Grade your SOC 2 Type II report.
Upload an issued report and get an instant, cited read on whether it contains what a SOC 2 report should — complete and consistent against the authoritative standards. See where it falls short before a reviewer or client does.
For audit firms checking their own reports.
Run a report your firm issued and see, element by element, whether it contains what a SOC 2 Type II report should. Every finding cites the standard it comes from, so your team can check our reading against the source.
Use it to calibrate before peer review, to compare reports across engagement teams, or to set a baseline before your next reporting cycle.
What it checks
22 elements across four sections, each tied to an authoritative source. It checks whether the report contains what the standards require — not whether the underlying controls are effective.
Opinion type, scope, management's assertion, restricted-use alert and auditor identification.
The nine description criteria in DC 200, from services and commitments to subservice organizations and changes.
In-scope categories named, every applicable criterion mapped and tested, exclusions explained.
Procedures described with specifics, results stated, and each control traced to a criterion, test and result.
The critical gate
Six elements are structurally critical. If any one is missing or inadequate, the grade is capped at F regardless of the numeric score.
How it works
- 1Upload an issued report
A SOC 2 Type II report your firm is authorized to share. PDF, up to 25 MB.
- 2AI classifies each element
A model running in our own cloud account reads the report at temperature zero, marks each of the 22 elements and quotes the supporting text.
- 3Code computes the grade
The score runs in code, never in the model, so the same report gets the same grade every time.
How we handle your report
An issued SOC 2 report is confidential. Here’s where yours goes, how long it stays and what we keep.
AWS Bedrock reads the report. The model doesn't train on your data, and no human reviews it.
We keep only your score summary and the name and email you provide.
Files and score summaries sit in KMS-encrypted storage.
No third-party sharing beyond the AWS processing above. Your grade is visible only to you.
Questions auditors ask
Is this a peer review?
No. It’s an automated completeness and consistency check against the cited standards. It isn’t an AICPA peer review, an audit opinion or a certification, and it isn’t an assessment of the issuing firm.
Read the methodologyDo you keep my report?
No. We delete it right after grading. We keep your score summary, which may be included in anonymized statistics across all graded reports. Those statistics never identify you, your firm, the service organization or the issuing auditor.
Security and trust at AudoraWhy was my report capped at F?
One of six critical elements was missing or inadequate: the opinion type, the opinion’s subjects, the scope and period, management’s assertion, the in-scope categories or the test results. Without any one of them, a core requirement of the report is missing or unreliable.
See the critical gateWhich reports can I upload?
Issued SOC 2 Type II reports, as a PDF up to 25 MB, that you’re authorized to share. Type 1 and SOC 1 reports aren’t graded.
Grade a free report