---
title: "Which TMS Vendors Publish SOC 2, ISO, Uptime and Support Hours? A Vendor-by-Vendor Check (2026)"
id: "27921"
type: "post"
slug: "tms-vendors-soc-2-iso-uptime-support-hours-2026"
published_at: "2026-11-03T13:30:00+00:00"
modified_at: "2026-11-03T15:19:07+00:00"
url: "https://locus.sh/blogs/tms-vendors-soc-2-iso-uptime-support-hours-2026/"
markdown_url: "https://locus.sh/blogs/tms-vendors-soc-2-iso-uptime-support-hours-2026.md"
excerpt: "Which TMS vendors publish SOC 2, ISO 27001, an uptime percentage and support hours? A dated check of Locus and 13 platforms, with what to ask each vendor before you sign."
taxonomy_category:
  - "General"
---

[General](https://locus.sh/blogs/category/general/)

# Which TMS Vendors Publish SOC 2, ISO, Uptime and Support Hours? A Vendor-by-Vendor Check (2026)

[Anas T](https://locus.sh/blogs/author/anas_locus/)

Last updated: Nov 3, 2026

11 mins read

TMS vendors that serve enterprises publish four kinds of trust evidence: a security attestation such as SOC 2, an ISO certification, an uptime commitment and a support-hours promise. They publish them to very different depths, and many publish only a claim on a marketing page.

This check reads each vendor’s own pages as of November 3, 2026. It covers Locus, the world’s first Decision-Intelligent, Agentic TMS, and 13 other platforms, and ends with the questions to ask before you sign.

## Key Takeaways

- All 14 platforms checked state some form of SOC 2 or ISO attestation, but only e2open publishes a SOC 2 observation period, and its period ended August 31, 2024.
- Locus publishes SOC 2 Type II and ISO 27001:2022 and 27701:2019 statements with certificate numbers, plus a SOC 3 report anyone can download, covering February 10 to December 23, 2025.
- Seven of 14 platforms state an uptime percentage, from 99% to 99.97%, which is 87.6 hours to 2.6 hours of downtime a year.
- Group-level certifications do not always name the TMS, so ask which product the scope covers.
- A trust page is a claim until you read the report, the SLA and the support terms in your contract.

## What Does Each TMS Vendor Publish on SOC 2, ISO and Sub-Processors?

The first table records attestations and sub-processor transparency on each vendor’s public pages. “Not found” means not found on the pages read, not that the vendor lacks it. Many reports are gated behind a customer login or an NDA.

| Platform | SOC 2 statement | ISO statement | Sub-processor list |
| --- | --- | --- | --- |
| Locus | SOC 2 Type II stated, plus a SOC 3 report downloadable without a request (period February 10 to December 23, 2025) | ISO 27001:2022 and 27701:2019, certificate numbers shown | Yes, 18 entries with data locations, updated July 14, 2026 |
| Oracle | SOC 1, 2 and 3 stated in its SaaS questionnaire (April 2025); no period; Industry Applications excluded | ISO 27001, 27701 and 22301 listed as frameworks; no OTM certificate found | On My Oracle Support, which needs a login |
| SAP | 12-month SOC 2 audit cycle stated; reports behind customer login | ISO 27001, ISO 22301 and BS 10012 | On My Trust Center, which needs a login |
| Blue Yonder | SOC 1 and SOC 2 listed for Transportation Management; type and period not stated | ISO 27001, 27701 and 22301 listed for Transportation Management; no versions | Yes, updated October 2025 |
| Manhattan Associates | SOC 1 Type II, SOC 2 Type II and SOC 3 shown; reports gated | Not found on the pages read | Yes, 2 entries, updated March 31, 2026 |
| Descartes | SOC 2 Type 2 in its data processing agreement, on request | ISO 27001 for UK operations and EDI; no TMS claim | Yes, about 14 entries, undated |
| Infios | ISO 27001, SOC 1 Type 2 and SOC 2 Type 2 stated | ISO/IEC 27001:2022 | Logos only, no locations |
| e2open | SOC 2 Type II, period ended August 31, 2024 | ISO/IEC 27001:2022 | Not found |
| project44 | SOC 2 Type 2; period not shown | ISO 27001; certificate gated | Yes, updated January 6, 2025 |
| FarEye | SOC 2 named in marketing; type not stated | Annually certified under ISO/IEC 27001, per its privacy policy | Not found |
| Bringg | SOC 2 Type II, results under NDA | ISO 27001 in its data processing agreement; no version | Yes, updated May 22, 2026 |
| DispatchTrack | SOC 2 renewed in 2024; type not stated | Not found | Not found |
| Onfleet | SOC 2 Type II, access on request | Not found for Onfleet itself | Yes, 9 entries, all US |
| Shipsy | SOC 2 Type II, report under NDA | ISO 27001:2022 via BSI, certificate on request | On request |

| Also Read: How to Secure Logistics API Integrations: Authentication, Scopes, Partner Access and Audit Trails |
| --- |

