Evidence-first authority page
SOC 2-Certified AI Agents: Directory and Verification Standard
A directory of AI agents verified as SOC 2-certified against a primary source, and the standard a product must meet to be listed here.
Direct answer
This page lists AI agents with a verified SOC 2 report or certification on file from a primary source. No agent currently has a verified SOC 2 receipt on file, so the directory below is empty; the presence of 'SOC 2' language on a vendor's marketing page is not treated as equivalent to a verified report.
Last reviewed 2026-08-29
This page remains noindex while its page-level source receipts are completed and verified. It is available for review, not presented as publication-ready authority.
What SOC 2 actually certifies
SOC 2 is an auditing standard covering a service organization's controls around security, availability, processing integrity, confidentiality, and privacy — Type I assesses controls at a point in time, Type II assesses their operation over a period, typically 6-12 months. A vendor claiming 'SOC 2 compliant' without specifying Type I or Type II, the audit period, or the trust-service criteria covered is making a materially incomplete claim.
Why this directory is currently empty
- SOC 2 reports are typically confidential documents shared under NDA rather than published publicly, which makes independent verification from outside the vendor relationship genuinely difficult for a public directory.
- A vendor's public 'SOC 2 Type II' badge or landing-page claim is not, on its own, the audit report — verification here requires either a published summary from a recognized auditor or direct confirmation from the vendor's trust/security page with a specific, checkable reference.
- Until a specific, checkable reference is available for a given product, that product is not listed here, regardless of what its marketing materials state.
How to verify a vendor's SOC 2 status yourself
Ask the vendor directly for their current SOC 2 report (Type II is the more meaningful standard for ongoing operations) and check the audit period is recent, the trust-service criteria covered match your actual concern (security alone is a narrower scope than security plus confidentiality and privacy), and any noted exceptions in the auditor's opinion.