Why this page looks like this. It replaces production's /solutions/soc-2 and folds in /solutions/soc-2-evidence-pack, which is retired (redirect it here). Production promised to "Meet AICPA's trust criteria", called SOC 2 a "certification", said "Our Software Resilience Certificates serve as trusted proof that auditors accept" and that "CC9 clears on the first review", "your report ships on schedule". None of that is ours to promise. The page tells the five-step story for a service organisation's compliance lead:

The exposure: the criteria where vendor software comes up, by identifier and our own short label.
The shift: a vendor's own SOC 2 report covers the vendor's controls, not your way back.
The model and the proof: an evidence map from each criterion to the documents that support it.
The next step: book a demo, or get the sample evidence pack.

Two lines run through the page, as the brief asks. A SOC 2 report is the service organisation's own report, from its service auditor (a CPA firm); Codekeeper's evidence supports the vendor-risk and availability controls in it. And the Trust Services Criteria are AICPA copyright, so no criterion text is quoted or closely paraphrased. The hero visual is an example account; names and dates are fictional and labelled. Production claims kept, flagged: "Trusted by 3,500+ teams" (trust row) and "deposits sync daily" are production figures, kept as agreed; each needs an owner's sign-off before launch (to-confirm.md; fact-check, 7 Oct).

SOC 2 · service organisations

The vendors your service runs on. Evidence they come back.

Your SOC 2 report is your own, from your service auditor. When it reaches vendor risk and availability, Codekeeper gives you dated evidence that the software your service depends on can be rebuilt without its vendor.

Book a demo Get the sample evidence pack

Trusted by 3,500+ teams
ISO/IEC 27001:2022 certified
Evidence for CC9.2 and the A1 criteria

Vendor continuity · 2026 report periodExample SaaS Ltd · 3 critical vendor applicationsEvidence current

Billing EngineVendor · Escrow Pro3 rebuilds in period

Identity ServiceSaaS vendor · Resilience ProRebuild passed

Reporting LibraryVendor · EscrowCertificate issued

Recoverability CertificateBilling Engine · Run #9 · 2 Sep 2026Download

Tested Exit ReportBilling Engine · Exit ExercisePass

Example account. Names and dates are fictional.

Social proof straight after the promise. These are the logos production already uses, loaded from codekeeper.co. Where an image can't load (for example in the preview), the name shows instead. Use the approved set only.

Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors

Step 1, the exposure: the criteria, by identifier only. The AICPA's Trust Services Criteria are copyright, so the cards give the identifier plus a short label we wrote, and say where software you don't control comes up. They don't quote or restate the criterion text.

Source. The current criteria are "2017 Trust Services Criteria (With Revised Points of Focus – 2022)", listed on aicpa-cima.com. The official download needs an AICPA sign-in, which our fetch tool can't do. Identifiers and group headings (CC9 Risk Mitigation; Additional Criteria for Availability, A1.1 to A1.3) were checked against two copies of the AICPA document (TSP Section 100) hosted by third parties. Confirm against the AICPA download before launch.
Production error fixed. Production's FAQ says escrow addresses "CC3.2 (third-party risk assessment) and A1.2 (business continuity planning)". The vendor criterion is CC9.2, in the Risk Mitigation group; CC3.2 is the general risk-identification criterion. A1.2 covers backup and recovery infrastructure; recovery plan testing is A1.3. The evidence pack page said "CC9.1 wants a tested plan for surviving a vendor failure"; CC9.1 is about business disruption generally.
The callout rests on AICPA's own description of the SOC 2 guide (aicpa-cima.com): an "Assertion-based examination of a service organization's description of its system and its controls", performed by CPAs, and "customers and business partners often request a SOC 2 report from the service organization."

What SOC 2 covers

Vendor risk and availability are in the criteria.

SOC 2 examinations use the AICPA's Trust Services Criteria. Four of them are where software you don't control comes up: two in the Risk Mitigation group of the common criteria, and two in the additional criteria for Availability.

CC9.2 · Vendor and business partner risk

Where your auditor asks about the vendors your service depends on, and what you'd do if one stopped.

CC9.1 · Business disruption

A critical vendor stopping is one of the disruptions your risk mitigation has to cover.

A1.2 · Backup and recovery infrastructure

If Availability is in scope: the copies and infrastructure your recovery would start from.

A1.3 · Recovery plan testing

If Availability is in scope: evidence that recovery works, not only that a plan exists.

A SOC 2 report is your report. It's issued by your service auditor, a CPA firm, on your description of your system and your controls. Codekeeper doesn't issue SOC 2 reports, and our documents don't replace one. They're evidence for the vendor-risk and availability controls your auditor tests.

Criteria are named by identifier, with short labels of our own. The Trust Services Criteria are published by the AICPA. Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your auditor to decide.

