SOC 2 Type II Certified LLM Providers in 2026: OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, Google Vertex AI, and Cohere — Real Audits, Real Trade-offs

**OpenAI** runs a full Trust portal at https://trust.openai.com/ that lists SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, GDPR, and CCPA. The Type II report is gated by an NDA click-through and a corporate email check — most procurement teams can complete the access flow in under thirty minutes. The portal also exposes the sub-processor list at https://openai.com/policies/sub-processor-list and the data processing addendum. The marketing claim to ignore is 'enterprise-grade security' as a standalone phrase; the artifact you want is the dated SOC 2 Type II report with the auditor's opinion letter, not a logo grid.

**Anthropic** publishes the equivalent at https://trust.anthropic.com/, with a similarly fast path to SOC 2 Type II, ISO 27001, and the standard GDPR DPA. Anthropic's Trust portal is generally considered the cleanest self-serve experience among foundation model labs in 2026 — most evaluators report a same-day download for the Type II. The sub-processor list lives at https://www.anthropic.com/legal/subprocessors and is updated when material changes occur. As with OpenAI, the marketing claim to discount is 'safe by design' — what you actually verify is the audit firm's opinion and the observation period stated on the report cover.

**AWS Bedrock** does not have its own SOC 2 — it inherits the AWS-wide SOC 2 Type II program documented at https://aws.amazon.com/compliance/soc-faqs/. Bedrock is explicitly listed as 'in scope' of the AWS SOC reports, which is the important detail. AWS refreshes its SOC reports on a semi-annual cycle (April and October), and the reports are downloadable from AWS Artifact inside your AWS console without a separate NDA. The trade-off is that you are buying into the AWS shared-responsibility model — controls below the hypervisor are inherited, controls above are yours.

**Azure OpenAI Service** sits inside the Microsoft Azure compliance umbrella. SOC reports are accessible via the Service Trust Portal at https://servicetrust.microsoft.com/ with a Microsoft account and the appropriate organizational role. Azure publishes both a SOC 2 Type II and a SOC 3 (the public-facing summary). Coverage spans all five Trust Services Criteria — Security, Availability, Confidentiality, Processing Integrity, and Privacy — which is broader than what most pure-play model labs publish. Azure OpenAI is listed in the in-scope services document.

**Google Vertex AI** rides the Google Cloud SOC 2 Type II at https://cloud.google.com/security/compliance/soc-2. The report is available via the Compliance Reports Manager in the Google Cloud console without a separate NDA workflow. Vertex AI is listed in scope. Google publishes ISO 27001, 27017, 27018, 27701, and the EU Cloud Code of Conduct alongside the SOC reports, which is useful when you need to satisfy multiple parallel security frameworks in one procurement cycle.

**Cohere** publishes its security posture at https://cohere.com/security including SOC 2 Type II and ISO 27001. The report is NDA-gated and typically delivered within a few business days of request. **Mistral** documents controls at https://mistral.ai/security with SOC 2 Type II audited by an EU-based firm and ISO 27001 in progress as of June 2026. **Together AI** runs a trust center at https://trust.together.ai/ with SOC 2 Type II and HIPAA attestations available on request. **Hugging Face** publishes Inference Endpoints security posture at https://huggingface.co/security, with SOC 2 Type II covering the Enterprise Hub and Inference Endpoints products. The marketing copy to discount across all four: 'we take security seriously' as a tagline. The artifact you verify is the dated report and the in-scope service list.

SOC 2 Type I is a point-in-time snapshot — an auditor describes the system and tests the design of controls on a single day. SOC 2 Type II adds the part procurement teams actually care about: the auditor tests the operating effectiveness of those controls over a defined observation period, almost always three to twelve months. A Type I report tells you the vendor wrote down the right controls. A Type II report tells you the vendor actually ran them, and that an independent CPA firm watched. Per the AICPA's official SOC framework documented at https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2, Type II is the artifact that maps to a real production trust decision; Type I is a developmental milestone.

The five Trust Services Criteria — Security, Availability, Confidentiality, Processing Integrity, and Privacy — are scoped per audit. Security is mandatory in any SOC 2; the other four are optional and the vendor chooses which to include based on what they sell. For LLM providers, Security plus Availability plus Confidentiality is the practical minimum, because you are paying for an always-on inference endpoint that processes sensitive prompts. Processing Integrity matters more when the output drives an automated decision pipeline (RAG retrieval ordering, function calling). Privacy matters when you process personal data — which, given that customers often paste PII into prompts, is most enterprise LLM deployments.

