Picture a SaaS company whose SOC 2 Type II report covers a period ending in June. In October, a new customer asks for current proof of security. The next report isn’t out yet. This is where a SOC 2 bridge letter comes in.
A bridge letter is sometimes called a gap letter. It covers the time between the end of one SOC 2 report period and the release of the next. It’s written by the company itself, not the auditor. In it, leaders state that the controls in the last report haven’t changed in a major way. They also confirm that no serious security incidents have hurt them.
Customers and their vendor risk teams use bridge letters to fill the gap in coverage. Without one, a buyer may see months of time with no assurance at all and slow down the deal.
A typical SOC 2 bridge letter names the company and the last report. It lists the bridge period and confirms the controls still work as described. It’s signed by someone in leadership. If something did change, like a new hosting provider, the letter should say so.
Because the company signs it, a bridge letter only carries weight if it’s accurate. That means the controls really do need to keep running between audits. Access reviews, onboarding and offboarding, device management and monitoring can’t pause just because the auditor isn’t watching.
Bridge letters are usually valid for a few months. Customers expect the next full report to follow.
Sentant helps startups and investment firms keep SOC 2 controls running all year. Compliance, IT, and security support sit in one place.
