1. [Home](/) 2. [Questions](/questions) 3. Which RFP software is SOC 2 and ISO 27001 certified? Security questionnaires and DDQs # Which RFP software is SOC 2 and ISO 27001 certified? Short answer 21 response tools list both SOC 2 and ISO 27001: 1up, Loopio, Ombud, Responsive, RocketDocs, SiftHub and 15 more. Ask for the current SOC 2 Type II report and ISO certificate before signing, and check the scope covers the product you are buying. 21 tools qualify on recorded evidenceNo paid placement Sources checked through Oct 2026 ## Tools that qualify, with the evidence __Rule: Both SOC 2 and ISO 27001 appear in the vendor certifications (sourced facts, security block or record list), and neither is marked as in preparation. Ordered by the related capability scores; ties go to sourced research facts, then overall score. Source dates are when the fact was read.__ | Tool | Evidence | Source | Starting price | | --------------------------------- | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | -------------------------- | | [1up](/1up) | Lists SOC 2 Type II; ISO 27001. | [1up.ai](https://1up.ai/)as of Oct 2026 | $0 (free tier) | | [Loopio](/loopio) | Lists SOC 2 Type II; ISO 27001 (legal addendum). | [loopio.com](https://loopio.com/legal/infosec-addendum/)as of Aug 2026 | Custom (\~$20K+/yr est.) | | [Ombud](/ombud) | Lists SOC 2; ISO 27001:2013 (announced 2021). | [ombud.com](https://www.ombud.com/blog/ombud-iso27001-certification-data-security-announcement)as of Aug 2026 | Custom | | [Responsive](/responsive) | Lists SOC 2 Type II; ISO 27001:2022. | [responsive.io](https://www.responsive.io/legal/dpa)as of Aug 2026 | $10,000 (Emerging edition) | | [RocketDocs](/rocketdocs) | Lists SOC 2 Type II; ISO 27001. | [rocketdocs.com](https://rocketdocs.com/trust)as of Aug 2026 | $18,500/yr | | [SiftHub](/sifthub) | Lists SOC 2 Type II; ISO 27001:2022. | [sifthub.io](https://sifthub.io)as of Jul 2026 | Custom | | [AutoRFP.ai](/autorfp-ai) | Lists SOC 2 Type II; ISO 27001:2022. | [autorfp.ai](https://autorfp.ai/trust)as of Aug 2026 | $899/mo | | [Drata](/drata) | Lists SOC 2 Type II; ISO 27001:2022. | [trust.drata.com](https://trust.drata.com/)as of Oct 2026 | Custom | | [Qvidian](/qvidian) | Lists SOC 2 / SSAE 118; ISO 27001 (older product pages). | [uplandsoftware.com](https://uplandsoftware.com/qvidian/technology/)as of Aug 2026 | Custom | | [Secureframe](/secureframe) | Lists SOC 2 Type II; ISO 27001:2022. | [trust.secureframe.com](https://trust.secureframe.com/)as of Oct 2026 | $7,500/yr | | [Sequesto](/sequesto) | Lists SOC 2 Type II; ISO 27001. | [sequesto.com](https://sequesto.com/product/security-and-governance)as of Oct 2026 | €750/mo | | [TrustCloud](/trustcloud) | Lists SOC 2 Type II; ISO 27001:2022. | [trust.trustcloud.ai](https://trust.trustcloud.ai/)as of Oct 2026 | Custom | | [Vanta](/vanta) | Lists SOC 2 Type II; ISO 27001. | [vanta.com](https://www.vanta.com/company/security)as of Oct 2026 | Custom | | [Whistic](/whistic) | Lists SOC 2 Type II; ISO 27001 and ISO/IEC 27001:2022. | [whistic.com](https://www.whistic.com/trust-security-privacy)as of Oct 2026 | Custom | | [SafeBase](/safebase) | Lists SOC 2 Type II (Drata trust center); ISO 27001 (Drata trust center). | [trust.drata.com](https://trust.drata.com/?product=safebase)as of Oct 2026 | Custom | | [SparrowGenie](/sparrowgenie) | Lists SOC 2 Type II; ISO 27001. | [sparrowgenie.com](https://www.sparrowgenie.com/security)as of Oct 2026 | $899/mo | | [Thalamus AI](/thalamus-ai) | Lists SOC 2 Type II; ISO 27001:2022. | [thalamushq.trust.site](https://thalamushq.trust.site/)as of Oct 2026 | Custom | | [AutogenAI](/autogenai) | Lists SOC 2; ISO 27001. | [trust.autogenai.com](https://trust.autogenai.com/)as of Aug 2026 | Custom | | [Docket](/docketai) | Lists SOC 2 Type II and SOC 2 Type I and Type II; ISO 27001. | [docket.io](https://www.docket.io/platform/security-and-trust)as of Oct 2026 | $3,000/mo | | [Kantiv](/kantiv) | Lists SOC 2 Type II; ISO 27001 (ISO/IEC 27001:2022). | [trust.kantiv.com](https://trust.kantiv.com/)as of Oct 2026 | Custom | | [ContraVault AI](/contravault-ai) | Lists SOC 2 Type II and SOC 2 Type 2; ISO 27001:2022. | [contravault.com](https://www.contravault.com/privacy)as of Oct 2026 | Custom | ## Why this question matters Your RFP library holds pricing, security answers and customer names, so the tool will face your own security review. SOC 2 and ISO 27001 are the two attestations most buyers ask for first. ## Which one fits your situation - If you need EU data hosting as well, start with [Loopio](/loopio), [Responsive](/responsive) and [RocketDocs](/rocketdocs). - If you need SSO on top, start with [RocketDocs](/rocketdocs), [Secureframe](/secureframe) and [Sequesto](/sequesto). ## What to test in a trial 1. Request the SOC 2 Type II report and read the exceptions section. 2. Check the ISO certificate scope and expiry date. ## Caveats - A listed certification is as published by the vendor on the date shown. Verify the current report. - Some records carry a certification without a separate sourced page; the source column falls back to the vendor site. ## How we decided who qualifies Only RFP, DDQ and questionnaire response tools with a published profile are checked. A tool is named here only when its record shows the rule above, either in a sourced research fact or in the reviewed profile, and we publish an answer only when at least three tools qualify. A tool missing from the table may still do this; it has not been documented in a way we could source. Read the [research methodology](/methodology) for how facts are dated and corrected. ## More questions on this topic Is SOC 2 Type II better than Type I? Type II tests controls over a period of time; Type I checks design at a point in time. Buyers usually ask for Type II. Does ISO 27001 replace SOC 2? They overlap. US buyers often ask for SOC 2; international buyers often accept ISO 27001. ## Related questions - [Which RFP software supports SSO and role-based access?](/questions/which-rfp-software-supports-sso-and-role-based-access) - [Which RFP software offers EU data hosting?](/questions/which-rfp-software-offers-eu-data-hosting) - [Security questionnaire automation tools](/security-questionnaire-automation) - [All buyer questions](/questions) Compared tools on this page: 1up, Loopio, Ombud, Responsive, RocketDocs, SiftHub, AutoRFP.ai and Drata and more.