## What Do TMS Vendors Publish on Uptime and Support Hours?

Locus states 99.97% uptime on its trust page and homepage. Its public pages do not publish contract-level SLA terms or support hours, so confirm both in your contract.

The second table records what the other 13 platforms publish on uptime and support. Percentages are not comparable until you read how each vendor measures them.

| Platform | Uptime published | Support hours published |
| --- | --- | --- |
| Oracle | 99.9% target, measured monthly; credits in separate service documents | 24x7x365 for technical requests; Severity 1 response in 15 minutes |
| SAP | 99.7% a month in a sample contract; credit of 2% of monthly fees per 1% below target | 24×7 for Priority 1 and 2; Priority 1 response in 1 hour |
| Blue Yonder | 99.9% in a marketing FAQ; no method or credits | 24/7 critical incident access with premium support; no response targets |
| Manhattan Associates | Not found | 24/7 major incident support; no response targets |
| Descartes | “Industry leading uptime”; no percentage | Business hours by default; 24×7 for Severity 1 at an extra fee, with 30-minute response |
| Infios | Not found | Support portal; no hours |
| e2open | 99.5%, 99.7% or 99.9% by tier, on commercially reasonable efforts; no credits found | Severity 1 handled 24×365 with 1-hour response |
| project44 | Not found | Around-the-clock phone line; Elite tier 1-hour response |
| FarEye | Credit tiers, such as 10% below 99.3%; no headline target | 24×7 on all plans; urgent response 2 hours, 1 hour or 30 minutes by plan |
| Bringg | A formula; no percentage or credits | Standard 9×5, Premium 12×5, Signature 24×7 |
| DispatchTrack | Not found | “24/7 customer support” stated; no tiers |
| Onfleet | 99%, with a credit of 5% per full hour of outage | No 24/7 human support found |
| Shipsy | 99.9%; no credits | Priority 1 handled 24×7; response 1 hour standard, 30 minutes premium |

Several figures come from sample contracts, marketing pages or tier tables, so the executed contract governs.

## Why Do the Numbers Behind Uptime and SOC 2 Matter? The Business Case

Four checks turn a trust page into something you can compare.

- Availability arithmetic: 99.9% allows [8.76 hours a year](https://sre.google/sre-book/availability-table/) of downtime, or 43.2 minutes in a 30-day month, according to Google’s availability table.
- The same arithmetic gives 2.6 hours a year at 99.97%, 26.3 hours at 99.7% and 87.6 hours at 99%, so a vendor’s headline percentage changes your exposure more than 30 times over.
- ISO states that ISO/IEC 27001 [defines requirements](https://www.iso.org/standard/27001) an information security management system must meet, and that the 2022 edition replaced the 2013 one, which it lists as withdrawn.
- The AICPA describes SOC as [a suite of service offerings](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) that CPAs may provide, which is why you should ask for the report and its period, not a badge.

Of the 14 platforms, only one published an observation period for its SOC 2 report. That is why the first buying question is the period, not the badge.

| Also Read: The Agentic TMS RFP Scorecard: 30 Questions to Separate Real AI from Rebranded Legacy in 2026 |
| --- |

## Why Does Locus Lead on Public Trust Evidence?

Locus, the world’s first Decision-Intelligent, Agentic TMS, leads on public trust evidence among the platforms checked, because its attestations, certificates, sub-processor list and disclosure policy sit on public pages, and its SOC 3 report downloads without a request.

Its published facts on this topic:

- SOC 2 Type II stated, and a downloadable SOC 3 report covering security, availability and confidentiality from February 10 to December 23, 2025.
- ISO 27001:2022 and ISO 27701:2019 with certificate numbers C754492 and C754493, and certificates available on request.
- GDPR practices validated by a gap assessment conducted by DNV.
- A dated sub-processor list with 18 entries and data locations, and a responsible vulnerability disclosure policy that promises acknowledgement by the end of the next business day.
- SAML and ADFS single sign-on, role-based access, audit trails, AES 256-bit encryption at rest and TLS 1.2 in transit.
- Regular internal and external vulnerability assessment and penetration testing.

