A badge in a website footer costs nothing to display. The audit behind it costs a provider months of work and a meaningful fee every year. Checking which of the two you are looking at takes about an hour, and it is the most useful hour a buyer can spend before moving confidential documents onto someone else’s servers.
This guide is vendor due diligence on the vendor. It assumes you already know roughly what SOC 2 and ISO 27001 are and focuses on how to read the evidence.
How strong is the evidence? Five levels of data room security proof
Website badge or claim
Read for: Nothing to read. A logo is a starting point for questions, not evidence.
Trust center page
Read for: Lists frameworks, subprocessors and policies. Check the dates and whether documents sit behind an NDA.
ISO 27001 certificate
Read for: Certification body, accreditation, scope statement, expiry date and the standard version.
SOC 2 Type II report
Read for: Audit period, systems in scope, carve-outs, exceptions and the complementary controls you must run.
Report plus bridge letter and pen test summary
Read for: Covers the gap since the audit ended and shows recent independent testing of the application.
What should you ask a data room provider for?
Send one written request, early in the evaluation, listing everything at once. It saves rounds of back-and-forth and shows how organised the provider is.
| Document | What it proves | Usually shared |
|---|---|---|
| SOC 2 Type II report | Controls were designed well and operated over a period | Under NDA |
| SOC 3 report | A short public summary of the same audit | Publicly |
| ISO 27001 certificate | An information security management system was certified | Publicly or on request |
| Statement of Applicability | Which ISO controls apply and which were excluded | Under NDA, sometimes refused |
| Bridge letter | Management’s statement covering the time since the audit ended | With the SOC 2 report |
| Penetration test summary | An independent tester attacked the application recently | Under NDA, as a summary |
| Subprocessor list | Who else touches your data, such as the hosting provider | Publicly or on the trust center |
Every provider in our dataset lists some form of SOC 2 coverage, and 12 of the 18 also list ISO 27001. The headline claim alone does little to tell providers apart; the scope, period and entity behind each report are where they differ.
How do you read a SOC 2 report quickly?
A SOC 2 report can run past 100 pages. You do not need all of them. Work through it in this order.
- 1
Check the type and the period
On the opinion page, confirm it is Type II, not Type I, and note the audit period. Type I looks at a single date. Type II tests whether controls worked over a span, commonly six to twelve months.
- 2
Read the system description
Confirm the data room application itself is in scope, not only a corporate network or the hosting layer. Look for the product name you are buying.
- 3
Look for carve-outs
Many reports carve out subprocessors such as the cloud host. That is normal, but it means you rely on that host's own report for those controls. Note which services are carved out.
- 4
Read the exceptions
In the testing section, search for 'exception' or 'deviation'. A few minor exceptions with sensible management responses are common. Repeated exceptions in access control or change management deserve a question.
- 5
List your own obligations
Find the complementary user entity controls. These are the things the provider assumes you will do, such as enforcing two-factor login and removing users who leave. If you do not do them, the audit does not cover you.
The trust services criteria behind SOC 2 are published by the AICPA. Security is always included; availability and confidentiality are optional extras, and for a data room both are worth seeing in scope.
Check which layer a report covers
Data room security is layered: the cloud infrastructure, the application, and the provider’s own people and processes. A SOC 2 report can cover any of these, and many providers rely on their host’s report for the infrastructure layer, which is a normal arrangement. For each report you receive, ask four things: which entity it was issued to, which systems are in scope, which audit period it covers, and whether a bridge letter brings it up to date. Then ask how the layers outside that scope, such as application permissions and staff access, are controlled and evidenced.
What is a bridge letter, and why does it matter?
A SOC 2 report describes the past. If the audit period ended eight months ago, nothing in the report covers the eight months since. A bridge letter, sometimes called a gap letter, is a short statement from the provider’s management saying that no material changes to controls have occurred since the period ended.
It is not an audit opinion. It is signed by the provider, not the auditor. It still matters, for two reasons: it commits management in writing, and a provider that hesitates to issue one may be in the middle of a change it does not want to describe.
