SOC 2 Logo & Badge: Where to Get the Official AICPA Mark

The official SOC 2 logo comes from the AICPA, not from your auditor, your compliance platform, or an image site. Create a free AICPA account, read the guidelines for the mark that matches your report, and register through the AICPA’s SOC logo page. You may display it once a licensed, independent CPA has issued your SOC report with an unmodified opinion and you have registered. Until then, use dated plain text instead of a logo.

Official download: Get the current AICPA SOC logo files and guidelines.

We link to AICPA rather than mirror its files because the marks are licensed and the terms travel with the download. Our SOC 2 compliance guide covers what has to happen before that point, from scope to report.

How do you download the official SOC 2 logo?

Get the official SOC 2 logo directly from AICPA after signing in or creating a free account. The registration flow connects the asset to the organization and report that support its use.

1. Open the AICPA logo resource. Use the SOC for Service Organizations registration and download page, not an image library or copied file.
2. Sign in or register. AICPA labels the resource as free-account access. Probo’s May 4, 2026 review reports that the registration form now asks for the name and license number of the CPA who signed your report and the report date, so have the report in hand.
3. Read the terms and choose the matching mark. Keep the approved file, registration record, and current guidelines with the person responsible for publishing the asset.

Which file formats come with it?

The AICPA’s terms say only that you must use the logo in the form delivered by email after you register; they do not list file formats. ComplyJet’s guide says registrants receive EPS, SVG, PNG, and JPEG files. Treat that list as a report rather than a promise.

If the format you need is missing, ask AICPA instead of converting, tracing, or recoloring a file. A transparent PNG, SVG, Figma component, or vector found elsewhere may be outdated or governed by different permissions. Free-image sites list badges with padlocks and “AICPA” seals drawn by third parties; a design made by a stranger carries no AICPA permission for you. The file format alone does not establish that an asset is official or licensed for your use.

Which official SOC 2 logo should you use?

The AICPA public resource dated April 22, 2026 describes two service-organization marks:

• AICPA SOC for Service Organizations Logo for use by Service Organizations is the general mark for organizations that have received a SOC 1, SOC 2, or SOC 3 report from a licensed, independent CPA or a non-U.S. equivalent.
• AICPA SOC 2 Logo for use by Service Organizations is the SOC 2-specific mark for organizations that have received a SOC 2 report from a licensed, independent CPA or a non-U.S. equivalent.

The AICPA’s April 2026 terms say a SOC 2 report holder may use either. Probo describes the SOC 2-specific mark as carrying “SOC 2” in the design, which makes it the more precise choice on a SOC 2 security page. Pick one, follow its guidelines, and use it consistently. If the wording or available files change, follow the current AICPA page.

AICPA also publishes a separate SOC Logo for CPAs, which licensed CPAs and CPA firms display for the examinations they perform. It is not the mark for the company that was examined.

Is there an official AICPA SOC 2 Type 2 logo?

The April 2026 AICPA resource names a SOC 2 service-organization mark. It does not list a separate official AICPA mark for Type 1 or Type 2. A graphic labeled “SOC 2 Type II” may be an auditor, compliance-platform, or custom asset; it is not automatically an official AICPA logo.

Use your report type in nearby copy where it gives buyers useful context. For example: “We received a SOC 2 Type 2 report covering [system or service] for the period [dates].” Do not alter an official mark to add “Type 2,” and do not assume that a third-party Type II graphic carries AICPA permission.

What if you only have a Type 1 report?

The AICPA’s April 2026 terms require at least one SOC 1, SOC 2, or SOC 3 report from a licensed CPA, and they describe both SOC 2 report types without limiting the logo to Type 2. A Type 1 report therefore meets the stated eligibility, as long as its opinion is unmodified. Guides that call it a “Type 2 logo” or require a Type II opinion are adding a condition the terms do not contain.

Say “Type 1” beside it. A Type 1 report describes how controls were designed at one date, while a Type 2 report tests how they operated over a period, and buyers read the two differently. Our SOC 2 Type 1 vs Type 2 comparison covers the difference.

How should you show that SOC 2 is in progress?

Use a dated, plain-text status statement while your SOC 2 work is underway. AICPA’s public resource lists no official “in progress” mark, so the wording should describe the stage you can verify. A “SOC 2 in progress” graphic from a vendor is that vendor’s artwork, not an AICPA mark; do not present it as one.

Say “in progress” only once there is a start line: a CPA firm is engaged, or the observation period has begun. Before that, “preparing for” is the accurate phrase.

Until a CPA issues the report, do not write “SOC 2 compliant,” “certified,” or “attested.” Write “we expect” rather than a firm completion date, and update the statement when the date moves. Only publish dates, report type, and auditor involvement that your security or legal owner can confirm. Remove or update the statement when the underlying status changes.

Which SOC 2 badges are safe to use?

Use a SOC 2 badge only when its issuer gives your organization permission and the underlying status is current. The asset source determines which terms apply and what the badge can claim.

Issuer badges carry their own conditions. As an example, A-LIGN’s post-audit kit, read October 6, 2026, lets organizations that completed a SOC 2 attestation with A-LIGN show its badge on a website if the badge links to A-LIGN. It bars uses that imply product certification or an attestation covering activities and sites outside its scope. Those are A-LIGN’s terms, not the AICPA’s.

What wording should accompany a SOC 2 badge?

A SOC 2 badge should sit beside a precise statement of the report type, system scope, audit period, and report-request path. The badge signals that a report exists; the accompanying copy tells a buyer what that report covers.

SOC 2 is an attestation engagement, not a certification against a universal pass-or-fail standard. People often use “SOC 2 certified” as shorthand, but accurate SOC 2 terminology makes the public claim easier for auditors and security buyers to verify.

Place the mark where buyers evaluate security claims, such as a trust center, security page, enterprise plan page, or sales deck. Link to the report-request workflow or security contact rather than suggesting that the badge itself proves the scope. A guide to reviewing a SOC 2 audit report explains what the underlying document can answer.

What should you confirm before publishing the logo?

AICPA’s public page says you must read and understand its guidelines before downloading the logo or displaying it on any website. The guidelines download after sign-in. The AICPA’s April 2026 terms for the general service-organization logo set the core conditions below; the SOC 2-specific mark has its own guidelines document, so confirm its conditions when you register. This is where each common rule is stated:

Treat the two reported rows as the strictest reading until you see what your registration asks for and delivers.

Before a page, deck, or press release goes live, confirm:

• which report supports the statement;
• which AICPA mark or third-party badge you are licensed to use;
• the date your display period ends, and who owns review when the report is renewed, qualified, or replaced; and
• where buyers can obtain the appropriate supporting material.

For the wider framework, report types, and audit process, use the SOC 2 compliance guide. The logo follows a CPA-issued report, so if you are still budgeting for one, see what a SOC 2 audit costs and browse the SOC 2 auditor directory to pick the firm. For logo files and display terms, return to the official AICPA registration page.