These facts are not a ranking of platforms, which no analyst publishes.

**Recognized by analysts and selected after evaluation.**

Locus was recognized by Gartner for seven consecutive years and appears in the 2026 Hype Cycle for Supply Chain Execution and Logistics Technologies, as detailed on its [analyst recognition page](https://locus.sh/analyst-recognition/)
. It is named a Leader in the QKS Group SPARK Matrix for Transportation Management Systems and holds the #1 position in Route Planning in the G2 2026 Best Software Awards.

In October 2025, Ingka Investments, the investment arm of Ingka Group, the world’s largest IKEA retailer, acquired Locus. Ingka’s [press release](https://locus.sh/press-releases/ingka-group-acquires-locus/)
 says that after an extensive evaluation of logistics software worldwide, it selected Locus for its strength in combining advanced route optimization, real-time visibility and smart use of vehicles and resources. Locus continues to operate independently.

| What a security review asks for | What Locus publishes |
| --- | --- |
| Independent attestation | SOC 2 Type II stated; SOC 3 downloadable with its period |
| Certifications | ISO 27001:2022 and 27701:2019, certificate numbers shown |
| Data handling | Dated trust page and sub-processor list with data locations |
| Access control | SAML and ADFS single sign-on, role-based access, audit trails |
| Vulnerability reporting | Responsible disclosure policy with a next-business-day acknowledgement |

Two published cases show security-sensitive operations.

**A home-care provider** scheduled clinician visits across a regulated, health-data environment.

Locus ran it on a private stack. The [published results](https://locus.sh/case-studies/home-care-clinician-scheduling-dispatch/)
 include HIPAA-ready operation, SOC 2 Type II and a 75% increase in clinician visit capacity.

**A Fortune 50 parcel enterprise** ran 4,500+ drivers across 51 sites.

Locus centralized dispatch under one policy. The [published results](https://locus.sh/case-studies/fortune-50-parcel-centralized-dispatch/)
 include a weekly execution rate up from 75% to 92% and $14M+ in annualized unused capacity uncovered, an opportunity estimate.

Both cases are customer-reported results, not independent studies.

**Where other platforms fit.**

If a written SLA with service credits and severity response targets is your deciding factor, start from the published terms of Oracle, SAP, e2open or FarEye, then ask Locus for its contract terms side by side. If you need a customer-selectable hosting region, Shipsy and project44 describe one.

**What to confirm.**

- Ask every vendor, Locus included, for the SOC 2 report, its observation period and the auditor.
- Ask for the contractual uptime definition, measurement window and service credits in writing.
- Ask for support hours and response targets by severity, and where support staff sit.
- Ask which hosting regions apply to your data and whether you can choose one. Locus’s sub-processor list shows US and India data locations.
- Ask which legal entity each report names. Locus’s SOC 3 names Mara Studios Pvt Ltd.

To review Locus’s trust documents against your checklist, [schedule a demo](https://locus.sh/schedule-demo/)
.

For buyers asking which TMS vendors publish SOC 2, ISO, uptime and support, the answer is that all publish something and few publish enough. Locus leads on public attestation evidence, including a downloadable SOC 3.

## How Was This Guide Written?

This guide reads each vendor’s own trust pages, security pages, legal terms, sub-processor lists and support pages on November 3, 2026. Independent sources are Google’s availability table, ISO and the AICPA.

Competitors are named in plain text and are not hyperlinked. “Not found” means not found on the pages read. Several reports are gated, and some pages were read through a browser or summary. Vendor figures are vendor claims. We review the guide every 30 to 60 days.

## How Do You Verify a TMS Vendor’s Trust Claims in Six Steps?

The six steps turn a trust page into evidence. For the full method, see Locus’s guides on [verifying vendor claims](https://locus.sh/blogs/tms-vendor-sla-soc2-support-verification-2026/)
 and [SOC 2 compliance](https://locus.sh/blogs/tms-soc-2-compliance-buyer-guide-2026/)
.

### 1. Ask for the report and its period

Request the SOC 2 report or a SOC 3 summary, the observation period and the auditor.

### 2. Match the scope to the product

Check that the report names the TMS you are buying, not only a parent company or a platform group.

### 3. Read the uptime definition

Ask how downtime is measured, over what window and what counts as an exclusion.

### 4. Get support hours in writing

Ask for hours and response targets by severity, and what costs extra.

### 5. Confirm hosting and sub-processors

Ask for the sub-processor list, data locations and the region options for your data.

