GUIDE
Reading a vendor security page
Certifications, encryption claims, and data-location statements say different things, and only one of them is about your client data.
Updated September 20, 2026
A certification is about the vendor's process
A SOC 2 report or an ISO certification describes how the vendor runs its systems. It is evidence about process, not a statement about what happens to a particular firm's client data.
That does not make it unimportant. It makes it a different kind of fact from the confidentiality wording, and the record keeps them in separate fields for that reason.
Encryption claims have two halves
Encryption in transit and encryption at rest are separate claims. A page that says encrypted without saying which one has said less than it appears to.
Where the vendor names both, the record can quote both. Where the page is silent on one, the gap is worth putting to the vendor rather than filling in yourself.
Data location is the claim closest to the client question
Where a vendor publishes a hosting region or a data-location statement, that is the claim most directly relevant to a firm's own confidentiality obligations. It is also the claim most often missing.
Where the vendor publishes nothing, the record says Not stated. That is a recorded absence in the checked source, not a finding about the vendor.
Read the security page beside the training statement
A strong security page and a permissive training statement can sit on the same website. One describes who can reach the data; the other describes what the vendor may do with it.
The record keeps confidentiality, training, and data location as three separate observations so a firm can see which parts are strong and which are silent.