Detect tampered and deepfake SOC 2 Report

What a genuine SOC 2 report contains

A SOC 2 report opens with the service auditor's report, the independent CPA firm's opinion letter, which states the trust services criteria in scope, the system examined, the period or date covered, and the opinion itself with any qualification. Management's assertion follows, signed by the service organisation. Section three describes the system: infrastructure, software, people, procedures, and data, together with the control environment and any subservice organisations carved out or included. Section four is the substance, listing each control, the auditor's test of it, and the result, with exceptions stated where testing found them.

The structure is what makes the report verifiable. A Type II opinion covers a period and is written in period language naming a duration, while a Type I is a point-in-time opinion on design alone, so a report claiming Type II with a single as-of date is not one. The opinion is dated after the period closes, because an auditor cannot sign on testing they have not finished, and a realistic gap is weeks rather than days. Section four's exceptions have to be reflected in the opinion, so a clean opinion above a populated exception list is internally inconsistent.

How SOC 2 report forgeries are made

• Audit period shifting

  The period covered is moved forward so a report that lapsed last year reads as current coverage. The period appears in the opinion letter, on the cover, in management's assertion, and often in section four headers, so an edit reaching only the cover leaves four statements of the same window disagreeing.

• Exception list trimming

  Exceptions are deleted from the results column in section four so the control matrix reads clean. Removing rows from a generated table forces those beneath to reflow, and control numbering, row heights, and the relationship between the table rules and the text inside them stop being uniform down the section.

• Opinion language upgrade

  A qualified opinion is edited into an unqualified one by replacing a clause in the auditor's letter. AICPA opinion wording is formulaic, so a rewritten paragraph tends to drift from the standard phrasing, and the substituted sentence carries a different rendering history from the paragraph containing it.

• Type I presented as Type II

  A Type I report, which opines on the design of controls at a single date, is offered as Type II coverage of operating effectiveness, sometimes by relabelling the cover alone. The opinion letter still reads 'as of' a date rather than 'throughout the period', and that sentence settles the question.

• Auditor identity fabrication

  A real CPA firm's letterhead, city, state, and signature block are copied onto a report the firm never issued. Firm details drift when a document is assembled rather than issued: a city that does not match the firm's registered office, or a signature image resampled from a public PDF and placed at a slightly different scale.

• Fully generated reports

  Complete reports come out of templates and language models, so the file's production trail carries the signal. CPA-grade reporting is produced with a small set of tools, and producer metadata pointing at a script or an online PDF generator is anomalous however well the text reads. Blanket claims of zero incidents across a six month period are a second tell.

What TamperCheck checks on a SOC 2 report

TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.

• Table structure integrity

  Inserted and deleted rows leave structural artifacts behind: inconsistent spacing, misaligned columns, and formatting the visible table no longer accounts for.

• Date and validity consistency

  Issue, expiry, and period dates are checked against one another and against the file's own creation metadata, which catches backdating and validity extension.

• Field-level forensics

  Every text region is analysed in its own right rather than as part of one whole-page image. This catches the smoothed and feathered edits that whole-image Error Level Analysis misses entirely.

• And many more checks

  The three above are the layers that carry the most weight on a SOC 2 report. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.

Who verifies a SOC 2 report, and why

Security, procurement, and compliance teams evaluating vendors. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.

How to verify a SOC 2 report in 4 steps

1. 1

   Check the fields against each other

   Read audit opinion, exception list, and audit period together rather than one at a time. Forgers typically change one value and leave the rest of the document describing the original.

2. 2

   Inspect the file metadata

   Open the document properties and look at the producer, creation date, and modification date. A document produced by a consumer PDF editor, or created long after the date printed on its face, is worth a closer look.

3. 3

   Ask for a second document

   Request a corroborating document from the same issuer or an adjacent period. Forgery effort concentrates on one file, so inconsistencies surface as soon as there are two to compare.

4. 4

   Run a forensic check

   Manual review catches obvious edits but not field-level pixel manipulation or synthetic generation. TamperCheck runs 200+ forensic checks on a SOC 2 report and returns a risk score from 0 to 100 within seconds, at $0.50 per document.

Frequently asked questions