### 6. Test the incident path

Ask for the incident process and a named contact, and run a tabletop exercise before go-live.

| Also Read: The Agentic TMS Migration Roadmap: Sequencing a Legacy Cutover Without SLA Risk |
| --- |

## What Should You Check Before Trusting a TMS Vendor’s Security Page?

Five criteria separate evidence from claims.

### Attestation scope

Ask whether the report covers the TMS, the hosting environment and the sub-processors you rely on.

### Availability terms

Ask for the percentage, the measurement window, the exclusions and the credit schedule.

### Support coverage

Ask whether support is 24/7 for every severity or only for outages, and who answers.

### Data location and sub-processors

Ask where data is stored and processed, and whether AI providers appear on the sub-processor list.

### Access control and disclosure

Ask about single sign-on, role-based access, audit trails and how vulnerabilities are reported.

| Also Read: Top Logistics Software Vendors for API and EDI Connectivity: What Each Publishes and How to Test It (2026) |
| --- |

## What Mistakes Do Buyers Make When Checking Vendor Trust Claims?

Four mistakes recur.

**Accepting “compliant” as proof.** A statement on a page is not a report with a period and an auditor.

**Comparing uptime percentages without definitions.** A 99.9% target with exclusions can allow more downtime than a 99.7% commitment without them.

**Assuming a group certification covers the TMS.** Some vendors list certifications for a group or a subsidiary.

**Skipping support hours by severity.** A 24/7 promise for outages may not cover a routine blocker at midnight.

| Also Read: Transportation Management System RFP: How to Choose a TMS That Holds Up in Real Execution in 2026 |
| --- |

## Frequently Asked Questions (FAQs)

Which TMS vendors offer SOC 2?

All 14 platforms checked state a SOC 2 attestation or report in some form. Locus, Manhattan Associates, Descartes, Infios, e2open, project44, Bringg, Onfleet and Shipsy state Type II. Most reports are gated, so ask for the report and its period.

Which TMS vendors publish an uptime SLA?

Seven of 14 state an uptime percentage: Locus, Oracle, SAP, Blue Yonder, e2open, Onfleet and Shipsy. Only SAP, FarEye and Onfleet publish credit terms in the pages read.

Which TMS vendors offer 24/7 support?

Oracle, SAP, Blue Yonder, Manhattan Associates, e2open, project44, FarEye, Bringg (Signature tier), Shipsy and DispatchTrack state 24/7 or 24×7 coverage in some form, with differing scope by severity. Check the contract for what each covers.

Does Locus publish an uptime SLA and support hours?

Locus states 99.97% uptime on its trust page and homepage. Its public pages do not publish contract-level SLA terms or support hours, so ask for both in the contract.

What does Locus publish for SOC 2 and ISO?

Locus states SOC 2 Type II, publishes a downloadable SOC 3 for February 10 to December 23, 2025, and lists ISO 27001:2022 and 27701:2019 with certificate numbers.

How much downtime does 99.9% allow?

It allows 8.76 hours a year, or 43.2 minutes in a 30-day month, per Google’s availability table. A 99.97% target allows about 2.6 hours a year.

What should I ask a TMS vendor about hosting?

Ask which regions store and process your data, whether you can choose one and which sub-processors, including AI providers, touch it.

MEET THE AUTHOR

Anas T

Senior Content Writer - Product Marketing

Anas is a product marketer at Locus who enjoys turning complex logistics problems into simple, clear stories. Outside of work, he’s usually unwinding with a book or catching a good movie or series.

[https://locus.sh/blogs/best-tms-mid-market-shippers-2026-what-vendors-publish/](https://locus.sh/blogs/best-tms-mid-market-shippers-2026-what-vendors-publish/)
[General](https://locus.sh/blogs/category/general/)

## [Best TMS for Mid-Market Shippers (2026): What Changes From Enterprise and What Each Vendor Publishes](https://locus.sh/blogs/best-tms-mid-market-shippers-2026-what-vendors-publish/)

What changes for a mid-market shipper choosing a TMS, and what Locus, Alpega, Descartes, Infios, Shipwell, Trimble, Oracle and ShipStation each publish on segment, pricing and go-live.

