A public-web index of SOC 2 claims, not a certificate registry.

How the index is built

We start with committed company-domain snapshots, then probe four common trust and security locations. Shared trust-center hosts add a second discovery feed; relevance-ranked newswire searches add a smaller source of company-to-auditor evidence.

Every HTTP probe has one of four meanings: found, absent, blocked, or error. A domain is absent only when every candidate URL is a clean negative. A challenge page, timeout, DNS failure, or failed JavaScript render never becomes a negative data point.

Candidate pages are extracted into a strict schema that asks two different questions: is the SOC 2 claim completed, and is it about this company rather than a vendor? Every accepted row must keep the exact evidence sentence and its public URL. Model output enters a review queue and cannot merge itself.

Before any adoption or market-share figure ships, a reviewer labels a stratified 200-page set. We publish attestation and subject precision/recall plus per-platform calibration beside the result. Fifty pages are re-labeled each quarter to detect drift.

What this cannot tell you

A missing row does not mean a company lacks SOC 2. Many reports sit behind NDA-gated trust centers, many attested companies publish no trust page, and some platforms cannot be enumerated because they use customer-owned domains.

The auditor's name usually lives inside the gated report PDF, not the public summary. Public company-to-auditor edges therefore come mainly from announcements, SOC 3 reports, and voluntary survey responses. We publish aggregates, never company-level prices or a firm's client list.

Platform share means share within the observable, subject-confirmed public frame. It is not total vendor market share. Any monthly migration result is pre-registered before that cycle's data is inspected, so an unflattering result cannot quietly change its definition after the fact.