Step 2, the shift: a vendor's report versus your way back. This keeps the useful idea from production's pack FAQ ("a vendor's report tells you they had controls, while the pack proves you can keep running if that vendor fails") without its absolutes and its unsourced "2–4 months added to your report timeline". Each "with evidence" cell is a confirmed output: protections per application, the automated check and certificate, agreed release or recovery terms, rebuilds in the Codekeeper AI Verification Lab in hours, four rebuilds a year. The steps underneath are arc step 3, one sentence each.

Where vendor software fits

Your vendor's SOC 2 report covers their controls. Not your way back.

Collecting a critical vendor's report is part of managing it. It tells you how the vendor runs its service. It doesn't show that your service could carry on if the vendor stopped.

On paper

With evidence

Vendor inventory

A list with a risk rating

A protection on each critical vendor application, checked and certified

Vendor assurance

The vendor's own SOC 2 report

Plus proof the application rebuilds without the vendor

Contract

A termination clause

Release or recovery terms agreed before anything goes wrong

Recovery testing

A plan that assumes the vendor will help

A rebuild in the Codekeeper AI Verification Lab, with no vendor help, in hours

Report period

One check before the audit

Dated rebuilds across the period, four a year included

List your critical vendors

Start from the vendor inventory in your system description.

Attach a protection

Escrow or Resilience for each vendor application. The deposit syncs daily from the vendor's repositories.

Rebuild through the period

With Pro, run rebuilds when you choose. Each successful run issues a dated Recoverability Certificate.

Hand over the evidence

Give your auditor dated documents per application, ready before fieldwork starts.

Step 4, the proof: which document supports which criterion. Identifiers with our own labels, no criterion text. Every document named is a confirmed output. "Supports" is the stance: the auditor decides how to test each control.

CC7.5 (recovery from identified security incidents) is included because an attack on a vendor is one of the four risks the site names. The label was checked against the same copies of the AICPA document.
Confirm before launch: production says Software Backup includes a Software Resilience Certificate; confirm it carries over before the A1.2 row relies on it. Whether "12 rebuilds a year, $299 a month more" is per application.
Removed from production's pack page: "A human-signed verdict … A named analyst signs the continuity assessment" (not in the confirmed facts), "Carve-out coverage … the carve-out method auditors default to" (a claim about audit practice we haven't checked) and "CC9 mapping, point by point … Each record cites the criterion it satisfies".
16 Oct: Continuity Pro added. Rebuild evidence now names Continuity Pro, since base Continuity no longer includes Agentic Verification; the Resilience Arrangement row covers both Continuity levels.

Evidence map

Evidence for each criterion.

Which documents support which criterion, and the protection they come with.

Trust Services Criteria	Codekeeper evidence
CC9.2 Vendor and business partner risk	Release or recovery terms for each critical vendor application, agreed up front, and an automated check of what's deposited. Escrow AgreementResilience ArrangementSoftware Resilience CertificateVault reportEscrow · Resilience · Continuity
CC9.1 Business disruption	Proof the application rebuilds without the vendor, and the recovery steps written down. Recoverability CertificateExit workbookDeployable copyEscrow Pro · Resilience Pro · Continuity Pro
A1.2 Backup and recovery infrastructure	For vendor applications, the deposit held by a neutral party, encrypted at rest and synced daily. For systems you run yourself, daily backups with the three latest versions kept. Vault reportSoftware Resilience CertificateEvery protection · Software Backup for in-house systems
A1.3 Recovery plan testing	Rebuilds you start, each with a run report. Add an Exit Exercise to test the business functions you nominate, without the original developers. Run reportRecoverability CertificateTested Exit ReportEscrow Pro · Resilience Pro · Continuity Pro · Exit Exercise as an add-on
CC7.5 Recovery from security incidents	If an attack takes a vendor application down, the recovery starts from a deposit held outside the vendor's systems. With Resilience, we run it for you. Resilience ArrangementVault reportResilience · Resilience Pro · Continuity · Continuity Pro
Across the report period	Each rebuild issues a dated certificate, so the evidence covers the period, not a single day. Four rebuilds a year are included; twelve are available as an add-on. Dated Recoverability CertificatesEscrow Pro · Resilience Pro · Continuity Pro

Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your auditor to decide.

Step 3 again, as a choice, with prices. The three jobs with the 6 Oct "from" prices (software row) and the agreed price logic sentence as the lead. SOC 2 buyers are often SaaS companies on both sides of the table, so the cross-sell speaks to the second audience: SaaS vendors whose enterprise customers ask about them. Backup is named for in-house systems without a price, because its production price still has a $99 vs $89 conflict. 16 Oct: Continuity Pro added; base Continuity is now everything in Resilience, and Continuity Pro adds Agentic Verification. 17 Oct: the recovery models are named, as in the launch film (Danny): Self-Run Recovery for Escrow, Managed Recovery for Resilience and Continuity.

