DEV Community

Evangelist Naval
Evangelist Naval

Posted on

How I catch a SOC 2 badge disappearing from a security page before renewal

#saas #security

Sales sent me a deck that still claimed SOC 2 Type II. I opened the vendor's public security page to grab the report request form. The badge was gone. No changelog. No email. Just a quieter trust page than the one I screenshotted in March.

That is how most security page updates land. Not with a press release. With a quiet edit.

Trust pages get edited in place

A security or trust center is not a brochure. It drifts:

  • a SOC 2 or ISO badge vanishes from /security or /trust
  • "Type II" becomes "in progress" in a footnote
  • the report request form moves behind a gated form nobody can find
  • a "last audited" date slips a year without a banner
  • subprocessors or pen-test summaries shrink to a single vague sentence

Google Alerts on the company name will not catch a badge that disappears from one URL. LinkedIn will not either. Your vendor review spreadsheet still says "SOC 2: yes" because nobody reopened the page.

Waiting for the renewal email is too late

I used to treat the annual questionnaire as the control. Then I watched a vendor keep the marketing claim while the public page stopped showing the attestation. Procurement found out during renewal, not during the year we kept sending them production data.

If your process is "we'll check security when the contract renews," you are checking after the badge already left.

Watch the exact security URL

Paste the public /security, /trust, or /compliance URL your security questionnaire and MSA appendix actually point to. Ask a watcher for an alert when the page text changes, especially around SOC, ISO, attestation, audit, report, and badge language.

I use AyeWatch for that. Free Preview is $0 with 3 topics and 6 lifetime runs. Pro is $9 a month.

When it fires I open the diff, screenshot the before/after, and ping security or the vendor AE the same day. The alert is the triage. The renewal email is optional.

Start with vendors that hold real data

Do not watch every marketing site. Watch the pages that would change a risk call:

  • trust / security centers for tools that store customer content
  • compliance pages linked from your MSA or DPA
  • attestation request forms that quietly go 404
  • "report a vulnerability" pages that lose contact details

A homepage can still say "enterprise ready" while /security drops the only badge your board asked about. Get the alert on that URL, not on the vendor blog.

Tags: security, saas, compliance, monitoring, productivity

Canonical / originally published at:
https://evangelist67.medium.com/how-to-get-a-security-page-alert-when-the-soc-2-badge-disappears-bd25b2f48b04

Top comments (0)