TMS SOC 2 Compliance: What Enterprise Buyers Should Verify in 2026

TMS SOC 2 compliance means that an independent CPA firm has examined a transportation management system vendor’s controls against the AICPA trust services criteria and issued a report on them. The report is an auditor’s opinion, not a certificate, and its value depends on its type, its audit period, the criteria it covers and whether the product you are buying is inside its scope. A TMS holds customer addresses, delivery windows, driver locations and carrier connections, and it sits in the middle of ERP, warehouse and carrier integrations, so the report is one of the first documents a security team asks for. For CIOs, security leaders and logistics buyers, the skill is reading the report, not collecting the badge. Locus, the world’s first Decision-Intelligent, Agentic TMS, holds SOC 2 Type II and publishes its security posture on its trust page.

Why SOC 2 Matters for a TMS: The Business Case

Breaches are expensive and getting more so. IBM’s 2026 Cost of a Data Breach report puts the global average cost at $4.99 million, a 12% increase and a record high. A TMS is a data-rich target because it connects to systems that hold orders, customers and carriers.

The criteria are defined, and they are narrower than people assume. The AICPA’s SOC 2 examination covers the five trust services criteria: security, availability, processing integrity, confidentiality and privacy. A report can include some of the five rather than all of them.

The type decides what the report proves. According to CPA firm Linford & Co, a Type 2 report covers a period, typically twelve months and generally six months to a year, while a Type 1 is as of a single point in time. At least six months must pass before a Type 2 can be issued, so a vendor with only a Type 1 has a shorter track record.

Distribution is limited. Linford & Co notes that SOC 2 reports are generally restricted to the service organization, its user entities and their auditors, which is why buyers usually see a SOC 3 summary first and ask for the full report under NDA.

How Locus Approaches TMS Security and SOC 2

Locus, the world’s first Decision-Intelligent, Agentic TMS, was recognized by Gartner for seven consecutive years and appears in the 2026 Hype Cycle for Supply Chain Execution and Logistics Technologies. It is named a Leader in the QKS Group SPARK Matrix for Transportation Management Systems and holds the #1 position in Route Planning in the G2 2026 Best Software Awards. In October 2025, Ingka Investments, the investment arm of Ingka Group, the world’s largest IKEA retailer, acquired Locus. Locus continues to operate independently.

Locus’s trust page lists SOC 2 Type II, a downloadable SOC 3 report covering security, availability and confidentiality, ISO 27001:2022, ISO 27701:2019 and GDPR, the last supported by a gap assessment from DNV, and it states that HIPAA safeguards apply. On the technical side it lists AES 256-bit encryption at rest, TLS 1.2 in transit, SAML and ADFS single sign-on, role-based access control, audit trails for user activity, web application firewall and intrusion detection, and regular vulnerability assessment and penetration testing. A list of sub-processors is published, and a data processing agreement is available on request. Around automated decisions, six governance mechanisms, explainability, traceability, evaluation, autonomy levels, an execution sandbox and human-in-the-loop approval, give security and audit teams a record of what the agents decided and why. Locus has optimized 1.5B+ deliveries for 360+ enterprise customers across 30+ countries. The trust page does not state the SOC 2 audit period or the sharing terms for the full report, so during evaluation ask Locus for the SOC 2 Type II report, the examination period, the criteria covered, the exceptions noted, the complementary user entity controls and how the subservice organizations are treated, and confirm the terms on which the report is shared. 

What is Different About SOC 2 for a TMS

The data is operational and personal. A TMS holds customer names, addresses, delivery windows and driver locations, so confidentiality and privacy matter as much as security.

Integration is the product. A TMS connects to ERP, OMS, WMS, telematics and carrier systems, so the report’s scope has to cover the interfaces and credentials, not just the application.

Availability is operational. A dispatch platform that is unavailable at the start of a delivery window affects the day’s routes, so the availability criterion has a direct operational meaning.

Automated decisions create their own evidence needs. An agentic TMS decides which carrier, driver or route to use, so buyers also ask how a decision can be traced and explained, which a SOC 2 report does not cover on its own.

Multi-tenant platforms share infrastructure. 3PLs and large shippers should check how the report treats customer separation and who the subservice organizations are, such as cloud hosts.

How to Read a TMS Vendor’s SOC 2 Report in Six Steps

1. Confirm the report type and audit period

Record the legal name of the vendor, whether it is Type 1 or Type 2, the dates of the examination period and the date of the auditor’s report. A Type 2 whose period ended more than a year ago describes a period that has closed.

