The Zendesk SOC 2 Report
The Zendesk SOC 2 report is what procurement asks for and almost nobody reads past the cover page. The genuinely useful part sits near the back.
What a SOC 2 report actually is
A SOC 2 is an attestation report produced by an independent audit firm against criteria published by the AICPA, known as the trust services criteria: security, and optionally availability, processing integrity, confidentiality and privacy. Security is the one everyone includes. The others are a choice the vendor made.
It isn't a certificate. There's no pass mark, no expiry sticker, and the logo means less than people think. It's a document in which a company describes the controls it says it operates, and an auditor gives an opinion on them after testing.
That framing changes how you read it. You're not checking whether a box was ticked. You're reading somebody else's homework and deciding whether the marking was strict.
Type I versus Type II
| Type I | Type II | |
|---|---|---|
| What it tests | Whether controls are designed appropriately | Whether controls actually operated over time |
| Coverage | A single point in time | A stated period, commonly several months or a year |
| Effort for the vendor | Lower | Substantially higher |
| When it is acceptable | A young company on its first audit cycle | What you should expect from an established vendor |
How to request the Zendesk SOC 2 report
These reports contain detail vendors don't publish openly, so they're almost always released under an NDA rather than downloaded from a website.
There are three routes and any of them work. A trust centre with a request form, your account manager, or the salesperson if you're mid procurement. That last one is fastest, because they have done it a hundred times.
Ask for two things, not one. The most recent report, and a bridge letter covering the gap between the report end date and today. Without the bridge letter you are relying on a document that might describe a period which ended eight months ago.
What a reviewer should actually look for
What SOC 2 will never tell you
It says nothing about your configuration. Your roles, your API tokens, your retention settings and your installed apps sit outside every audit scope except your own. That's the half security reviews actually find problems in, and there's a checklist for it in the security and compliance guide.
It's also not GDPR compliance. Even when the privacy criterion is included, a SOC 2 is not a substitute for a processing agreement, see the Zendesk DPA.
And it doesn't guarantee nothing goes wrong. It says a defined set of controls was tested by one firm over a stated period and mostly held. Treat it as evidence rather than as an answer, and if the contract is large enough, have your own auditor read it instead of taking a summary on trust. None of this is legal advice.
The other acronyms you will be handed
SOC 2 rarely arrives alone, and knowing what else is in the envelope saves you asking for the wrong document.
None of them substitute for each other, and a reviewer who knows the difference asks sharper questions and finishes faster. If you're the one assembling this for a customer of your own, the same list is what they'll ask you for.
Frequently asked questions
How do you request the SOC 2 report?
Through the Zendesk trust center, usually under NDA. Ask specifically for the Zendesk SOC2 Type 2 audit report rather than a summary, and the same page lists the other Zendesk certifications.
Does Zendesk have a SOC 2 report?
Certification and attestation statuses change, and scopes change with them, so the only reliable answer comes from Zendesk directly. Request current documentation through their trust centre or your account team rather than relying on any third-party page.
Should we ask for Type I or Type II?
Type II. A Type I describes how controls looked on one day. A Type II tests whether they kept working across a period, which is the question you actually care about.
Is SOC 2 a certification?
No, it's an attestation. An independent firm gives an opinion on described controls. There's no certificate and no formal pass mark.
How long is a SOC 2 report valid for?
It isn't valid or invalid, it describes a period. Once that period is a few months behind you, ask for a bridge letter or the next report.
Can we share the report internally?
Check the NDA you signed to receive it. Sharing is usually limited to people who need it for the assessment, and posting it anywhere wider is normally a breach.
The vendor half and your half
Audit reports cover the vendor. Your configuration is yours, and a queue full of duplicate tickets is a data footprint you chose without meaning to.
Start free trial14-day free trial. No credit card required.