Security questionnaires and DDQs
Which RFP software is SOC 2 and ISO 27001 certified?
Short answer
21 response tools list both SOC 2 and ISO 27001: 1up, Loopio, Ombud, Responsive, RocketDocs, SiftHub and 15 more. Ask for the current SOC 2 Type II report and ISO certificate before signing, and check the scope covers the product you are buying.
Tools that qualify, with the evidence
| Tool | Evidence | Source | Starting price |
|---|---|---|---|
| 1up | Lists SOC 2 Type II; ISO 27001. | 1up.aias of Oct 2026 | $0 (free tier) |
| Loopio | Lists SOC 2 Type II; ISO 27001 (legal addendum). | loopio.comas of Aug 2026 | Custom (~$20K+/yr est.) |
| Ombud | Lists SOC 2; ISO 27001:2013 (announced 2021). | ombud.comas of Aug 2026 | Custom |
| Responsive | Lists SOC 2 Type II; ISO 27001:2022. | responsive.ioas of Aug 2026 | $10,000 (Emerging edition) |
| RocketDocs | Lists SOC 2 Type II; ISO 27001. | rocketdocs.comas of Aug 2026 | $18,500/yr |
| SiftHub | Lists SOC 2 Type II; ISO 27001:2022. | sifthub.ioas of Jul 2026 | Custom |
| AutoRFP.ai | Lists SOC 2 Type II; ISO 27001:2022. | autorfp.aias of Aug 2026 | $899/mo |
| Drata | Lists SOC 2 Type II; ISO 27001:2022. | trust.drata.comas of Oct 2026 | Custom |
| Qvidian | Lists SOC 2 / SSAE 118; ISO 27001 (older product pages). | uplandsoftware.comas of Aug 2026 | Custom |
| Secureframe | Lists SOC 2 Type II; ISO 27001:2022. | trust.secureframe.comas of Oct 2026 | $7,500/yr |
| Sequesto | Lists SOC 2 Type II; ISO 27001. | sequesto.comas of Oct 2026 | €750/mo |
| TrustCloud | Lists SOC 2 Type II; ISO 27001:2022. | trust.trustcloud.aias of Oct 2026 | Custom |
| Vanta | Lists SOC 2 Type II; ISO 27001. | vanta.comas of Oct 2026 | Custom |
| Whistic | Lists SOC 2 Type II; ISO 27001 and ISO/IEC 27001:2022. | whistic.comas of Oct 2026 | Custom |
| SafeBase | Lists SOC 2 Type II (Drata trust center); ISO 27001 (Drata trust center). | trust.drata.comas of Oct 2026 | Custom |
| SparrowGenie | Lists SOC 2 Type II; ISO 27001. | sparrowgenie.comas of Oct 2026 | $899/mo |
| Thalamus AI | Lists SOC 2 Type II; ISO 27001:2022. | thalamushq.trust.siteas of Oct 2026 | Custom |
| AutogenAI | Lists SOC 2; ISO 27001. | trust.autogenai.comas of Aug 2026 | Custom |
| Docket | Lists SOC 2 Type II and SOC 2 Type I and Type II; ISO 27001. | docket.ioas of Oct 2026 | $3,000/mo |
| Kantiv | Lists SOC 2 Type II; ISO 27001 (ISO/IEC 27001:2022). | trust.kantiv.comas of Oct 2026 | Custom |
| ContraVault AI | Lists SOC 2 Type II and SOC 2 Type 2; ISO 27001:2022. | contravault.comas of Oct 2026 | Custom |
Why this question matters
Your RFP library holds pricing, security answers and customer names, so the tool will face your own security review. SOC 2 and ISO 27001 are the two attestations most buyers ask for first.
Which one fits your situation
- If you need EU data hosting as well, start with Loopio, Responsive and RocketDocs.
- If you need SSO on top, start with RocketDocs, Secureframe and Sequesto.
What to test in a trial
- Request the SOC 2 Type II report and read the exceptions section.
- Check the ISO certificate scope and expiry date.
Caveats
- A listed certification is as published by the vendor on the date shown. Verify the current report.
- Some records carry a certification without a separate sourced page; the source column falls back to the vendor site.
How we decided who qualifies
Only RFP, DDQ and questionnaire response tools with a published profile are checked. A tool is named here only when its record shows the rule above, either in a sourced research fact or in the reviewed profile, and we publish an answer only when at least three tools qualify. A tool missing from the table may still do this; it has not been documented in a way we could source. Read the research methodology for how facts are dated and corrected.
More questions on this topic
Is SOC 2 Type II better than Type I?
Type II tests controls over a period of time; Type I checks design at a point in time. Buyers usually ask for Type II.
Does ISO 27001 replace SOC 2?
They overlap. US buyers often ask for SOC 2; international buyers often accept ISO 27001.