How to share — or gate — a SOC 2 report

Why email attachments fail

Once the PDF is in someone's inbox you have no expiry, no watermark, no audit trail and no ability to revoke. The same PDF then ends up in their next vendor review pack, shared drives, and eventually on a competitor's desktop.

Email also breaks the chain of custody auditors expect. When an examiner asks who has seen your SOC 2 report in the last twelve months, "I sent it to a few prospects" is not an acceptable answer. You need names, companies, timestamps, and proof of NDA acceptance. Email threads do not give you that.

Examples of unsafe sharing

Unsafe sharing usually starts with good intentions. A sales rep wants to unblock a deal before quarter-end, so they attach the SOC 2 PDF to a follow-up email. A founder forwards the report to an advisor who asks for it. A customer success manager uploads it to a shared Dropbox folder so an enterprise client can "take a look."

Each of these creates an uncontrolled copy. The sales rep's email lives in the customer's inbox forever, forwarded to procurement and legal. The advisor stores it in a personal Google Drive with no retention policy. The Dropbox link is discoverable by anyone with access to the folder, and there is no record of who opened it.

Another common mistake is publishing the full SOC 2 report on a public marketing page to "build trust." This reveals control descriptions an attacker can use to map your environment. It also exposes exception notes that may worry customers who do not have the context to interpret them. The right balance is a public badge and summary with the full report gated behind an NDA workflow.

What can be public vs what should be gated

Not everything in the SOC 2 package needs to be locked down. There are three tiers of SOC 2 content, and only the full report itself should sit behind an NDA in most cases.

Public tier: the SOC 2 badge, a one-paragraph summary of scope and criteria, and the observation-period dates. A public badge tells customers you have passed an independent audit without exposing control detail. The summary should be two or three sentences — report type, criteria covered, period, and auditor name. No more, no less.

NDA-gated tier: the full SOC 2 Type 2 report, the bridge letter (if applicable), and the most recent letter of attestation. These contain the control matrix, the auditor's test results, the exception list, and the management response. Customers who are in active procurement should get access, but only after they have identified themselves and agreed to confidentiality terms.

Internal-only tier: raw evidence-collection logs, the auditor's working papers, and any pre-remediation drafts. These are never shared externally — they surface only under legal compulsion or during an acquisition due-diligence room.

When not to share the report at all

There are legitimate situations where sharing the SOC 2 report is the wrong move, even under NDA.

First, if the report contains unresolved exceptions or a qualified opinion — material weaknesses not fully remediated by the end of the observation period. Sharing this mid-deal is usually deal-fatal unless paired with a clear remediation timeline and evidence of progress. It is often better to share the previous clean report plus a bridge letter and a written update on remediation status.

Second, if the report is expired. SOC 2 Type 2 reports cover a fixed observation period and are typically treated as current for about twelve months from the report date. Some customers will accept an expired report if a new one is in progress, but lead with the bridge letter and a commitment date rather than the stale report itself.

Third, if the requester cannot be verified. A personal email address, a competitor domain, or a request pattern that looks automated are all reasons to pause and verify before releasing anything. A good NDA workflow captures company, work email, and intent; escalate to manual review if any of those feel off.

Fourth, during an active incident or a regulatory investigation. If you are currently responding to a breach or a regulatory inquiry, legal may advise pausing external sharing of audit reports until the situation is resolved — the report could become discoverable in litigation if it is widely distributed in the meantime.

The minimum bar for a release flow

A defensible SOC 2 release flow has four ingredients: an NDA (or signed acceptance), a watermark tied to the individual requester, a time-limited download link, and an audit log of every view and download.

The NDA establishes legal accountability. It does not need to be a forty-page custom agreement — a short click-through acceptance with the requester's name, company, and email is enough for most mid-market deals. Enterprise customers may require their own paper, but you can still route that through a portal so the acceptance is timestamped and logged.

The watermark creates traceability. If a PDF leaks, the diagonal watermark tells you exactly which requester downloaded it. Most procurement teams understand this and will not object — many enterprises prefer watermarked copies because it proves the report came from you and has not been altered.

Time-limited links reduce exposure. A twenty-four hour window is standard. It gives the reviewer time to read the report and share it with their security team without leaving a permanent access path open. If the customer needs more time, treat it as a renewal request, which creates another log entry.

The audit log is what you show your own auditors. It should record the request, the NDA acceptance, the approval decision, the download timestamp, and the requester's identity. This turns a vague "we shared it with prospects" into a concrete list of every human who has touched the document.

The customer's perspective: what they actually need

Understanding what customers need helps you decide how much to share and how quickly.

A mid-market SaaS customer typically needs three things: proof that an independent audit happened, proof the scope covers the service they are buying, and proof the report is current. A public badge and a short summary satisfy the first two; the third usually requires seeing the report itself, which is where the NDA-gated download comes in.

