Enterprise SLAs, SOC 2 and 24/7 Support: How to Verify TMS Vendor Claims

Enterprise assurance in a TMS procurement covers three separate things that are usually discussed as one: security attestations such as SOC 2 and ISO 27001, platform availability expressed as an uptime figure, and support coverage across the regions you operate in. Each is verifiable, and none of them is verified by a vendor saying yes. This guide explains what each attestation actually attests, what it deliberately leaves out, and the specific questions that turn a claim into evidence.

Why These Three Questions Now Gate TMS Shortlists

The financial case for asking is no longer abstract. IBM’s Cost of a Data Breach Report puts the global average at $4.99 million, a 12% rise year over year and a record, with AI-enabled breaches now accounting for one in four malicious incidents at an average of $6 million each. A TMS holds customer addresses, delivery windows, carrier credentials and often payment-adjacent settlement data, which places it inside the scope of that exposure rather than adjacent to it.

The attack surface grows with every integration, and integration is exactly what an enterprise TMS deployment consists of. Gartner’s survey conducted in October and November 2025 found that more than half of chief supply chain officers, 56% of those surveyed, cite integrating AI with legacy systems as a major challenge. Each connection to an ERP, WMS, OMS or carrier endpoint is both an operational dependency and a credential to be protected.

What makes this worth a dedicated evaluation step rather than a checkbox is that the three claims are routinely conflated. A vendor can hold a genuine SOC 2 Type 2 report covering security only, publish a 99.9% availability figure that is a measured historical average rather than a commitment, and offer support hours that cover two of your four operating regions. All three statements can be true and the combination can still fail your requirements. Separating them is the whole job.

There is also a timing reason to do this early rather than at contract stage. Security review is the step most likely to stall a signed deal, because it is usually the first point at which someone reads the scope documents rather than the summary. A gap discovered then costs a renegotiation and a quarter. The same gap discovered during shortlisting costs one email.

What Each Attestation Actually Attests

1. Understand the SOC family before comparing reports

The AICPA maintains the Trust Services Criteria underpinning SOC 2, covering five categories: security, availability, processing integrity, confidentiality and privacy. These are outcome-based criteria used to evaluate whether a system and its controls are effective against objectives management has set.

Two distinctions matter more than anything else in a vendor conversation. The first is type. A Type 1 report addresses the description of the system and the design of controls. A Type 2 report adds the operating effectiveness of those controls over a stated period, which is the difference between a vendor having written a policy and a vendor having followed it. The second is criteria coverage. Most SOC 2 reports do not cover all five categories, and a report scoped to security alone says nothing about availability, which is the criterion that bears on uptime.

SOC 3 is a general-use report containing less detail than SOC 2 and intended for public distribution. A vendor publishing a SOC 3 is being helpful, and it is not a substitute for reading the SOC 2 when you are the one signing.

2. Read the ISO 27001 scope statement, not the certificate

This is the single most overlooked item in TMS security diligence. ISO/IEC 27001:2022 specifies requirements for an information security management system, and ISO’s own guidance is explicit that certification scope is a statement describing the activities, products and services applicable at each site, and that an organization may choose to certify only part of its products, services, processes or sites.

The practical consequence is that a genuine ISO 27001 certificate can exclude the platform you are evaluating. A vendor certified for its corporate IT and its primary data center, but not for the newly acquired module you intend to deploy, is accurately describing itself as ISO 27001 certified. The certificate number tells you nothing. The scope statement tells you everything, and it is a short document. Request the statement of applicability alongside it, since that names which controls from the standard the organization applied and which it excluded with justification. Together those two documents answer in five minutes what a security questionnaire takes six weeks to circle.

3. Separate an availability figure from an availability commitment

Uptime is quoted in two forms that look identical on a slide. A measured historical figure describes what happened. A commitment describes what the vendor undertakes to deliver, and it comes with a definition of downtime, a measurement window, exclusions for planned maintenance, and a remedy if missed. Ask which one you are being shown, then ask how downtime is defined, because a platform that counts only total unavailability will report differently from one that counts degraded performance. The distinction has operational weight in logistics specifically. A dispatch engine that responds in forty seconds instead of two is not down by most definitions, and it is unusable during a dispatch window, so ask whether latency thresholds appear anywhere in the availability definition.

4. Map support coverage against your operating map, not against a label

“24/7 global support” is a marketing phrase rather than a specification. The specification is a table. For each region you operate in, establish the hours during which a human responds, the language, the severity definitions, the target response time per severity, and whether the first responder can resolve or only triage. An operation running evening peaks in three time zones needs coverage during those peaks specifically, which is a narrower and more answerable requirement than round-the-clock everything. Framing it that way also tends to produce a better answer, because a vendor who cannot promise universal coverage can often commit to your actual windows, and a requirement they can meet is worth more than one they will agree to and miss.

5. Ask about subprocessors and data residency together

A TMS rarely runs alone. Mapping and geocoding services, notification providers, cloud regions and carrier APIs all touch data, and each is a subprocessor for data protection purposes. Ask for the subprocessor list, then ask which regions data is processed and stored in. For operations spanning the EU, the UK, the Gulf and North America, residency requirements can differ by market and a single global answer usually means the question has not been examined.

6. Establish the renewal cadence and the last report date

Attestations lapse. A SOC 2 Type 2 observation period ending 14 months ago is a statement about a period that has closed, and the interval since is unexamined. Ask for the current report date, the next scheduled examination, and whether any material change has occurred since, such as a migration, an acquisition or a new region.