As a rule of thumb, if the report period ended more than three months ago, ask for the bridge letter. If it ended more than twelve months ago, ask when the next report is due.
How do you check an ISO 27001 certificate?
The certificate itself is one page. Check five things on it:
- The certification body. It should be a recognised auditor, and ideally accredited by a national accreditation body. The accreditation mark usually appears on the certificate.
- The scope statement. “Provision of virtual data room services” is useful. “Head office IT operations” is not.
- The dates. Certificates run for three years with annual surveillance audits in between. Check the expiry and ask for the latest surveillance report if the certificate is more than a year old.
- The version. The current version is ISO/IEC 27001:2022. Certificates under the 2013 version had to transition by 31 October 2025, and those that did not have expired, so a 2013 certificate shown today is a red flag worth raising.
- The legal entity. It should match the company you are contracting with, or clearly cover it.
The Statement of Applicability lists which controls the provider applied and which it excluded. Some providers share it under NDA, some refuse. A refusal is not damning, but an explanation of the main exclusions is a fair request.
What about penetration tests?
Certifications test process. A penetration test tests the product: someone tries to break into the application, escalate privileges, or reach another customer’s files. For a data room, the last of these is the scenario that matters most.
| Pen test detail | Good answer | Weak answer |
|---|---|---|
| Who ran it | Named independent firm | ”Our internal team” only |
| When | Within the last 12 months | Two or more years ago |
| Scope | The data room application and its API | The marketing website |
| Findings | High and critical findings fixed and retested | ”No issues found”, no detail |
| Format shared | Executive summary or attestation letter | Nothing, or a verbal assurance |
You will rarely see the full report, and you should not expect to. The summary is enough to judge whether the test was real.
Which answers should worry you?
Some responses are more telling than any document:
- “Our security is confidential.” Reasonable for internal details, not for the existence of an audit.
- Only a Type I report, years after launch. Type I is a common first step. Staying there suggests the provider has not committed to ongoing testing.
- A report from a different company name with no clear link to the entity you are signing with.
- Vague scope. If you cannot find the data room product named in the system description, assume it was not audited.
- No subprocessor list. You should know who hosts your data and in which region.
Equally, do not over-read a single minor exception. Auditors find small things in every organisation. What matters is the management response and whether the same exception appears again next year.
How does this fit into choosing a data room?
Security evidence is a gate, not a ranking. Once a provider clears it, the decision usually comes down to workflow, usability and price. Our review method weights security posture at 22% of the overall score, using certifications, two-factor login, watermarking, document rights control and audit depth, and the review pages list each provider’s certifications.
If you want to go one level deeper, the next question is what the provider’s own staff can see. Our piece on whether a data room provider can read your files covers encryption keys, support access and staff logging.
How long does vendor security review take?
For a single deal, a buyer or seller can usually complete this review in a day once the documents arrive. Allow a week for the provider to process an NDA and send the pack. Larger firms that approve vendors centrally may run a fuller security questionnaire; the documents above are the core of any such review, whatever form it takes.
Frequently asked questions
What is the difference between SOC 2 Type I and Type II?
A Type I report assesses whether controls were suitably designed at a single point in time. A Type II report tests whether those controls actually operated effectively over a period, commonly six to twelve months. For a data room, ask for Type II.
Will a data room provider share its SOC 2 report?
Most established providers share it under a non-disclosure agreement on request. A shorter SOC 3 report is often public. If a provider refuses to share any audited report, treat that as a significant gap.
How long is an ISO 27001 certificate valid?
Three years, with surveillance audits each year in between. Check the expiry date, the scope statement and the certification body, and ask for the latest surveillance audit if the certificate is more than a year old.
What is a bridge letter in a SOC 2 context?
A letter from the provider's management stating that no material changes to controls have occurred between the end of the last audit period and a recent date. It fills the gap until the next report and is signed by management, not the auditor.
What does a hosting provider's SOC 2 report cover?
The infrastructure layer: the data centers and cloud services the data room runs on. It is useful evidence for that layer. For the rest, ask the provider which entity and systems any other report covers, its audit period, whether a bridge letter is available, and how application permissions and staff access are controlled.