Which AI tools are SOC 2 compliant?
Updated October 18, 2026 · from live checks of 45,084 MCP servers · Methodology
OpenAI, Anthropic, Google, Microsoft, GitHub Copilot, Cursor and Perplexity all report SOC 2 Type II audits for their business offerings, per their trust centers (checked 2026-10-17).SOC 2 covers the vendor's controls, not the third-party MCP servers you connect, so check those separately.
SOC 2 status of major AI tools
| Vendor / product | Report | Trust center |
|---|---|---|
| OpenAI (ChatGPT Business/Enterprise, API) | SOC 2 Type 2 | trust.openai.com |
| Anthropic (Claude Team/Enterprise, API) | SOC 2 Type II | trust.anthropic.com |
| Google (Gemini for Workspace / Google Cloud) | SOC 2 Type II | Google Cloud |
| Microsoft (Microsoft 365 Copilot, Azure OpenAI) | SOC 2 Type II | Microsoft |
| GitHub Copilot (Business/Enterprise) | SOC 2 Type II | GitHub |
| Cursor | SOC 2 Type II | trust.cursor.com |
| Perplexity (Enterprise Pro) | SOC 2 Type II | trust.perplexity.ai |
What SOC 2 doesn't cover
Connecting an app through MCP adds another party. Only 37% of MCP servers are published under a verified company domain, so check the server's publisher and trust grade on canmyaiuse before connecting work data.
Are consumer plans covered?
SOC 2 reports usually cover business and API offerings. Consumer apps follow the vendor's general controls but aren't what the reports are scoped to.
How do I get the report?
Request it through the vendor's trust center, usually under NDA.