Request access to SOC reports and bridge letters

A Service Organization Controls (SOC) report is a way to make sure a company is following important rules about keeping data safe, private, and available. These reports are created by independent third-party auditors and help customers or partners check if there are any risks in working with a company.

Gusto’s reports focus on Security, Availability, and Confidentiality and can be accessed by prospects, current customers, and past customers.

Use the dropdowns below to learn more. Use CMD + F (or CTRL + F) to search for words in the article.

Reports supported by Gusto—SOC 1, SOC 2, SSAE-18, and bridge letters

Gusto supports these reports for prospects, current customers, and past customers:

SOC 1: Checks internal financial processing
SOC 2: Focuses on IT, privacy, and technology
SSAE-18: Enhancements to improve the SOC reports
Bridge (gap) letters: Covers the time between the end of their last SOC report audit period and the current date.

You'll need to sign a Non-Disclosure Agreement (NDA) before you can download the reports.

Request a SOC 1 or SOC 2 report and bridge letter

You'll need to sign a Non-Disclosure Agreement (NDA) before you can download the reports.

NDA already signed (within last year)

If you already signed an NDA in the last year, you should have access to the Gusto Security Trust Center. If you do not have access, request access at the top of trust.gusto.com.

NDA needs to be signed

Go to www.gusto.com/security.
Under “Information Security”, click the SOC section.
Click Download documents to fill out a Non-Disclosure Agreement (NDA).
Fill out some information:
- Full name
- Work email address
- Company name
- Title
- Phone number
Click Accept.
You should see a link where you can now access the Gusto Security Trust Center and find the security documentation listed below.
- SOC 1 Type I
- SOC 2 Type II
- Gusto Bridge Letter
  - Covers the time between the end of their last SOC report audit period and the current date.
Go the Resources tab.
On the right-side of the page, click Request access.
Enter your full name, email, and company name (required).
For the "Reason", select I have signed an NDA with Gusto.
Choose the access level:
- Full access
- Request access to specific resources
Click Request access.

If approved, you'll get an email from Vanta ([email protected]) to access the Trust Center. If an NDA has not been signed, you'll need to sign one before accessing the documents further.

Full-calendar year reports

Gusto’s SOC reports sometimes cover from March of the previous year to February of the current year.

Example: Mar 2024–Feb 2025

To cover a full calendar year, request a "SOC2 type 2" report for the missing period from the previous year's report (e.g., Jan–Mar '24).