The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Most vendors do not publish their SOC 2 report on an open web page. You request it through a route the vendor controls, and that route depends on the vendor. For AWS it is AWS Artifact in the AWS console. For Vercel it is the Trust Center. For Supabase it is the organization dashboard, and only on a Team or Enterprise plan. For GitHub it is the enterprise Compliance page, not the organization page. For Stripe it is the Dashboard, for an Owner or Administrator.
This guide verifies the official routes for those five vendors. The title also refers to 25 additional providers, which are not named here, so their routes are not covered. The checklist at the end applies to any vendor’s trust portal.
As an Amazon Associate I earn from qualifying purchases.
Quick answer: where each report lives and who can get it
| Vendor | Where to start | Who can get the SOC 2 report | Other conditions |
|---|---|---|---|
| AWS | AWS console, then AWS Artifact | Any account that accepts the NDA in Artifact | SOC 1 and SOC 2 require an NDA; SOC 3 is public and needs no Artifact access |
| Vercel | Vercel Trust Center at security.vercel.com | Users who request access through the Trust Center | Public availability and eligibility are not stated in the source reviewed |
| Supabase | Organization dashboard, then Legal Documents | Team or Enterprise plan customers | Annual examination; rolling 12-month report window |
| GitHub | Enterprise Compliance page, then Resources | Enterprise owners (SOC 2 Type 2 and SOC 1 Type 2) | Organization Settings page lists SOC 3 and other materials, not SOC 2 |
| Stripe | Dashboard, then Compliance & Documents, then Stripe documents | Dashboard Owners and Administrators | Terms may need to be accepted; no separate NDA; downloads are watermarked |
Choose the right report before you request it
A vendor often publishes more than one report, and they serve different purposes. Check these three things before you download anything.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Report type. A SOC 2 report is restricted and detailed. A SOC 3 report is a high-level summary. AWS and Stripe both publish a public SOC 3, which cannot substitute for a restricted SOC 2 report in a detailed review. Stripe also issues SOC 1 reports, which address a different scope.
- Scope. Read which systems or services the report covers. Supabase states that its SOC 2 coverage applies to its own product and control environment and does not transfer to customer environments outside that boundary. Your own configuration and responsibilities sit outside the report.
- Audit period. Confirm the period the report covers. Stripe describes its SOC 1 and SOC 2 Type II reports as covering control design and operating effectiveness over a 6 to 12 month period; its Help page does not state a publication date. Supabase describes an annual examination with a rolling 12-month window running March 1 through February 28 of the following year.
Reports generally assess the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. Which criteria a given report covers is stated in the report itself, so read the scope section rather than assuming.
#1 Best Overall
Vendor-by-vendor routes
AWS: AWS Artifact
AWS Artifact is AWS’s self-service portal for compliance documents. AWS also describes it as a route to certain AWS Marketplace ISV compliance reports, but that feature covers only the listed marketplace context and should not be read as a general portal for every vendor. AWS’s help article on downloading and sharing Artifact documents is at repost.aws/knowledge-center/download-share-artifact-documents.
- Sign in to the AWS console and open AWS Artifact.
- Choose View reports, then AWS reports.
- Read the report description and audit period for each document to select the one that matches your review.
- For a SOC 1 or SOC 2 report, accept the NDA and download the document. SOC 3 is public and downloads without Artifact access.
The overview is at aws.amazon.com/artifact/.
Vercel: Trust Center
- Open the Vercel Trust Center at security.vercel.com.
- Find the SOC 2 Report in the list of documents.
- Select Get access and request access to the security documentation.
The Trust Center presents this as a request process. Do not expect an immediate download, and do not assume the report is public. The source reviewed does not state the eligibility criteria for approval.
Supabase: organization Legal Documents
- Sign in to Supabase and open the dashboard for the organization.
- Open Legal Documents.
- Confirm the organization is on a Team or Enterprise plan. Supabase documents that the SOC 2 Type 2 report is available only to customers on these plans.
Supabase’s compliance page is at supabase.com/docs/guides/security/soc-2-compliance. Read the rolling 12-month window to determine which period the report you download covers.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteGitHub: enterprise page, not the organization page
GitHub has two access points, and they give different reports. Use the one that matches your account structure.
- Enterprise. An enterprise owner opens the enterprise’s Compliance page and downloads the SOC 2 Type 2 report under Resources. The same page also provides SOC 1 Type 2.
- Organization. Settings > Security > Compliance lists SOC 3 and other materials, not SOC 2. If you need the SOC 2 report, check whether your organization belongs to an enterprise account and use that enterprise’s page.
GitHub documents the two routes in the enterprise guide and the organization guide.
Stripe: Compliance & Documents
- Sign in to the Stripe Dashboard as an Owner or Administrator.
- Open Compliance & Documents, then Stripe documents.
- Accept the terms if prompted.
- Download the report. Stripe states that a separate NDA is not required for this route.
Each download is watermarked with your account details and the time you accepted the terms. Stripe’s public SOC 3 is a high-level, public-facing summary. If your review date falls after the last report Stripe issued, check the Dashboard for a bridge letter, which covers the gap until the next report. Stripe’s help page is Download SOC Reports. Check the bridge letter’s own dates rather than relying on any sample date in the help article.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If your vendor is not on this list
The same steps apply to any provider, but confirm each route against that vendor’s own documentation.
Recommended Free Tools
Quick Recap
- Search the vendor’s site for “trust center”, “security” or “compliance”.
- Identify whether the report is downloaded directly, requested, or gated behind a plan, role, NDA or terms.
- Confirm the report type (SOC 2 or SOC 3) and whether it is restricted or public.
- Check the system scope and audit period against the system you are assessing.
- If the period does not cover your review date, ask the vendor whether a bridge letter or current-period update is available.
.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