The hyperscalers — AWS, Azure, Google — typically cover all five Trust Services Criteria in their SOC 2 Type II reports because they have to: their platforms underpin everything from healthcare claims processing to ad measurement. The pure-play model labs (OpenAI, Anthropic, Cohere, Mistral) generally cover Security, Availability, and Confidentiality and add Processing Integrity or Privacy as their enterprise business matures. The right question in vendor diligence is not 'do you have SOC 2 Type II' — it is 'which TSC does your Type II cover, and does it include the criteria that map to my use case.'

Observation period is the underrated detail. A twelve-month observation period is the gold standard; nine months is acceptable; anything below six months is a red flag in 2026 unless the vendor is brand new and explicitly transitioning from Type I. When you read a Type II report, the cover page lists the dates — typically 'for the period October 1, 2024 through September 30, 2025' or similar. If the report you receive is dated 'as of' a single day, you have been handed a Type I and the vendor is hoping you do not notice.

Bridge letters cover the gap between the end of the audit period and today. If a vendor's most recent Type II covers through September 2025 and you are evaluating in June 2026, ask for a bridge letter — a short attestation from management (sometimes co-signed by the auditor) confirming that no material changes to the control environment occurred between the end of the audit period and the date of the letter. Reputable vendors issue bridge letters on request; if the vendor cannot produce one, treat that as a control gap signal, not a paperwork delay.

Continuous compliance platforms — Drata at https://drata.com/ and Vanta at https://www.vanta.com/ are the category leaders — automate the evidence collection that backs SOC 2 audits. Almost every modern LLM provider on this list uses one of them internally. When you are the customer doing your own SOC 2 with one of these providers as a sub-processor, ask whether they will share automated evidence via Drata or Vanta's evidence-exchange APIs. That capability can compress your own audit cycle by weeks.

**OpenAI** — start at https://trust.openai.com/, click into the SOC 2 Type II resource, click through the NDA, and submit your corporate email. Approval is usually automated within an hour for verified business domains; PDFs of the Type II report, the bridge letter, and the SOC 3 summary are then accessible via the same portal. Plan on thirty minutes total for a procurement analyst who has done this before. If you need the report distributed under your own corporate NDA rather than OpenAI's, escalate through your account executive — this adds 5 to 10 business days.

**Anthropic** — at https://trust.anthropic.com/ the flow is similar but generally faster, with a brief acknowledgment click instead of a longer NDA workflow. The Type II report, ISO 27001 certificate, GDPR DPA, sub-processor list, and security whitepaper are all available in the same hub. Most procurement teams report a same-day end-to-end download. As with OpenAI, custom NDA workflows are possible but add lead time — use Anthropic's standard NDA unless your legal team has a strict reason not to.

**AWS Bedrock** — log into your AWS console, navigate to AWS Artifact, accept the AWS Customer Agreement (or your existing enterprise agreement), and download the AWS SOC 2 Type II report directly. There is no separate NDA because the AWS customer agreement covers confidentiality. The report is several hundred pages; the parts relevant to a Bedrock deployment are the sections labeling Bedrock as in-scope and the underlying compute, storage, and IAM controls. AWS Artifact is documented at https://aws.amazon.com/artifact/.

**Azure OpenAI** — sign into the Service Trust Portal at https://servicetrust.microsoft.com/ with a Microsoft Entra account that has the Service Trust Portal access role. Navigate to SOC reports, filter by Azure, and download the SOC 2 Type II plus the SOC 3 summary. Microsoft's portal also lets you generate a one-page in-scope service matrix that maps Azure OpenAI to specific controls — extremely useful for procurement teams who do not want to read 400 pages of report. Service Trust Portal is documented at https://learn.microsoft.com/en-us/microsoft-365/compliance/get-started-with-service-trust-portal.

**Google Vertex AI** — open the Compliance Reports Manager inside the Google Cloud console under Security & Compliance, locate the Google Cloud SOC 2 Type II, and download. No separate NDA workflow is required. Vertex AI is listed in the in-scope services. Google's compliance hub at https://cloud.google.com/security/compliance is the master index, and the EU-specific Cloud Code of Conduct attestation is downloadable from the same place — useful for EU data residency conversations.

