SOC 2 in Progress? How to Tell Customers and Keep Deals Moving

A buyer’s security team sends a short note: “Are you SOC 2 compliant? Please share your report.” You’re two months into a three-month observation window. The report doesn’t exist yet. The deal is supposed to close this quarter.

The answer isn’t “no,” and it definitely isn’t “yes.” It’s a specific, dated description of where you are, sent with enough evidence that the buyer’s reviewer can mark you as “in progress, acceptable” and move on. Done well, an in-progress SOC 2 becomes a reason to trust you: it shows you started before anyone forced you to.

Below: what you can truthfully say at each stage, the words to avoid, what to send instead of a report, why a bridge letter isn’t the answer for a first audit, and copy-and-paste templates for the emails, questionnaire answers and trust page you’ll need.

The short answer

Tell customers exactly where your SOC 2 stands: the report type, the CPA firm, the observation period dates and when you expect the report. Send a management-signed status letter and your security evidence in place of the report, offer a call with your security lead, and offer to commit to a report delivery date in the contract. Don’t call yourself SOC 2 compliant, certified or attested until the report is issued.

That’s the whole playbook. The rest of this article is the detail: what counts as “in progress,” what each stage lets you say, and the exact wording.

If you’re still deciding which report to get, start with SOC 2 Type 1 vs Type 2. If you want to know how long each stage takes, see How Long Does a SOC 2 Audit Take?

What you can say at each stage

“In progress” means something specific. Probo’s guide to announcing an in-progress SOC 2 puts the line clearly: “An engaged auditor or an observation period that has started counts. Creating an account on Vanta, Drata, or any other platform does not.” And: “If you cannot name the firm or the observation start date, you are not in progress. You are getting ready. Say that” (Probo, September 17, 2026).

That gives you five stages, each with its own honest sentence:

1. Preparing. You’ve started readiness work but haven’t signed with a CPA firm. Say you’re preparing for a SOC 2 Type 2 examination. Don’t give a report date yet; you don’t control one. What you can share is what already exists: policies, honest questionnaire answers, a recent penetration test.

2. Auditor engaged. You’ve signed an engagement letter with a licensed CPA firm. Now you can name the firm and the report type, and the buyer’s reviewer can look the firm up. That matters more since this spring’s Delve allegations put a spotlight on who actually issues a report.

3. Observation window open. Your controls are running and the clock has started. This is the stage where “in progress” is most credible, because you can give two dates: when the window started and when it ends.

4. Fieldwork. The window has closed and the auditor is testing. You can give a narrower expected report window, and this is the right time to firm up any delivery date you’ve promised.

5. Report issued. Now you can share the report under NDA, call yourself SOC 2 attested, and, once you’ve registered with the AICPA, display its SOC logo. For what happens next, see The Week After Your SOC 2 Report Lands.

Tranquility Cybersecurity’s guide uses similar stages and adds a useful rule: “Never promise a hard report date: the review period, fieldwork, and report drafting each take time you don’t fully control. Give stage-based updates instead” (TCSA). We agree with the first half and add one exception, covered below: when a deal depends on it, a contractual date with a sensible buffer is often what gets the signature.

Words to keep out of emails and your trust page

Probo’s version of the rule fits in two sentences: “You can describe the work. You cannot claim the result.” Four phrases cause most of the trouble:

• “SOC 2 certified.” Never, at any stage. Audit firm BARR Advisory puts it plainly: “completing a SOC audit does not result in any certification” (BARR Advisory). SOC 2 is an attestation: a CPA’s opinion on your controls. A buyer’s reviewer who sees “certified” learns that you don’t know what you’re buying.
• “SOC 2 compliant.” Not until the report is issued, and even then “we have a SOC 2 Type 2 report” is more precise.
• “Attested.” Same rule: only once the CPA firm has signed.
• The AICPA SOC logo. The AICPA’s SOC logos are “designed to help service organizations communicate they have received a SOC report issued by a licensed, independent CPA” (AICPA), and, as BARR notes, “Organizations may only use the logo if authorized to do so by the AICPA.” A badge from your compliance platform that says “SOC 2 in progress” isn’t the same thing, and shouldn’t look like it.

