Security attestations, free trials and offline support across QHSE software: what 209 profiles document

What the records show

1. More than half of the profiles name a security attestation. 118 of 209 (56%) name SOC 2 or ISO 27001. SOC 2 appears in 77 profiles and ISO 27001 in 75; 34 name both. Of the 77 that name SOC 2, 59 name a Type II report, 3 name Type I only and 15 do not say which type.
2. 83 profiles have no certification entry. That is 40% of the records. It means we recorded none, not that the vendor holds none: the records come from vendor pages, so a vendor that shares its reports only after a sales conversation, or whose trust portal was not among the pages reviewed, shows up here as a blank. A further 8 profiles name only other schemes, such as an ISO 9001 quality certificate, without SOC 2 or ISO 27001.
3. The share varies by category, but the categories are small. Among the 12 categories with at least 5 profiles, the share naming SOC 2 or ISO 27001 is lowest in Occupational Health (4 of 11, 36%) and highest in Asset Management (6 of 7, 86%) and Construction Safety (6 of 7, 86%). With between 5 and 43 profiles in a category, one added or corrected record moves a percentage by several points, so treat the spread as a pattern in this sample and not as a property of a software type.
4. A documented free trial is the minority position. 48 of 209 (23%) document a free trial, 41 of 209 (20%) offer a trial or demo only on request, and for 120 of 209 (57%) we could not establish either. By category, the share with a documented free trial is lowest in Emergency Management (0 of 6, 0%) and highest in Audits & Inspections (11 of 15, 73%).
5. Offline support is the least classified of the three. 39 of 209 (19%) have a documented offline workflow and 51 of 209 (24%) a partial one. 1 is recorded as needing a connection for the workflow we assessed, 1 is not applicable (document templates, where offline use is not a meaningful question), and 117 of 209 (56%) are not yet classified. Among the 91 profiles that have been classified, 39 of 91 (43%) are documented as working offline and 51 of 91 (56%) partly.
6. Few profiles document all three, partly because the offline field is incomplete. 7 profiles name SOC 2 or ISO 27001, document a free trial and document an offline workflow. 28 combine an attestation with a free trial and 24 combine an attestation with a documented offline workflow. A documented free trial is about as common among profiles that name an attestation (28 of 118 (24%)) as among those that do not (20 of 91 (22%)), so in these records the two are not linked.

Security attestations named by the vendor

A certification counts here when a vendor page names it. We read the name of each entry: "SOC 2" matches any SOC 2 report, "Type II" is counted separately when the entry says Type II or Type 2, and "ISO 27001" matches every edition of the standard, with or without the "IEC" prefix. 260 entries are recorded across 126 profiles; 231 of them say in so many words that the report or certificate was not reviewed, and none records a document that was.

Other schemes appear less often. Each row counts a profile once, however many of the listed schemes it names, and a profile can appear in several rows:

The schemes answer different questions. SOC 2 is an audit report written by an independent accounting firm about a described system and a set of trust criteria; a Type I report looks at how controls are designed on one date, a Type II report at whether they operated over a period, commonly three to twelve months. ISO 27001 is a certificate for an information security management system, issued by a certification body after an audit, and it covers the scope written on the certificate. ISO 9001, 14001 and 45001 concern quality, environmental and safety management and say little about how a software product protects customer data. Neither SOC 2 nor ISO 27001 is a government certification, and a profile that names one has not thereby said which of its products or hosting locations the report covers.

Free trials

Each profile carries one of three trial states. "Free trial documented" means the vendor's own pages advertise a free trial. "Trial or demo on request" means access follows a request or registration form, or a conversation with the vendor, which does not by itself establish that the product is free to try. "Not established" means our research did not find a statement either way; it is not a finding that no trial exists.

A trial that the vendor documents is worth using early in a shortlist, because it lets a team test the workflows that matter before a contract exists. Ask what the trial includes: a trial limited to a sandbox with sample data will not show how imports, permissions or the integrations you need behave in your own environment, and a trial may leave out single sign-on and the administrator features that a security review depends on.