**Cohere, Mistral, Together AI, Hugging Face** — these follow the email-and-NDA pattern. Email the security or trust contact listed on the trust page (security@cohere.com, security@mistral.ai, the trust.together.ai contact form, security@huggingface.co), state that you are evaluating their service for production use, request the latest SOC 2 Type II under mutual NDA, and provide your corporate domain. Typical turnaround is 2 to 5 business days for the report, 5 to 10 business days if you insist on negotiating bespoke NDA terms. For high-volume procurement cycles, agree to the vendor's standard NDA — the time saved is real, and the terms are almost always boilerplate.

SOC 2 is an attestation about the vendor's own control environment. It does not, by itself, tell you which sub-processors that vendor uses, where your data sits geographically, or whether the vendor trains models on your prompts. Those questions live in the data processing addendum, the sub-processor list, and the published data usage policy — three separate documents you need to read alongside the Type II report. The combined picture is what your CISO actually evaluates.

**OpenAI** publishes its sub-processor list at https://openai.com/policies/sub-processor-list, including Microsoft Azure as the primary infrastructure provider, plus auxiliary processors for analytics, support, and observability. The data processing addendum confirms that API and Enterprise data are not used to train OpenAI models by default — confirm the latest text at https://openai.com/policies/data-processing-addendum before signing. Data residency: US is default; EU residency is available on Enterprise contracts as of June 2026.

**Anthropic** publishes its sub-processor list at https://www.anthropic.com/legal/subprocessors. Primary infrastructure runs on AWS and Google Cloud. The Claude for Work commercial DPA explicitly states that customer prompts and completions are not used to train Claude models — verify current language at https://www.anthropic.com/legal. Data residency: US default; EU residency available on enterprise tiers; further regional expansion is on the public roadmap.

**AWS Bedrock, Azure OpenAI, Google Vertex AI** are different — when you use a hyperscaler's managed LLM service, the hyperscaler is both the LLM provider and the cloud infrastructure provider, which collapses the sub-processor chain. For AWS Bedrock, the sub-processor list at https://aws.amazon.com/compliance/sub-processors/ applies. Azure's list lives at https://www.microsoft.com/licensing/docs/view/Subprocessor-List. Google's at https://cloud.google.com/terms/subprocessors. Data residency is configurable by region in the console; for regulated workloads, pin the model endpoint to a specific region and document it in your data flow diagram.

**Cohere, Mistral, Together AI, Hugging Face** each publish sub-processor lists on request or via their trust pages. Mistral's EU origin and EU-based data centers make it a notable option for buyers who need to keep inference physically in the EU under contract — confirm at https://mistral.ai/security. Hugging Face Inference Endpoints supports deployment into specific AWS or Azure regions you choose, which gives you per-workload control over residency — documented at https://huggingface.co/docs/inference-endpoints.

The practical rule for sub-processor management in 2026: get the list, set up a quarterly review with your DPO or privacy counsel, and subscribe to the vendor's sub-processor change notification (most vendors publish a mailing list or RSS feed for changes). When a new sub-processor is added, you typically have 30 days to object under standard EU DPA terms. If your procurement team treats SOC 2 as a one-and-done check rather than the start of an ongoing sub-processor monitoring relationship, you will fail your own audit eighteen months later when the regulator asks how you knew Vendor X added Subprocessor Y.

Drata at https://drata.com/ and Vanta at https://www.vanta.com/ dominate the continuous compliance category in 2026. Both platforms automate evidence collection across cloud accounts, identity providers, code repositories, ticketing systems, and HR systems, then map that evidence to SOC 2, ISO 27001, HIPAA, PCI, and GDPR control frameworks. The result is that SOC 2 audits are no longer manual evidence scrambles every twelve months — they are quarterly check-ins against a continuously updated control library.

Every major LLM provider on this list uses one of those platforms internally, which is why their audit cycles are predictable and their bridge letters are quick to produce. More importantly, both Drata and Vanta have built vendor risk management modules that let you ingest a vendor's SOC 2 report (and the bridge letter, and the sub-processor list) directly into your own compliance dashboard. If you are running Drata or Vanta yourself, ask your account team whether your LLM vendor is already integrated — for OpenAI, Anthropic, AWS, Azure, Google, and Cohere, the answer is almost always yes as of June 2026.

What that integration buys you operationally: when your LLM vendor refreshes their SOC 2 Type II report, your VRM tool automatically pulls the new artifact, flags any changes in scope, and updates your vendor risk score without a human in the loop. When the vendor adds a sub-processor, you get a notification. When the bridge letter date expires, you get a follow-up. This is the difference between a security program that survives a regulator visit and one that does not.

