If an X buyer asks for your SOC 2 report, first check whether the report itself is a purchase requirement or whether they want security information to review. Then check what current evidence you actually have. If you have no SOC 2 report, say so; offer other documentation only if it exists, you are authorized to share it, and the buyer can consider it. Keep document exchange out of the public thread.
Find out whether the report is mandatory
A SOC 2 report is not just another name for a security overview. The AICPA describes a SOC 2 examination as an examination of a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy. A description of your practices may help a buyer evaluate you, but it does not establish that an examination took place.
Read the buyer’s exact words and any replies before answering. “Can you share your SOC 2 report? We need to review security before buying” leaves open whether another document would be considered. “Our procurement policy requires a current SOC 2 report” is a different constraint. For an ambiguous request, ask: “Is a SOC 2 report required for your review, or can your team consider other security documentation?” Do not treat a willingness to look at alternatives as approval to purchase without the report.
Check what you can substantiate and share
Before drafting a reply, establish whether your company has a report covering the product or service the buyer means. If it does, confirm that it is the report and period you intend to describe, and check who may receive it and how. Do not promise a document you have not located or been cleared to share.
If you do not have a SOC 2 report, identify any current materials your team has approved for this purpose, such as a security overview or answers to a security questionnaire. Check each statement you plan to make against those materials. An internal plan to pursue an examination is not a completed report, and a vendor’s report is not your company’s report. If you have no suitable documentation to offer, say that rather than improvising claims about controls.
If your company has a SOC 3 report, name it accurately rather than calling it SOC 2. The AICPA says SOC 3 reports are general-use reports with less detail than SOC 2 reports. Whether the buyer will accept one is still their decision.
Answer the request without implying an audit
Consider a fictional buyer who posts: “Can you share your SOC 2 report? We need to review security before buying.” For this example, the seller has no SOC 2 report but does have a current security overview approved for sharing with prospective buyers. The post does not say whether SOC 2 is mandatory. The next action is to disclose the missing report and ask whether the overview is worth reviewing—not to send it publicly or present it as equivalent.
A public reply could be: “I’m with [company]. We don’t have a SOC 2 report to share. We do have a current security overview available for buyer review. Is SOC 2 a firm requirement for your team, or could you consider the overview? If it would help, we can arrange to share it privately through a channel your team approves.” Use this wording only after confirming that the overview exists and can be offered. The public thread establishes the next step; the document itself goes through an appropriate private channel.
If the buyer answers that a SOC 2 report is mandatory, the decision changes: “Understood. We can’t provide a SOC 2 report, so we can’t meet that requirement at present.” Do not keep pitching the overview as a substitute. If the buyer can review other evidence, ask what their reviewers need and share only approved material through an agreed channel. Their review—not your public reply—determines whether it is sufficient.
Treat a suggested X reply as a draft
ReachFast says it finds relevant public X posts and prepares suggested replies that open typed in the X thread; the seller chooses whether to send from their own account. That can help you notice a buyer’s question, but a suggested reply cannot verify your company’s audit status, documents or sharing permissions. Compare it with the live post and your checked evidence. Remove any unsupported security claim before you decide to send.
Keep the answer proportionate to what the buyer asked. The useful outcome may be a private review of approved evidence, a clarification of their procurement rule, or an honest acknowledgment that you cannot meet it.