Attestation Decoder

The pattern across every row is the same. The named thing is a container, and the contents are defined by a scope document that is short, specific and usually available on request. Procurement processes that collect the container names and never open them are performing diligence rather than doing it.

Worth noting what this table is not. None of these attestations is a guarantee against a breach, and a vendor with a complete set can still be compromised. What they establish is that controls exist, were examined by a third party, and cover a defined scope. That is meaningfully better than a vendor assertion and meaningfully weaker than a promise, and buyers who understand the difference negotiate better contracts than those who treat the certificate as either worthless or conclusive.

Five Questions to Put in the RFP

1. Provide your most recent SOC 2 Type 2 report, including the observation period and any exceptions noted. Exceptions are normal and their absence is more suspicious than their presence. What matters is whether they were remediated and how quickly. A report with zero exceptions across a twelve-month window is either a very narrow scope or a very light examination, and either is worth a follow-up question.

2. Provide your ISO 27001 scope statement and confirm the module we are purchasing is within scope. Ask for this in writing. It is the fastest way to find a gap that would otherwise surface during a security review after signature, and a written confirmation is worth having on file regardless of what the certificate says.

3. Which trust services criteria does your SOC 2 cover? If availability is not among them, the uptime figure has no attested basis and should be treated as a vendor-reported metric.

4. Give the per-region support coverage table with severity definitions and response targets. Compare it against your own peak hours by region rather than against a competitor’s tier names.

5. List subprocessors and the regions where data is processed and stored. Then confirm this is contractually committed rather than described, and how you will be notified of changes.

Building the Vendor Comparison Yourself

There is no reliable published table of which TMS vendors hold which attestations, and any table that exists is out of date on the day it publishes, because certifications lapse, renew and change scope on independent cycles. Treat the comparison as something you build during evaluation rather than something you look up.

The practical method is a grid with vendors as rows and seven columns: SOC 2 type, criteria covered, observation period end date, ISO 27001 scope confirmed for the purchased module, uptime figure with its definition, per-region support coverage, and subprocessor list provided. Populate it only from documents rather than from answers given verbally or in a slide. Blank cells are findings, and in practice the pattern of what a vendor supplies quickly is more informative than the contents. A vendor with mature assurance sends a document pack within a day because the pack already exists. A vendor assembling it in response to your question is telling you something about how often the question gets asked.

One caution on interpretation. The absence of a certification is not automatically disqualifying for a smaller or newer vendor, and its presence is not sufficient for a large one. A SOC 2 Type 2 covering security only, at a vendor with no regional support presence, is weaker assurance for a multi-region enterprise than a narrower certification set at a vendor whose scope statement explicitly includes your deployment.

Four Mistakes in Security and Support Diligence

Accepting the certification name without the scope document. The name is the container. Every meaningful distinction lives in the scope statement, and it is the shortest document in the pack.

Treating an uptime percentage as a commitment. A measured historical figure and an undertaking are different claims. Establish which one is on the table before it reaches a contract discussion.

Reading “24/7 global support” as a specification. It is a label. The specification is regional hours, severity definitions, response targets and whether the first responder can act.

Running diligence once, at selection. Attestations expire and scopes change. Set a renewal check at the same cadence as the vendor’s examination cycle rather than at contract renewal, which is usually much later. A calendar reminder tied to the observation period end date costs nothing and catches the case where a vendor quietly narrows scope at renewal.

Why and How Locus Meets Enterprise Assurance Requirements

Locus, the world’s first Decision-Intelligent, Agentic TMS, publishes its security and compliance posture rather than describing it. Locus holds SOC 2 Type II and has obtained a SOC 3 report for public assurance covering security, availability and confidentiality. It is certified to ISO 27001:2022 for its information security management system and to ISO 27701:2019 for privacy information management, and it is compliant with GDPR and with HIPAA for operations handling protected health information.

On data security architecture, AES 256-bit encryption protects data at rest and TLS 1.2 with HTTPS protects data in transit, with high-availability deployments and geographically redundant backups. Locus operates at 99.99% uptime. Full details, including current certification status, are maintained on the Locus Trust page, which is the right place to verify rather than taking any of the above on the strength of a blog post.

On support and operating footprint, the honest answer is a factual one rather than a tier name. Locus serves 360+ enterprise customers across 30+ countries and has delivered 1.5B+ orders, which is the scale at which regional operating presence exists as a matter of necessity rather than as a commitment on a slide. Buyers with specific regional peak-hour requirements should ask for the coverage table described above and evaluate it against their own operating map, and that request is the correct one to make of any vendor including this one.

Locus models 250+ real-world constraints simultaneously across 1,000+ pre-integrated carriers, and six governance mechanisms covering explainability, traceability, evaluation, autonomy levels, execution sandbox and human-in-the-loop mean automated decisions can be traced to the state and logic that produced them. Auditability of AI-generated decisions is becoming its own diligence category, and traceability is what answers it. Buyers evaluating any agentic platform should ask the same question of it that they ask of the security posture: not whether decisions are explainable in principle, but which specific record is produced, retained for how long, and who can retrieve it during an audit.

Locus has been recognized by Gartner for seven consecutive years across multiple research categories, appears in the 2026 Gartner Hype Cycle for AI-powered logistics, features ShipFlex as a Representative Vendor in the 2026 Gartner MCPMS Market Guide, holds Leader designation in the QKS SPARK Matrix for Transportation Management Systems, and ranks #1 on G2 for Route Planning software.

In October 2025, Ingka Investments, the investment arm of Ingka Group, the world’s largest IKEA retailer, acquired Locus. Locus continues to operate independently.

To request current attestation documents and a regional support coverage table, schedule a demo.