This isn’t pedantry. Statements about your security program are representations, and buyers, regulators and investors treat them that way. In its case against SolarWinds, the SEC alleged that the “Trust Center” section of the company’s website held its Security Statement, and that employees sent it to customers who asked about security practices (SEC complaint, October 2023). The SEC dismissed the remaining claims in November 2025, but the court had let claims based on that statement proceed for more than a year (Harvard Law School Forum on Corporate Governance).

And this spring, an anonymous writer describing themselves as a former Delve customer alleged that the compliance platform’s trust page “presented our company as fully secure before we had completed any compliance work, enabling us to close deals based on misrepresented security claims” (DeepDelver, March 2026). Delve disputes the allegations. The lesson for founders doesn’t depend on how they’re resolved: a trust page that runs ahead of the audit is a liability the moment a buyer checks it.

One more reason to be literal: buyers increasingly have software read your trust page for them. Drata now lets a buyer’s AI tool connect to a vendor’s trust center, because “Procurement and security teams are already using AI agents to speed up vendor reviews” (Drata, August 4, 2026). An agent summarizing “SOC 2 compliant” will repeat it to the reviewer as fact. A dated line that says “examination in progress, observation period ends March 31” survives the summary intact.

What to send instead of a report

A buyer who asks for your SOC 2 report is really asking a narrower question: can we trust this vendor with our data, and is there evidence? Until the report exists, you answer that question with a packet.

1. A status letter. One page on your letterhead, signed by your CEO or security lead: scope, criteria, CPA firm, report type, observation period, expected report window, and a short list of the controls you already run. It’s a management representation, so say so in the letter and make every line true. There’s an outline in the templates below.
2. Your auditor’s confirmation of dates, if they’ll give one. TechnologyMatch’s advice is precise about what this is worth: “Send the engagement letter, or a short letter from the audit firm that confirms the audit dates. It proves the work is booked. It gives no assurance on your controls” (TechnologyMatch, October 2026). Ask your firm early whether they’ll write a short confirmation, and ask before forwarding the engagement letter itself, which usually includes fees and terms.
3. Complete questionnaire answers. Answer the buyer’s questionnaire fully and accurately, based on the controls that are actually running today. A clean, fast questionnaire often carries more weight with a reviewer than the PDF they asked for. If the format is new to you, start with What Is a DDQ?
4. A recent penetration test summary. Most buyers ask for one anyway, and it’s real third-party evidence you can share before the audit finishes. Our Pentest Once a Year piece covers what reviewers look for.
5. A trust page status line. Dated, specific and updated whenever a date moves. Template below.
6. A call with your security lead. A 30-minute conversation between your security lead and their reviewer resolves more than another week of email. This is a big part of what our Sales Support team does.

Our free SOC 2 readiness checklist shows which of these you can already produce and which gaps a reviewer is most likely to find first.

Even after the report lands, the packet doesn’t go away. Whistic found that 68% of buyers are likely to request additional documentation even after receiving a SOC 2 or ISO 27001 report (Whistic 2023). Building it now is work you’d do anyway.

What is a SOC 2 bridge letter?

A SOC 2 bridge letter (also called a gap letter) is a short letter in which your management confirms that your controls haven’t materially changed since your last SOC 2 audit period ended. It covers the gap between that period and the next report.

Linford & Co, a CPA firm, describes the mechanics: the letter “is on the service organization’s letterhead and signed by the service organization, not the service auditor,” and “most bridge letters typically cover a period of no more than three months” (Linford & Co). Because the auditor doesn’t sign it, “they are not attesting to the design or operating effectiveness of the internal controls within the gap period.” Grant Thornton is blunter: “bridge letters are not audit deliverables” (Grant Thornton).