2. Check which criteria are in scope

Security is the base. Look for availability if uptime matters to you, confidentiality for customer data and privacy for personal information. A report without a criterion gives you no audited basis for claims about it.

3. Match the system description to your purchase

Read the description of the system to confirm it names the TMS product and modules you will use, the infrastructure that runs them and the locations that support it. A report on a different product line is not evidence about yours.

4. Read the exceptions and management responses

Exceptions are normal, and what matters is whether they were remediated and whether the auditor tested the fix. A future remediation plan does not erase a deviation that occurred during the period.

5. Map the complementary user entity controls

According to Bitsight’s review guide, these are controls the provider expects you to run, such as restricting administrator access or configuring authentication. Assign an owner to each one that applies.

6. Check subservice organizations and the gap since the report

Find out whether cloud hosts and other subservice providers are carved out, which means their controls are excluded, or included. If they are carved out, request their reports. Ask for a bridge letter if the report period ended some time ago.

SOC 2 vs SOC 3 vs ISO 27001: Key Differences

What to Look for in a SOC 2-Ready TMS Vendor

A current Type 2 report. Check the period end date and ask when the next examination is due. Ask for a bridge letter if there is a gap.

Criteria that match your risk. Look for availability and confidentiality in scope, not only security, and for privacy where personal data is involved.

A scope that covers your product. The system description should name the TMS platform, the modules you will use and the infrastructure behind them.

Controls you can see in operation. Look for evidence that fits the report, such as encryption standards, single sign-on, role-based access and audit trails for user activity.

A way to trace automated decisions. Ask how the platform explains and records what its agents decide, since the report will not.

Enterprise TMS Deployments in Action: Real-World Results

Neither deployment below is a security result. They show the integration breadth that makes a security review matter.

A global freight operator with 4,500+ drivers across 51 service centers. The operator ran 1,500+ captive drivers and 3,000+ third-party transporters across a network spanning more than 120 countries. With centralized dispatch, the execution rate rose from 75% to 92%, uncovering $14M+ in annualized capacity across 25 sites. Read the freight operator case study.

A Canadian multi-modal retailer. Six legacy systems handled dispatch across ocean, rail and road. After consolidating them on one platform, the retailer reached 99%+ on-time store delivery, 95%+ route compliance and 80%+ less manual dispatch, held exceptions under two hours and saved $1M+. Read the retailer case study.

Common SOC 2 Review Mistakes to Avoid

Treating a SOC 3 as the SOC 2. The SOC 3 is a public summary without test results, so it is a start, not the evidence.

Reading only the auditor’s opinion. The opinion is a few pages. The exceptions and the user entity controls are where the buyer’s work is.

Ignoring your own controls. A vendor’s report covers the vendor. How administrators, credentials and integrations are configured on your side is your responsibility.

Checking once. Reports are renewed on a cycle, so set a reminder at the end of each report period.

For security and logistics leaders asking how to verify a TMS vendor’s SOC 2 compliance, Locus publishes its attestations and controls, and invites buyers to test them against the report itself. To see how Locus would pass your security review, schedule a demo.

Frequently Asked Questions

What does SOC 2 mean for a TMS? It means an independent CPA firm has examined the TMS vendor’s controls against the AICPA trust services criteria and issued a report. It is an auditor’s opinion on those controls, not a certificate, and it covers only the criteria and scope included in the report.

What is the difference between SOC 2 Type 1 and Type 2? Type 1 covers whether controls are suitably designed at a point in time. Type 2 covers design and operating effectiveness over a period, typically six to twelve months, and includes the auditor’s test procedures and results.

Which SOC 2 criteria matter most for a TMS? Security is the base. Availability matters because a dispatch platform has to be up when routes are planned, and confidentiality and privacy matter because the platform holds customer and driver data. A report only counts the criteria it includes.

Can I get a vendor’s SOC 2 report? Usually, but SOC 2 reports are generally restricted to customers and their auditors, so vendors often share them under NDA and publish a shorter SOC 3 report publicly. Ask for the full report during evaluation.

Is a SOC 3 report enough? A SOC 3 is a useful public summary, but it leaves out the description of controls tested and the results. For a procurement decision, ask for the SOC 2 Type 2 report.

Does Locus have SOC 2? Locus’s trust page lists SOC 2 Type II and a SOC 3 report, along with ISO 27001:2022, ISO 27701:2019 and GDPR. Ask Locus for the SOC 2 report to see the examination period, the criteria covered and any exceptions.