GitHub Enterprise Cloud – SOC 2 Type II Report and Bridge Letter Requests Unanswered for Over a Month

[lisapat9959]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Code Search and Navigation

Body

We are a **GitHub Enterprise Cloud customer and have been attempting for more than a month to obtain GitHub's current SOC 2 Type II report and applicable bridge letter, without success.

This is not a billing, upgrade, or self-service documentation question. This is a failure of GitHub's compliance-document fulfillment and support escalation processes.

Documents Requested

1. GitHub's most recent SOC 2 Type II report
2. The applicable bridge letter covering the period following the most recent audit

Issue

GitHub's Enterprise Trust Center does not provide direct access to these documents and instead directs customers through a request workflow. And nothing ever comes of the access requests in the trust center. No responses are received.

We have now:

• Had mutliple attempts in the trust center via the compliance tab in Github without receiving responses or the requested documents
• Had additional coworkers independently submit requests, also without receiving responses
• Attempted to open additional support tickets, only to have GitHub Copilot redirect us back to the same compliance documentation request process, preventing us from successfully escalating the issue

After more than a month of repeated requests, we have received neither the requested documents nor a substantive response explaining why they have not been provided.

Requested Resolution

We are asking that this discussion be brought to the attention of the team responsible for GitHub's Trust Center and compliance artifact distribution.

Specifically, we need:

1. Correct access path: Confirmation of how our GitHub Enterprise Cloud organization can obtain the requested documentation
2. Access prerequisites: Confirmation of any NDA, approval, account entitlement, or other requirements that may be preventing fulfillment
3. Delivery timeline: A specific ETA for when the requested documents will be available
4. Escalation ownership: A contact or responsible team that can investigate and resolve the failed request process

Please do not redirect us to the standard Trust Center request page or the Copilot support workflow. We have already attempted both repeatedly without success.

We are not asking GitHub to publish confidential compliance documents in this discussion. We are asking for someone to take ownership of the request and provide a working, secure method of obtaining the documentation.

We would appreciate a response from GitHub's Trust, Security, or Compliance team so that we can complete our required vendor security assessment.

[lakshyadeep-glitch]

Discussion Type

Question

Feature/Topic Area

Code Search and Navigation

Body

We are a GitHub Enterprise Cloud customer and have been trying for over a month to obtain GitHub’s latest SOC 2 Type II report and the applicable bridge letter, but we have not received the requested documents or a meaningful response.

This is not a billing or subscription issue. It concerns the compliance-document request process and the lack of an effective escalation path.

Documents Requested

1. GitHub’s latest SOC 2 Type II report
2. The applicable bridge letter covering the period following the latest audit

Issue

We have submitted multiple requests through GitHub’s Enterprise Trust Center, but none have resulted in access to the requested documents.

Several coworkers have submitted requests independently, with the same outcome. We have also attempted to open support tickets, but have repeatedly been directed back to the existing Trust Center workflow.

After more than a month of attempts, we still have neither the documents nor a clear explanation of what is preventing access.

Steps Already Attempted

1. Submitted multiple requests through the Trust Center’s compliance resources.
2. Asked coworkers to submit independent access requests.
3. Attempted to escalate the issue through GitHub Support.
4. Followed the suggested request process again, without receiving a resolution.

Relevant Official Links

• [GitHub Enterprise Trust Center](https://copilot.github.trust.page/)
• [Accessing compliance reports for your enterprise](https://docs.github.com/en/enterprise-cloud/admin/overview/accessing-compliance-reports-for-your-enterprise)
• [GitHub Support portal](https://support.github.com/contact)
• [Creating a support ticket](https://docs.github.com/en/enterprise-cloud/support/contacting-github-support/creating-a-support-ticket)

According to GitHub’s documentation, enterprise owners can access compliance reports through the enterprise’s Compliance page. However, our repeated attempts to obtain the requested materials have not been successful.

Requested Resolution

We would appreciate assistance from the team responsible for GitHub’s Trust Center and compliance-document distribution.

Specifically, we need:

1. Correct access path: Confirmation of how our Enterprise Cloud organization can obtain both documents.
2. Access requirements: Clarification of any required permissions, NDA, approval, or account entitlement.
3. Delivery timeline: An estimated date for fulfillment of our outstanding requests.
4. Escalation ownership: Confirmation of which team can investigate the failed request process and provide a resolution.

We have already tried the standard request process repeatedly, so directing us back to the same workflow without investigating the issue would not resolve the problem.

We understand that these documents may contain confidential information and are not asking for them to be published publicly. We are looking for a working, secure method of access and clear guidance on the next steps.

We would appreciate a response from GitHub’s Trust, Security, or Compliance team so that we can complete our vendor security assessment without further delays.

[lisapat9959]

I'm trying to figure out if, in your reply, you read what I wrote. I've already tried every one of those things that you listed. They do not work. This was my last resort.

When you go to the Enterprise or Copilot Trust centers and request the information, you get no confirmation that you requested it, and no access ever comes.

When you attempt to open a ticket, the Copilot AI shuts you down and says, "This is not a concern," and sends you back to the trust center that does not work. Worse, the AI copilot response sending you to the article about how to access your Trust Center asks you to rank the article as helpful or not, but no comments can be left. All I can do is give it a thumbs down because it doesn't work.

Nothing I have tried works. I have even attempted to escalate through Vanta, who is our shared SOC compliance monitor.

[lakshyadeep-glitch]

I’m really sorry that it didn’t work