Here’s the part founders get wrong: a bridge letter can’t help with a first SOC 2. It bridges from an existing report, and you don’t have one. As TechnologyMatch puts it, “A bridge letter does nothing for a first-time company, because there is no earlier report to bridge from.” If a buyer asks for one during your first audit, they’re usually asking for the thing a bridge letter provides, a signed statement of where you stand, and the status letter above is the honest version of that.

You’ll need a real bridge letter later, every year, in the gap between one report and the next. The Type 1 vs Type 2 guide covers how long buyers will accept one.

Put the report date in the contract

Some buyers will wait for the report. Many will sign now if the report is a contractual deliverable. TCSA describes the second group: they “will accept contractual commitments instead — a security addendum with audit rights, breach-notification, and report-delivery obligations.” Find out which kind of buyer you have in the first security conversation, not the last.

If you commit to a date, pick one you can keep. The observation window can’t be shortened, and the report takes time after it closes: CBIZ’s study of 193 SOC reports found that “the average issuance duration was 69.9 days” after the period ended, with 85% issued within 100 days (CBIZ). Ask your audit firm how long they usually take, then add a buffer.

A clause along these lines works for many buyers. It’s an illustration, not legal advice; have your counsel adapt it:

SOC 2 report delivery. Vendor has engaged [CPA firm], an independent CPA firm, to perform a SOC 2 Type 2 examination of [product] covering the period [start date] to [end date]. Vendor will deliver the resulting report to Customer, subject to the confidentiality terms of this Agreement, no later than [date]. If Vendor expects to miss that date, Vendor will notify Customer in writing with a revised date at least [10] business days in advance. If the report is not delivered within [60] days after the original date, Customer may terminate this Agreement without penalty and receive a pro-rata refund of prepaid fees.

Two details make the clause easier to accept. Name the CPA firm and the period, so the buyer can verify both. And give them a real remedy if you miss; an escape hatch costs you little if your dates are sound, and it’s what lets their reviewer say yes now.

A Type 1 report can also unlock a deal sooner, if the buyer will accept one. Ask in writing before you change plans; the decision guide walks through when it’s worth it.

Copy-and-paste templates

Replace everything in brackets. If a bracket can’t be filled honestly yet, use the wording for an earlier stage.

Reply to “Are you SOC 2 compliant? Please send your report.”

Thanks for asking. Our SOC 2 Type 2 report hasn’t been issued yet, so here’s exactly where it stands:

• Auditor: [CPA firm]
• Scope: [product], [Security] criteria
• Observation period: [start date] to [end date]
• Expected report: [month], and we’re happy to put a delivery date in the contract

In the meantime I’ve attached a status letter signed by [name], our completed [questionnaire], and our latest penetration test summary. If it helps, [security lead] can join a 30-minute call with your security team this week.

Answer for the questionnaire line “Do you have a current SOC 2 Type 2 report?”

No, not yet. A SOC 2 Type 2 examination by [CPA firm] is in progress. The observation period runs from [start date] to [end date], and we expect the report in [month]. A management-signed status letter is attached, and we will provide the report when it is issued.

Don’t answer “Yes,” and don’t answer “N/A.” Then answer the control questions that follow based on what’s actually operating today.

Trust page status block

SOC 2 Type 2: in progress. Last updated [date].

We have engaged [CPA firm] to perform a SOC 2 Type 2 examination of [product], covering the [Security] Trust Services Criteria. Our observation period runs from [start date] to [end date], and we expect the report in [month]. Until the report is issued, we are not SOC 2 attested and do not display the AICPA SOC logo. To request our status letter, security questionnaire responses or penetration test summary, email [security@company.com].

