This article is for prospects, current customers, and past customers who need access to Gusto’s SOC reports and bridge letters.
A Service Organization Controls (SOC) report helps verify that a company follows important rules to keep data safe, private, and available. Independent third-party auditors create these reports to help customers and partners check for risks when working with a company.
Our reports focus on security, availability, and confidentiality.
Expand the sections to learn more. Use CMD + F (or CTRL + F) to search for words in the article.
We support the following reports for prospects, current customers, and past customers:
SOC 1: Checks internal financial processing
SOC 2: Focuses on IT, privacy, and technology
SSAE-18: Enhancements to improve the SOC reports
Bridge (gap) letters: Cover the time between the end of our last SOC report audit period and the date on the letter
You’ll need to sign a Non-Disclosure Agreement (NDA) before you can download the reports.
Our bridge letters are in the same folder as our SOC reports, so these steps get you both.
Before you download our security reports, you must sign a Non-Disclosure Agreement (NDA). We use a self-service workflow so you can sign the NDA and then access the reports.
How to sign the NDA and get our security reports:
Go to our Security Trust Center at https://gusto.com/security.
Scroll to Information Security, then open the SOC dropdown.
Click the link to our Ironclad NDA form (hosted at ironcladapp.com).
On the form, enter:
Full legal name of your business
Full name of the person signing for your business
Email address of the signer
Job title of the signer
Click Submit. Our system automatically creates the NDA and refreshes the page.
Click Click to sign, then complete the signature steps.
After you sign, you see a “You’re All Set!” message. Click Download it now to save a copy of the signed NDA.
After the NDA is signed, we send an automatic email from “Gusto via Ironclad” via Security-GRC to the email address you entered in the NDA form.
Open that email (check spam if needed) and click the link in the message body. A new browser tab opens with a folder that contains our security certification reports and bridge letters.
View or download any report you need from that folder.
Did not get the email, or need a bridge letter that covers a later date? Each bridge letter covers the time up to the date on the letter, and we add newer letters to the folder over time. Check the folder for the newest one first. If you still cannot find what you need, contact us.