Which protection fits

Who runs the recovery if a vendor stops?

Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on.

Released to you

Escrow

Released to you→Self-Run Recovery

When the agreed conditions are met, the deposit is released to you. Escrow Pro adds proof it builds, from $449. Explore Escrow

From $199

Recovered by us

Resilience

Comes to us→Managed Recovery

If the application fails, Codekeeper runs the recovery for you. Resilience Pro starts from a deposit we know builds, from $649. Explore Resilience

From $399

Stays online

Continuity

Live service kept on+Managed Recovery

Everything in Resilience, plus the live environment kept paid and switched on for an agreed period while we recover. Continuity Pro adds Agentic Verification. Explore Continuity

From $1,449

Prices per application per month, for software applications; SaaS and AI applications have their own rows. Setup is $499 per arrangement for Escrow and Resilience, and $999 for Continuity. For systems you run yourself, Software Backup attaches the same way. See all prices

Selling SaaS to enterprises?

Your customers manage you as a vendor too. Escrow for SaaS applications puts your code, infrastructure and data exports with a neutral party, and Escrow Pro shows them it builds.

Explore SaaS escrow

The secondary conversion, on every page. Visitors who aren't ready to talk can still leave their email. The sample evidence pack is the same offer on every page, so the site has one lead magnet instead of a different e-book per page. It also carries the launch story: proof, not promises. The button goes to the sample evidence pack page.

Sample evidence pack

See what your auditor would receive.

An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.

Recoverability Certificate
Run report
SBOM and Exit workbook excerpts

Get the sample evidence pack

The questions compliance leads ask, in the order sales hears them. The first answer is the line the brief asks for: the report is theirs. Production's FAQ called SOC 2 a "security audit that proves to clients you can protect their data" and said our certificates are "trusted proof that auditors accept"; both are gone. Production's general answers ("five principles", "Is SOC 2 the same as ISO 27001?") aren't about our product and are cut. The Codekeeper answer claims only ISO/IEC 27001:2022: production badges show SOC 1/2/3, while the Trust Center text says "SOC 2 aligned", so nothing else is claimed until the team confirms it. 16 Oct: Continuity Pro added; the report-period answer now credits the four rebuilds to the Pro levels, since base Continuity no longer includes Agentic Verification.

Questions

Before your next SOC 2 report.

Is Codekeeper's evidence a SOC 2 report?

No. A SOC 2 report is your organisation's own report, issued by your service auditor on your system and your controls. Codekeeper's documents are evidence you can give your auditor for the controls that cover vendor risk and availability.

Which criteria does the evidence relate to?

Mainly CC9.2 for vendors and business partners and CC9.1 for business disruption, plus A1.2 and A1.3 if Availability is in your report's scope. See the evidence map for the documents that go with each.

Why don't you quote the criteria?

The Trust Services Criteria are published by the AICPA, and the text is copyright. We name criteria by identifier, with a short label of our own. Your auditor works from the full text.

Our critical vendor has its own SOC 2 report. Isn't that enough?

It's worth collecting, and it tells you about the vendor's controls. It doesn't show your service could carry on if the vendor stopped. A Recoverability Certificate shows the vendor's application rebuilds without the vendor.

Our report covers a period. Is one rebuild enough?

Your auditor decides what the period needs. Each rebuild issues a dated Recoverability Certificate, and the Pro levels include four a year, run when you choose. Twelve a year are available for $299 a month more.

We sell SaaS to enterprises. Can this help us?

Yes. Your customers have to manage you as a vendor. Escrow for SaaS applications holds your code, infrastructure and data exports with a neutral party, and Escrow Pro adds a Recoverability Certificate showing your application rebuilds without your team.

Is Codekeeper itself independently audited?

Codekeeper is certified to ISO/IEC 27001:2022, audited by BSI. The Trust Center explains how we protect deposits, including encryption and how Agentic Verification handles your code.

Will this get us through our SOC 2 audit?

No product can promise that. Your auditor tests your controls and issues the report. Codekeeper gives you evidence for the vendor-risk and availability controls. Whether it meets a specific requirement is for you and your auditor to decide.

What happened to the SOC 2 evidence pack?

It's part of this page now. The sample evidence pack shows the documents an Agentic Verification run produces, and an Exit Exercise adds a Tested Exit Report with an annex mapped to your framework.

Want the background first? Our SOC 2 guide is in Resources.

The same close on every page. The SOC 2 close names what the page sells: evidence for the vendor-risk and availability controls in the customer's own report, not a pass. Every page ends on the same two actions in the same order: Book a demo, then the sample evidence pack.

Put vendor continuity in your evidence.

We'll take the critical vendors in your system description and show you the evidence each protection gives your auditor.

Book a demo Get the sample evidence pack