Vanta gets you ready. It can't sign your report.
That last step needs an independent assurance provider. Vanta's audit network is built around US firms and the US attestation standard. If your customers, your regulators and your data are in Europe, the report you need is the European one — and you shouldn't have to leave your Vanta workspace to get it.
Assurance requires a party with no stake in the controls. That's structural, not a gap in the product.
SOC 2 is a US attestation. ISAE 3000 is how Europe does the same work.
SOC 2 isn't a certification. It's an attestation governed by the AICPA, and the opinion can only be signed by a firm licensed by a US state board of accountancy. No Dutch, German or Swedish firm can issue one — including us.
What a European firm can do is run the identical examination under ISAE 3000, using the AICPA Trust Services Criteria as the benchmark. Same five criteria. Same Type 1 and Type 2 distinction. Same evidence, same testing, same period. Any firm that tells you it's literally a SOC 2 has just told you something useful about their standards.
| SOC 2 Type II | ISAE 3000 Type 2 — the European route | |
|---|---|---|
| Signed by | US-licensed CPA firm | Registered accountant or IT-auditor (RA/RE) |
| Governing body | AICPA | IAASB |
| Criteria tested | Trust Services Criteria | Trust Services Criteria — identical |
| Accepted by US procurement | Always | Usually — verify the wording in the contract first |
| Accepted by EU procurement | Usually | Always |
| Can cover ISO 27001, NIS2, DORA in the same engagement | No | Yes |
| Evidence and working papers leave the EU | Often | No |
| Report language | English | English, Dutch, German, Swedish |
| Works inside your Vanta workspace | Depends on the firm | Yes — via Vanta's auditor access |
Which one do you actually need
A contract names SOC 2
Engage a US CPA firm. Nothing else satisfies a procurement policy that specifies it by name, and we'll say so on the first call rather than the fourth. We can point you at firms we've worked alongside.
Your buyers are European
ISAE 3000 Type 2 against the Trust Services Criteria. Same assurance, EU jurisdiction, your language, and a signing partner in your timezone during fieldwork.
You also face ISO 27001, NIS2 or DORA
One engagement instead of three. The control testing overlaps heavily, so a single European audit cycle can produce the evidence all of them require, rather than three separate sets of fieldwork.
Four things a European auditor gives you that a US firm structurally cannot
This is not a preference for local suppliers. Each of these is a concrete difference in what you end up holding, and none of them can be fixed by a US firm working harder or charging less.
- 1. The report is issued under a standard your regulator already recognises
- ISAE 3000 is the IAASB assurance standard, adopted across the EU and in more than 130 jurisdictions. A SOC 2 is an AICPA attestation written for the US market. Both test the same Trust Services Criteria; only one of them sits inside the European assurance framework your supervisor, your auditor and your board already work within.
- 2. Your evidence and working papers stay in the EU
- An audit means handing over configuration exports, access reviews, incident records and personnel data. With a US firm those working papers sit under US jurisdiction and US lawful-access regimes. With a European firm they do not leave the EU — which matters if you are answering DORA third-party questions or a GDPR transfer assessment about your own supply chain.
- 3. One audit can serve your European obligations, not just your sales cycle
- A SOC 2 says nothing about NIS2, DORA or the EU AI Act. Those are the frameworks actually being enforced against you. A European assurance engagement can be scoped so the same control testing produces evidence for the report your customers ask for and the regulation your supervisor asks about.
- 4. Signing partner, language and timezone
- Fieldwork involves weeks of back-and-forth. A registered accountant or IT-auditor in your own timezone, issuing in English, Dutch, German or Swedish, and reachable when your team is at their desks, is the difference between a three-week close and a three-month one.
Securance is a Dutch firm operating across the Netherlands, the DACH region and the Nordics.
Adding us to your Vanta workspace
Select Securance from the auditor list
Settings, then User permissions, then the Auditors tab. We're already in the dropdown as a Vanta audit partner — no invite, no partner request, no waiting for Vanta to onboard a new firm.
Grant domain access
This does not open up your Vanta account. It lets our named auditors sign in to an auditor portal scoped to your engagement.
Open the engagement
We see nothing until the observation window starts, unless you choose to grant earlier access.
We pull evidence through the API
Not by email. No screenshot chains, no shared drives, nothing re-uploaded that you've already connected. Monitoring you've already run counts — changing auditor does not restart your observation period.
One thing we won't do
If we build your controls, we can't audit them. A report from the firm that designed the control environment is worth nothing to the buyer who asked for it. So if you want us for readiness or vCISO work, another firm signs your report. If you want us as auditor, we stay out of implementation. You'll know which side of that line we're on before you sign anything.
Questions we get on the first call
Can a Dutch firm issue a SOC 2 report?
No. The SOC 2 opinion is an AICPA attestation and requires a firm licensed by a US state board of accountancy. A Dutch firm can issue an ISAE 3000 report against the same Trust Services Criteria, which European buyers accept as standard and most US buyers accept on review.
Will my US customers accept an ISAE 3000 report?
Usually, but check the wording before you commit. If their policy names SOC 2 explicitly, engage a CPA firm. If it asks for independent assurance over security controls, ISAE 3000 against the Trust Services Criteria typically satisfies it. Send us the clause and we'll tell you which it is.
Do I have to leave Vanta to switch auditors?
No. You add us in your workspace settings and assign us to the engagement. Your existing monitoring period and collected evidence carry over.
Does Vanta have to approve my auditor first?
You can invite any firm yourself, but a firm that isn't already a Vanta audit partner has to go through Vanta's onboarding before fieldwork can start, which adds time. We're an existing partner, so that step doesn't apply.
What's the difference between ISAE 3000 and ISAE 3402?
ISAE 3402 covers controls relevant to your customers' financial reporting — the SOC 1 equivalent. ISAE 3000 is broader and is what's used for security, availability and privacy assurance — the SOC 2 equivalent.
Find out which report you actually need
Thirty minutes with a signing auditor. Bring the clause your customer sent you and we'll tell you whether we're the right firm — including when we're not.
Schedule a consultation