Status letter outline

[Company letterhead] · [Date]

Re: SOC 2 Type 2 examination status

1. System in scope: [product and environment]
2. Criteria: [Security; add Availability, Confidentiality as applicable]
3. Auditor: [CPA firm], engaged on [date]
4. Observation period: [start date] to [end date]
5. Current stage: [readiness / observation period / fieldwork]
6. Expected report: [month]
7. Controls in operation today: [for example, MFA on all systems, encryption at rest and in transit, quarterly access reviews, centralized logging, annual penetration test completed [date]]
8. Contact: [name, title, email]

This letter is a representation by [Company]‘s management. It is not an auditor’s opinion. We will provide the SOC 2 Type 2 report upon issuance.

[Signature, name, title]

Milestone post when the observation window opens

Today we started the observation period for our SOC 2 Type 2 examination with [CPA firm]. For the next [three] months our controls run under audit, and we expect the report in [month]. If you’re evaluating [product] and your security team has questions before then, our current status and evidence are at [trust page link].

Turning the SOC 2 journey into sales traction

An in-progress SOC 2 is more useful to sales than most teams realize, because it’s news you can share three times: when the auditor is engaged, when the window opens and when the report lands. Each is a reason to get back in touch with a stalled prospect.

A few habits make it work:

• Bring it up first. Y Combinator’s enterprise sales lecture names the biggest mistake founders make at the closing stage: getting surprised by security, privacy, legal and compliance reviews. Put your SOC 2 status in the first security conversation and the buyer plans around it.
• Give sales one sentence and one owner. Every rep should have the current stage sentence from the stages above, and one named person to route security questions to. Improvised answers are how “we’re basically compliant” ends up in an email.
• Keep a waiting list. Track every deal that’s waiting on the report. Send each an update when the stage changes, and send the report to all of them the day it’s issued.
• Update the trust page on the same day as everything else. A stale “expected in Q3” in November undoes the credibility the rest of the packet built.

Our client Augment Code is a good example of what happens when the report finally lands. According to our case study, Augment’s “product was gaining traction, but security concerns kept stalling procurement.” Five months after starting, with zero deviations in the audit, “Augment wasn’t just compliant—they were closing enterprise deals,” and the clean report “drove 15x growth in security-qualified leads in the first 3 months after achieving SOC 2 Type 2.”

When the date slips

Dates slip. Evidence gaps turn up in fieldwork, auditors get busy, a control change needs a second look. What damages trust isn’t the slip; it’s the buyer finding out from a stale trust page.

When you know a date will move, tell every waiting buyer before they ask, with the new date and the reason in one line:

A quick update on our SOC 2 Type 2: our auditor, [CPA firm], has finished testing and the report is now expected in [new month] instead of [old month], because [one-line reason, for example: the firm’s report review is taking longer than scheduled]. Nothing about the scope or our controls has changed. We’ll send the report the day it’s issued, and [security lead] is available if your team has questions in the meantime.

If you put a date in a contract, the notice period in the clause is your deadline for sending this. Update the trust page the same day.

Summary

An in-progress SOC 2 is a sales asset if you describe it precisely. Name the CPA firm, the report type and the observation period dates. Say “in progress” only once there’s an auditor or a running window, and never say “certified.” Send a status letter, your auditor’s confirmation of dates, complete questionnaire answers and a recent pentest summary in place of the report. Don’t offer a bridge letter for a first audit. And when a deal depends on it, put a report delivery date with a sensible buffer in the contract.

Our SOC 2 Type 2 team works as your embedded security function: we run readiness and the observation window, coordinate with the auditor, and through Sales Support we answer questionnaires and join security calls while the audit is in progress and after the report lands. Our clients maintain a 99% audit pass rate, and we bill in 15-minute increments with no retainers or minimums.

If a deal is waiting on your SOC 2 right now, book a 15-minute call. Our free Founder’s Security Cheat Sheet includes the SOC 2 script founders use on security calls, and startups can claim their first 8 hours free.

Download the SOC 2 readiness checklist (PDF)

The key controls auditors check across all 10 SOC 2 areas, the evidence they ask for, and how to score your readiness.

Download PDF