If you are not yet running Drata or Vanta, the entry point in 2026 is roughly $20,000 to $40,000 per year for a small-to-mid-market deployment, with the price scaling on number of integrations and number of frameworks. Compare that against the loaded cost of one full-time compliance engineer (typically $150,000 to $200,000) and the math is straightforward for most companies above 50 employees. For solo founders and 5-person startups, manual evidence collection plus a service like Sprinto or Secureframe at the lower end of the price band is more proportional.

There is a second-order effect worth flagging: when your LLM vendor publishes via Drata or Vanta's trust-exchange API, you can short-circuit your security questionnaire. Instead of sending the vendor a 300-question Excel and waiting six weeks, you grant their trust portal access to your VRM tool and the questions auto-populate against the vendor's machine-readable evidence. For high-volume procurement teams evaluating five LLM providers in parallel, this can compress evaluation from quarters to weeks. Verify the integration is live for your specific vendor before relying on it — coverage is growing fast but not universal.

The honest caveat: continuous compliance tools do not replace human judgment on edge cases. If your LLM workload involves PHI, biometrics, financial transaction data, or anything else that triggers sector-specific regulation, the automated evidence is necessary but not sufficient. Get counsel involved, get the BAA or equivalent written agreement, and document your residual risk in your own risk register. The tooling speeds the paperwork; it does not absolve the underwriting decision.

If you are a regulated enterprise already running on AWS, the right LLM provider is **Bedrock**. The SOC 2 inheritance from the AWS-wide audit is the simplest procurement story available, the HIPAA BAA is already in your master agreement, and you avoid adding a new vendor relationship entirely. The trade-off is model choice — Bedrock hosts Claude, Llama, Mistral, Cohere, Amazon Nova, and others, but you do not get GPT-5 there. If GPT-5 is non-negotiable for your workload, you need Azure OpenAI or direct OpenAI. Verify current Bedrock model availability at https://aws.amazon.com/bedrock/.

If you are a Microsoft 365 shop with a Microsoft enterprise agreement already in place, **Azure OpenAI** is the procurement path of least resistance. The Service Trust Portal access, the unified BAA, the consistent identity model via Microsoft Entra, and the ability to pin GPT-5 to a specific Azure region are all material advantages for regulated enterprises. The trade-off is that Azure OpenAI lags direct OpenAI by weeks to months on the newest model releases — if you need GPT-5 the week it ships, direct OpenAI is faster.

If your workload is heavy on Google Workspace, Looker, and BigQuery, **Google Vertex AI** is the obvious choice. Vertex AI hosts Gemini, Claude, Llama, and a growing list of partner models. The SOC 2 inheritance from Google Cloud is clean, the BAA covers Vertex AI, and Compliance Reports Manager makes the audit artifacts easy to pull. The trade-off is the same hyperscaler-lag problem — partner model availability sometimes trails the model lab's direct API.

If you want a foundation model lab directly and need the cleanest enterprise procurement story among the labs, **Anthropic** is the call in 2026. The self-serve Trust portal is the fastest in the category, the Claude for Work DPA is straightforward, and the no-training-on-customer-data commitment is unambiguous. **OpenAI** is the close second, with a slightly heavier NDA workflow but a deeper enterprise sales motion if you need bespoke contract terms. If GPT-5 is the model you need, OpenAI direct is the answer.

If you are buying for an EU regulated workload and you want a non-US LLM provider with an EU SOC 2 audit and EU data residency by default, **Mistral** is the answer. The EU origin, EU-based infrastructure, and EU-audited SOC 2 program combine into a procurement story that is materially easier with German data protection authorities, French CNIL, and Italian Garante than any US-origin vendor. Verify the latest at https://mistral.ai/security and confirm the specific datacenter regions in your contract.

If your workload is genuinely sensitive — PHI, sealed financial transactions, classified material — none of these SaaS LLM options is the right answer. Self-hosted Llama, Mistral, or Mixtral on hardware you control, in a network you control, with audit logs you generate, is the only architecture that satisfies the strictest regulator conversations. SOC 2 from your LLM vendor is a starting point for most enterprise workloads in 2026, but the highest-trust workloads still require running the model on-prem or in a sovereign cloud you control. Map the HIPAA-compliant AI tools for healthcare guide for the healthcare-specific decision tree.