SOC 2 and ISO 27001 in QHSE Software: What 212 Profiles Say

A security review can reach a QHSE software shortlist late, after the demos, when a team may already have formed an impression from a badge on a vendor's website. This article looks at what SOC 2 and ISO 27001 statements are worth at the start of an evaluation, using the counts in our security, trial and offline evidence study, and then sets out how to turn a claim into a document you can read.

The short version: more than half of the profiles we researched name one of the two schemes, none of those statements comes with a report we have seen, and a missing statement tells you very little. A claim and its absence are both starting points for a question.

The figures at a glance

The box below is built from the same generated file as the study page. The sections that follow explain how to read each number.

What vendors state, in numbers

We researched 212 QHSE, EHS and ESG software profiles. Of those, 122 of 212 profiles (58%) name SOC 2 or ISO 27001 on a vendor page. SOC 2 appears in 78 of 212 profiles (37%) and ISO 27001 in 79 of 212 profiles (37%); 35 profiles name both. Those three numbers fit together: 78 plus 79 less the 35 that name both gives the 122.

Of the 78 profiles that name SOC 2, 60 name a Type II report, 3 name Type I only, and 15 do not say which type.

At the other end, 82 of 212 profiles (39%) have no certification entry in our records, and a further 8 name only other schemes, such as a quality management certificate.

The figures also differ by category, but the categories are small. Among the 13 categories with at least five profiles, the share naming SOC 2 or ISO 27001 is lowest in Occupational Health (4 of 11, 36%) and highest in Asset Management and Construction Safety (6 of 7, 86% in each). With 5 to 43 profiles in a category, one corrected record moves a percentage by several points, so read this as a pattern in our sample, not a property of a type of software. The study page has the full table and a CSV.

Other schemes are named too

The chart counts profiles that name a scheme from each of seven other families; a profile can appear in several bars.

The most common family is the ISO management system standards for quality, environment, occupational health and safety, medical devices or continuity, named by 27 of 212 profiles (13%). They say little about how a product protects customer data. The security-related families are smaller: SOC 1, SOC 3 or ISAE 3000 appear in 12 profiles, government programmes such as FedRAMP, TX-RAMP or CMMC in 10, and the ISO/IEC extensions for cloud security, privacy information management or AI management (27017, 27018, 27701 and 42001) in 9.

What a named attestation does and does not prove

SOC 2 is a report issued by a CPA firm. The AICPA, which promulgates the professional standards for SOC engagements, titles its guide to the report as reporting on an examination of controls at a service organisation relevant to security, availability, processing integrity, confidentiality or privacy. In general terms, a Type I report is described as covering the design of controls at a point in time, and a Type II report as also covering how they operated over a stated period; the report's own text sets out what it covers, which is why a badge alone is thin evidence. It is a report, not a certificate, so read the opinion, the system description and any exceptions it lists.

ISO/IEC 27001 is a standard for information security management systems. ISO publishes the standard, and its page for the 2022 edition describes it as defining the requirements such a system must meet. ISO itself does not certify anyone: its certification page says certification is performed by external certification bodies and that a company cannot be certified by ISO. A certificate therefore shows that a named certification body found an organisation's management system within a stated scope to meet the standard, on the dates on the certificate.

What a statement on a vendor page adds. In our records the statement is the vendor's own, and we did not read a report or inspect a certificate for any of them. Of the 266 certification entries recorded, 236 say in so many words that the report or certificate was not reviewed, and none of the other 30 records a review. So the 122 profiles above are 122 vendors that claim SOC 2 or ISO 27001, not 122 that hold a valid, current, relevant one. A claim can be accurate and still not cover the product you would buy.

A blank is not a negative

The 82 profiles with no certification entry deserve the same care in the other direction. A blank means we recorded none from the pages we read. It does not mean none exists. A vendor may share its reports only after a sales conversation, keep them in a trust portal that was not among the pages reviewed, hold a certification for a different entity, or be a newer product still within its first audit cycle.

So do not filter a shortlist on the presence of a badge: it removes vendors who simply do not publish one and keeps vendors whose claim has not been tested. Ask every vendor the same question in writing and compare the documents you get back.

