Leaderboards compress. A provider profile shows a row of badges, SOC 2, ISO 27001, HIPAA, and a reader scanning eighteen rows will reasonably assume that the same badge means the same thing on every row. It often does not.
The difference that matters most is scope: what the certification actually covers. This article explains the three common scopes, how they show up on our provider leaderboard and the most secure list, and what a security reviewer should request before treating two badges as equal.
What is an inherited certification?
An inherited certification is one held by a supplier that a vendor depends on, most often the cloud platform it runs on. Large infrastructure providers maintain extensive SOC 2 reports and ISO 27001 certificates covering their data centers, physical security, network controls and hardware handling. Any software company that runs on that infrastructure benefits from those controls.
What the software company does not get from its host is assurance about its own layer: how its application handles permissions, who among its staff can reach customer documents, how it reviews code changes, how it responds to incidents. Those controls live with the vendor, and only an attestation that names the vendor’s own system covers them.
Three layers a data room certification can cover
Hosting infrastructure
Data centers, physical access, network and hardware. Usually attested by the cloud provider.
Vendor application
Permissions, encryption handling, logging and code changes inside the data room product.
Vendor organization
Staff access approvals, background checks, incident response, supplier management.
How do SOC 2 reports handle the cloud host?
SOC 2 reports are prepared under AICPA attestation standards, and they have an explicit way of dealing with suppliers. When a vendor relies on a cloud host, the report treats the host as a subservice organization and uses one of two methods.
| Method | What the report covers | What the reader must do |
|---|---|---|
| Carve-out | The vendor’s own controls; the host’s controls are excluded and the report lists the controls it assumes the host operates | Obtain and read the host’s own report for the excluded layer |
| Inclusive | The vendor’s controls and the host’s relevant controls, tested together | Read one report, which is rarer and needs the host’s cooperation |
| Infrastructure only | The host’s report, presented by the vendor as its assurance | Ask whether any report covers the vendor’s own application and staff |
The carve-out method is normal and not a weakness. Most software vendors use it, because large hosts publish their own reports. The third row is different: it describes a vendor that has no SOC 2 report of its own and points buyers to its host’s report. That is an inherited attestation in the strict sense, and it should be read as one.
How does our facts file record scope?
Our facts file distinguishes two SOC 2 listings: SOC 2, meaning the vendor lists a report covering its own service, and SOC 2 Infrastructure, meaning the listing covers the hosting layer. ISO 27001, HIPAA and GDPR are recorded separately.
How the 18 tracked providers list certifications
Providers listing a SOC 2 report on their own service in our facts.
Ellty lists SOC 2 for its hosting infrastructure rather than its application.
Providers listing an ISO 27001 certificate, including iDeals, Datasite and Intralinks.
Box and Citrix ShareFile list HIPAA support.
The one infrastructure-only listing belongs to the provider at the top of our overall list. Ellty’s profile states it plainly: SOC 2 is listed for the hosting infrastructure rather than the application, and there is no ISO 27001 certificate. Inside the room it lists two-factor login, dynamic watermarking, view, print and download rights and a full audit trail, and its Data protection mark on our model is 9.4 out of 10. On the most-secure list it still places fourth, behind three providers that hold ISO 27001 and list single sign-on and redaction. A procurement policy that names a product-level SOC 2 report or ISO 27001 as a hard requirement should be applied as a filter before any ranking.
How does scope change a security score?
On our model, scope affects scores in two places. The Data protection criterion, which carries 21% of the overall score and 45% on the most-secure list, reflects attestations as well as controls, so an infrastructure-only SOC 2 and no ISO 27001 cost points there. And the most-secure list adds 2.5 bonus points for ISO 27001, the single largest bonus on that list.
What scope does not do is erase controls. A room with strong document rights, watermarking and audit trails, built on a well-attested host, can be a sound choice for many deals. The question for a buyer is whether their own policy accepts that evidence.
What should you request from each provider?
Do not rely on badges on a website or a leaderboard, including ours. Request the documents and read the lines that define scope.
Certification documents to request
- The latest SOC 2 Type II report, with the system name and the period covered on its first pages.
- The list of subservice organizations and whether each was carved out or included.
- The cloud host's own SOC 2 report if the vendor's report carves it out.
- A bridge letter covering the gap between the report period end and today.
- The ISO 27001 certificate with scope statement, certification body and expiry date.
- For health data, the business associate agreement and the scope of HIPAA support.
Reading a SOC 2 report for scope in ten minutes
- 1Find the system name
The opening section names the system examined. Check that the data room product appears there, not only a parent company or platform.
- 2Check the type and period
A Type II report tests controls over a period, often six to twelve months. Note the end date and ask for a bridge letter if it is old.
- 3List the subservice organizations
Note each supplier, usually the cloud host, and whether it was carved out. Collect those reports separately.
- 4Read the user entity controls
The report lists controls the customer is expected to operate, such as reviewing user access. Those become your tasks.
- 5Scan the exceptions
Any tested control that failed is noted with the vendor's response. A few minor exceptions are common; repeated access-control exceptions are not.
Does an inherited certification rule a provider out?
That depends on the buyer, not the provider. Plenty of deal teams, especially in founder-led sales, fundraising rounds and mid-market M&A, accept a room built on a well-attested host when the in-room controls are strong and the vendor answers security questions clearly. Enterprise procurement, regulated financial firms and public bodies often cannot, because their policy names a product-level report or ISO 27001.
The practical answer is to know your own policy before you read any list. If it names a specific attestation, filter on it. If it does not, compare the in-room controls and the vendor’s answers, and use the ranking to order what remains. Our ranking method explains how attestations feed the Data protection criterion, and the feature checker lets you filter all 18 providers on the in-room controls.
Related top list Top 10 most secure virtual data rooms Ranked mostly on data protection, with the largest bonus for ISO 27001. 1
Ellty2
iDeals3
Datasite See the full list →
Frequently asked questions
What does inherited SOC 2 mean for a data room?
It means the SOC 2 assurance comes from the cloud provider the data room runs on, covering the hosting layer, rather than from a report on the data room vendor's own application and staff.
Is a carve-out SOC 2 report a red flag?
No. Carving out the cloud host is standard practice. The vendor's own controls are still examined, and you read the host's report for the excluded layer. The concern is a vendor with no report on its own service at all.
Which data room providers hold ISO 27001?
In our facts, 12 of the 18 tracked providers list ISO 27001, including iDeals, Datasite, Intralinks, Ansarada, Firmex, Drooms and SmartRoom. Ask for the certificate and its scope statement.
Why does Ellty rank first overall if its SOC 2 is infrastructure only?
The overall model weights six criteria, and Ellty scores highly on toolkit, ease of adoption and cost predictability. Its attestation scope costs it points on Data protection, and on the most-secure list it earns only one of the five bonus items, where iDeals, Datasite and Intralinks earn four each.
How recent should a SOC 2 report be?
Ideally the period should have ended within the last twelve months. If it ended earlier, ask for a bridge letter covering the gap and the date of the next report.