Menu
Get Ready
SOC 2 Readiness AssessmentCompare service firms
SOC 2 Readiness FirmsPenetration Testing FirmsvCISO FirmsISO 27001 ConsultantsCompliance ConsultantsAll Service FirmsWe scanned 5,912 Y Combinator company domains for public trust and security pages, then measured visible SOC 2 claims by company cohort and trust-center host.
The headline is intentionally narrower than "companies with SOC 2." It counts companies whose public trust page visibly claims SOC 2. Companies without a public page, or with a page our conservative scan could not read, are not treated as noncompliant; they are simply absent from the detected group.
The cohort chart uses batch year as a rough company-age lens. It is descriptive, not causal, and small early cohorts can move sharply when only a few companies change status.
7% of the 5,912 Y Combinator companies we scanned publish a public trust page claiming SOC 2, about 1 in 14.
Source: SOC 2 Auditors, https://soc2auditors.org/data/soc-2-adoption/#yc-soc2-trust-page-share (retrieved 2026-06-12). Of the 1,548 YC companies with a public trust page, the most common host is self-hosted (1458).
Source: SOC 2 Auditors, https://soc2auditors.org/data/soc-2-adoption/#trust-center-platform-share (retrieved 2026-06-12). SOC 2 trust-page adoption among YC companies rises with company age, from the newest batches to the oldest cohorts we scanned.
Source: SOC 2 Auditors, https://soc2auditors.org/data/soc-2-adoption/#soc2-adoption-by-batch (retrieved 2026-06-12). The source universe is the committed YC company snapshot used by the statistics pipeline. For each company domain, the scanner probes common trust and security paths plus hosted trust-center patterns for Vanta, Drata, SafeBase, and Conveyor. A company is counted as publishing SOC 2 only when the reachable public page exposes a visible SOC 2 claim.
This method favors precision over recall. JavaScript-only pages, blocked requests, moved domains, and private trust portals can produce false negatives. The result is a reproducible public-web adoption signal, not a certification registry and not a complete measure of private SOC 2 reports.
Platform share describes the host detected for public trust pages. "Self-hosted" means the page did not match one of the named hosted-platform fingerprints; it does not imply the company built every trust-center function itself.
Maintained by Peter Korpak. Questions, corrections, or a stale number? Email hello@soc2auditors.org and we will reply within two business days.
Cite freely with attribution. This dataset is published under CC BY 4.0. Each figure above has a stable anchor, a CSV where a breakdown exists, and a copyable citation.
See the topic in context on the SOC 2 statistics hub. Questions or corrections can go to hello@soc2auditors.org.
Compare firms by fit, pricing, location, and experience, or ask us to match your scope to a short list.