How to ask for the report

The aim is to move each claim to a document, with every vendor going through the same steps so the answers are comparable. This sequence works for either scheme.

1. Name the product and environment. Ask which product, service and hosting environment the report or certificate covers, and confirm that the product, edition and region you would use sit inside it. Our hosting and data location study shows what the records say about where data is held.
2. Ask for the document itself. For SOC 2, the full report, not a summary or a marketing page; for ISO 27001, the certificate and its scope statement. Offer a non-disclosure agreement if needed, and say who will read it.
3. Check the dates. For SOC 2, the type, the audit period and how long ago it ended. For ISO 27001, the certificate's issue and expiry dates.
4. Read the exceptions and the carve-outs. A SOC 2 report lists exceptions found in testing and describes which functions are carved out to subservice organisations, such as the hosting provider. It also lists controls that you, as the customer, are expected to operate yourself.
5. Check who issued it. For SOC 2, which CPA firm signed it. The AICPA's SOC page carries a notice urging service organisations and CPA firms to evaluate SOC services thoroughly, which is a reasonable prompt to ask. For ISO 27001, which certification body issued the certificate, and whether it is accredited. ISO's certification page points to the accreditation community's IAF CertSearch database as a way to confirm certification and accreditation status.
6. Ask about what is not covered. Subprocessors, customer-specific configurations, mobile apps, integrations and any AI features that send data to a third party may fall outside the audited system; the AI statements study counts what the records say about AI features.
7. Write the notification duty into the contract. Ask how and when you will be told if the certification lapses or an audit finds a significant issue.

The RFP template turns these questions into written requirements, and the demo checklist scripts the hands-on tests that sit beside the document review. If the vendor will also connect to your other systems, the integration article covers what to ask about that.

What to do at each stage of a purchase

At longlist stage, use the statements as a prompt, not a score: a named scheme is a reason to ask early for the document, and a blank is a reason to ask, not to exclude. Our buying guide covers the wider shortlist. At shortlist stage, put the seven steps above into the questionnaire for every vendor and give your security reviewer time to read a report. At contract stage, keep the scope, the dates and the notification duty with the agreement, and diarise the expiry of whatever you were shown. Security evidence ages, and a decision made on a report from one audit cycle does not automatically hold in the next.

A free trial is one way to test the product itself, and a trial is documented for fewer profiles than a certification: see what is documented about free trials. The two are not linked in our records: 30 of 122 profiles that name an attestation also document a free trial (25%), a slightly higher share than among those that do not (20 of 90 profiles, 22%).

Method and limits

The counts come from the structured profile records behind the directory, computed by a script, and the study page and its CSV are rebuilt from the same output, so a number changes only when a record changes. A certification counts when a vendor page names it. We read the name of each entry: "SOC 2" matches any SOC 2 report, "Type II" is counted separately when the entry says Type II or Type 2, and "ISO 27001" matches every edition of the standard. Records were checked through 11 October 2026. The methodology describes the profile set.

Four limits apply. These are vendor statements that we did not verify. The 212 profiles are the products we researched, not every QHSE product, and a vendor with a public security page may be more likely to show an attestation here. Categories are small. And a count of profiles says how many vendors claim something, not how secure any product is. No score, price or payment is an input, and nothing here ranks or recommends a product.

Disclosure. One of the 212 profiles belongs to a vendor that pays for sponsored placement on this site, and the editor works at that vendor. Its record was read by the same rules as every other and is counted in every figure above like any other profile. It is not named in this article.

FAQ

Does a SOC 2 or ISO 27001 mention on a vendor's website mean the product is secure?

No. It means the vendor says it holds the attestation. Only the document or certificate shows whether it is current, covers your product and records any exceptions.

Is SOC 2 Type II better than Type I?

They answer different questions. Type I looks at how controls are designed at one date; Type II looks at whether they operated over a period. In our records 60 of the 78 profiles that name SOC 2 name Type II.

Sources

• The QHSE Standard: Security, trial and offline evidence 2026, the counts and CSV behind every figure
• ISO: ISO/IEC 27001:2022, Information security management systems and ISO certification, both opened on 3 October 2026
• AICPA: System and Organization Controls (SOC) suite of services, opened on 3 October 2026