Offline support

The offline classification is the one used in the directory filter. "Documented" means the reviewed pages describe an offline workflow for the assessed use. "Partial" means some functions work offline and others do not. "Connection required" means the assessed workflow needs a connection. "Not yet classified" means the profile has not been through the offline review, which is a statement about our coverage, not about the product.

For field work the useful questions are narrower than the label. Ask the vendor to show the exact task your inspectors perform, starting with no connection, including photos and signatures, and then reconnecting; ask what happens when two people edit the same record offline. The guide to offline inspection apps sets out that demonstration step by step.

By category

The charts below use the 12 categories with at least 5 profiles, which together hold 180 of the 209 profiles. The other 12 categories hold 29 profiles between them and are pooled in the table and the CSV, so that no row describes one or two products. A profile belongs to one category, the one shown in the directory.

How many profiles document all three

7 of 209 profiles (3%) name SOC 2 or ISO 27001, document a free trial and document an offline workflow. This page gives the count and not the names, because the offline classification covers only 91 profiles, and such a list would show which products we have reviewed furthest, not which suit a buyer. The full split of the 209 profiles over the three yes-or-no questions is below; the "offline workflow documented" column counts only the documented classification, so a partial workflow is counted as no.

How to read these numbers

• Named by the vendor, not reviewed by us. Every attestation counted here is a statement on a vendor page. We did not read an audit report or inspect a certificate for any of them, so none is verified, and the counts say how many vendors claim a certification, not how many hold a valid one.
• A blank is not a negative. A profile with no certification entry may hold a certification that its public pages do not mention, share its report only under a non-disclosure agreement, or be a newer product. Ask the vendor; do not treat a blank as a failed check.
• A named attestation is not a security assessment. It does not say what the report covers, whether the audit period is current, whether the exceptions are material, or whether the product you would use sits inside the audited system. A SOC 2 report can cover one product of a vendor and not another.
• The trial and offline fields have different coverage. The trial status was recorded for every profile, with "not established" where the pages are silent. The offline classification has been done for fewer profiles, so every offline figure and the three-way count depend on that coverage and are likely to rise as more profiles are classified.
• Categories are small. Percentages in a category of five to twelve profiles are shaky; read the counts. The categories are the directory's own, and a product that serves several is counted in one.
• These are counts of profiles, not of the market. The 209 profiles are the products we have researched, not every QHSE product, and a vendor with a public security page is more likely to show an attestation here than one without.

What to ask when a profile names an attestation

1. Which product, service and hosting environment does the report or certificate cover, and is the product you will use inside that scope?
2. For SOC 2, which type, which period and which trust criteria were audited, and were any exceptions reported? For ISO 27001, which certification body issued the certificate, what is its scope statement and when does it expire?
3. Can the full report be shared before signature, under a non-disclosure agreement if needed, and who inside your organisation will read it?
4. What is not covered: subprocessors, customer-specific configurations, mobile apps, integrations and any artificial intelligence features that send data to a third party?
5. How and when are you told if the certification lapses or the audit finds a significant issue? Put the answer in the contract, not only in the sales deck.

The RFP template and the demo checklist turn these questions into written requirements and demonstration tasks.

How the figures were computed

The figures are computed by a script from the structured profile records, and the page and the CSV are rebuilt from the same output, so a count can change only when a record changes. The certification field holds the name of each certification the vendor states, with a note on where it was found. The script reads the name before the first bracket, so a source note that mentions another scheme is not counted. Free-trial status is the field recorded on each profile. The offline classification is the one the directory uses; a profile that has not been reviewed counts as "not yet classified", and the document-template product counts as "not applicable". A profile's category is its own category, or the catalogue category where the profile has none. Percentages are rounded to whole numbers. Records were checked through 3 October 2026.

No score, rating, price or payment is an input, and the page does not rank or name any product. The profile set is described in the methodology, and the same records feed the 2026 report on vendor transparency.

Disclosure. One of the 209 profiles belongs to a vendor that pays for sponsored placement on this site, and the editor works at that vendor. Its record was read by the same rules as every other, it is counted in every figure above like any other profile, and it is not named on this page.