An enterprise or financial-services customer needs more — the full report, the bridge letter, the management response, and sometimes the right to contact the auditor directly. They may ask about the exception list and how you handled findings. For these customers, a smooth NDA workflow with fast approval is a competitive advantage.

A small startup customer often does not need the full report at all. They may not have a security team capable of reading it, and they are evaluating you on signals of maturity rather than control detail. The public badge and a short FAQ are usually enough to unblock the deal; offering the full report anyway is fine, but do not be surprised if they never request it.

Recommended workflow

Start by uploading the SOC 2 PDF to your trust portal and marking it NDA-required. The document still appears on the public page so customers know it exists, but the download button triggers a request flow instead of serving the file directly.

Next, configure your NDA. Choose between a built-in click-through template, your own uploaded text, or a full e-signature integration like DocuSign or SignNow. For teams under ten security reviews a month, click-through is usually enough; for higher volumes, e-signature gives you a legally stronger paper trail.

Plan for review. Every request is approved manually, which lets you spot unusual patterns — a competitor domain, a free email address — before releasing the file. Keep the queue in a shared inbox or rota so approvals do not stall when one person is away.

Enable watermarking and set the expiry. The watermark should include the requester's name and email on every page. The link expiry should match your policy — twenty-four hours is standard, but some teams prefer seventy-two hours for long holiday weekends.

Finally, test the full flow end to end. Request the document yourself, sign the NDA, download the PDF, and check the audit log. Verify the watermark is visible, the link expires on schedule, and the log captures every step. Run this test after every SOC 2 refresh so you know the process still works when a real customer shows up.

Set the SOC 2 to NDA-required

In VendorLens, mark the SOC 2 PDF as NDA-required. It still appears on the trust page so customers can see it exists, but downloading requires a request and an approved NDA. This single toggle is what separates a public brochure from a controlled document release.

If you have multiple SOC 2 reports — for example, a Type 2 and a bridge letter — upload each as a separate document and set the visibility independently. Some teams make the bridge letter public while keeping the full Type 2 gated, so customers get confidence the audit is current without exposing control-level detail.

Configure NDA acceptance

Use the built-in template, your own NDA text, or a DocuSign / SignNow flow. Requests are approved by your team after the NDA is accepted, so you see every requester before a document is released.

The NDA text should cover three things: confidentiality of the report, prohibition on redistribution, and permission to share internally within the requester's organization for the purpose of vendor evaluation. Keep it to one page if possible — long NDAs slow down procurement teams and increase the chance a customer abandons the review.

Watermark the download

VendorLens injects a diagonal watermark with the requester's name and email on every page of the PDF on download. Even if the customer forwards the file, the source is traceable — this is not about distrusting your customers, it is about creating accountability that satisfies both your auditors and theirs.

Watermarking also protects against accidental leaks. A customer may forward the PDF to a colleague without thinking; if that colleague forwards it again, the original watermark is still there. In a worst-case scenario where the file appears somewhere public, you know exactly which organization it came from.

Expire the link

Default token expiry is 24 hours. For longer access, configure a longer window, but most reviews do not need more than a day — a reviewer typically downloads the PDF, reads it, and shares selected pages with their team within a single working session.

If a customer asks for an extension, treat it as a new request. This creates a fresh audit log entry and reminds the requester that access is temporary. Some teams offer a seventy-two hour window for enterprise deals with complex procurement committees — the key is to document the policy and apply it consistently.

Keep the audit log

Every NDA signature, request, approval, view and download is logged with a timestamp. This is what you show to your own auditors when they ask how you control distribution. The log should include the requester's name, email, company, document version, and action taken.

Review the log weekly for the first quarter after launch. Look for repeat requesters, unusual domains, and failed requests. A failed request is often a sign the customer hit the expiry window or had a corporate firewall issue — following up proactively improves your close rate and shows customers you take security seriously.

Building an internal policy around SOC 2 sharing

Ad-hoc sharing works until someone forwards the PDF to the wrong Slack channel. A short internal policy keeps everyone aligned.

Assign an owner. One person on the security or compliance team should own the SOC 2 distribution policy, the NDA template, and the approval queue. They do not need to approve every request personally, but they own the rulebook.

Define approval tiers. Self-serve for known-good domains and repeat customers. Manual review for new companies, competitors, personal emails, or unusual request patterns. Escalation to legal for government, law enforcement, or subpoena requests.

Set a refresh cadence. Review the NDA template quarterly and the approval rules monthly. After each new audit cycle, replace the old report in the portal and update the public badge dates — a trust center with a report from two audits ago looks neglected.

Train sales. The sales team should know the portal link by heart and should never email the SOC 2 PDF directly. One well-meaning attachment can undo months of controlled-release discipline.