Security

How to read a vendor security page without being sold to

SOC 2, ISO 27001 and a padlock icon are not the same claim. A short guide to the words that carry weight.

Vault Index desk / 18 August 2026 / 8 min read

The three tiers of claim

Tier one is an independently audited report you can request under an agreement: a SOC 2 Type II covering a stated period, or an ISO 27001 certificate with a named scope and a certificate number you can check with the registrar.

Tier two is a compliance statement: the vendor says it operates under UK GDPR, offers a data processing agreement, encrypts at rest with AES 256. These are checkable in contract but not audited on the page.

Tier three is atmosphere: bank grade, military grade, enterprise ready. Those phrases mean nothing and should not move your shortlist.

Questions that get useful answers

Which product and which regions does the certificate scope cover, and when does it expire? Where is data hosted, and can we require a single region? Will you sign a data processing agreement with sub processor notification? How long is the audit trail retained, and can we export it? What happens to our documents when the room closes?

Retention is the one buyers forget. A room with a ninety day log and a deal that completes in eight months leaves you unable to reconstruct who saw what during the early stages.

Young platforms and the certification gap

Newer products often have good engineering and no audit report yet, because a Type II needs an observation window and costs real money. That is a legitimate reason to be cautious in a regulated deal, and a poor reason to dismiss a platform for a seed raise.

Our scoring treats it the same way. Missing certifications are recorded as a limit, not as a security failure, and we say plainly which of the two situations a vendor is in.

Sources and further reading

Vendor figures rechecked 1 September 2026