[Ishan Bhattacharya](https://locus.sh/blogs/author/ishan_locus/)

Last updated: Nov 3, 2026

[Read more](https://locus.sh/blogs/best-tms-mid-market-shippers-2026-what-vendors-publish/)

[https://locus.sh/blogs/best-tms-large-bulky-goods-delivery-crews-skills-proof-2026/](https://locus.sh/blogs/best-tms-large-bulky-goods-delivery-crews-skills-proof-2026/)
[General](https://locus.sh/blogs/category/general/)

## [Best TMS for Large and Bulky Goods Delivery: Crews, Skills, Appointments and Proof (2026)](https://locus.sh/blogs/best-tms-large-bulky-goods-delivery-crews-skills-proof-2026/)

How to pick a TMS for furniture, appliance and building-material delivery: crews, skills, windows, installation and proof. What Locus and nine other platforms publish, and what to ask.

[Ishan Bhattacharya](https://locus.sh/blogs/author/ishan_locus/)

Last updated: Nov 3, 2026

[Read more](https://locus.sh/blogs/best-tms-large-bulky-goods-delivery-crews-skills-proof-2026/)

Which TMS Vendors Publish SOC 2, ISO, Uptime and Support Hours? A Vendor-by-Vendor Check (2026)

- Share
  - [Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Flocus.sh%2Fblogs%2Ftms-vendors-soc-2-iso-uptime-support-hours-2026%2F)
  - [Twitter](https://twitter.com/intent/tweet?url=https%3A%2F%2Flocus.sh%2Fblogs%2Ftms-vendors-soc-2-iso-uptime-support-hours-2026%2F&text=Which%20TMS%20Vendors%20Publish%20SOC%202%2C%20ISO%2C%20Uptime%20and%20Support%20Hours%3F%20A%20Vendor-by-Vendor%20Check%20%282026%29)
  - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Flocus.sh%2Fblogs%2Ftms-vendors-soc-2-iso-uptime-support-hours-2026%2F)
  - [Email](mailto:?subject=Which%20TMS%20Vendors%20Publish%20SOC%202%2C%20ISO%2C%20Uptime%20and%20Support%20Hours%3F%20A%20Vendor-by-Vendor%20Check%20%282026%29&body=https%3A%2F%2Flocus.sh%2Fblogs%2Ftms-vendors-soc-2-iso-uptime-support-hours-2026%2F)

- Print
- Download
- [Schedule a Demo](https://locus.sh/schedule-demo/)

### Is your team spending more time on fixing logistics plan than running the operation?

- Agentic transportation management from order intake to freight settlement
- Route optimization built on 250+ real-world constraints
- AI-driven dispatch with automatic execution handling

20%Cost Reduction

66%Faster Planning Cycles

[Schedule a demo](/schedule-demo/)

Insights Worth Your Time

[General](https://locus.sh/blogs/category/general/)

## [US Returns Hit $850 Billion in 2025: Why US Retailers Are Restructuring Reverse Logistics in 2026](https://locus.sh/blogs/850-billion-us-returns-ai-routing-reverse-logistics-2026/)

[Ishan Bhattacharya](https://locus.sh/blogs/author/ishan_locus/)

Last updated: Oct 29, 2026

[General](https://locus.sh/blogs/category/general/)

## [Locus 2026 UK Consumer Survey: Why Returns Visibility is Now the Conversion Engine for AI-Driven Shopping in UK Retail](https://locus.sh/blogs/returns-visibility-conversion-engine-ai-shopping-uk-retail-locus-q2-2026-consumer-survey/)

[Aseem Sinha](https://locus.sh/blogs/author/aseem_locus/)

Last updated: Sep 11, 2026

[General](https://locus.sh/blogs/category/general/)

## [Locus 2026 US Consumer Survey: Generative AI isn’t Just Changing How Consumers Shop, it’s Breaking the Demand Patterns US Retail Was Built On](https://locus.sh/blogs/generative-ai-shopping-effect-retail-fulfillment-operations-locus-q2-2026-consumer-survey/)

[Ishan Bhattacharya](https://locus.sh/blogs/author/ishan_locus/)

Last updated: Jun 2, 2026

[General](https://locus.sh/blogs/category/general/)

## [Embedded vs Bolted-On AI: The Architecture Question European Logistics Buyers Are Asking](https://locus.sh/blogs/embedded-vs-bolted-on-ai-european-logistics-platform-architecture-business-benefits/)

[Aseem Sinha](https://locus.sh/blogs/author/aseem_locus/)

Last updated: Jul 17, 2026

[General](https://locus.sh/blogs/category/general/)

## [Hybrid Fleet Management: How Owned, 3PL, Gig, ICE, and EV Capacity Actually Operate at Most Enterprises](https://locus.sh/blogs/three-workforce-fleet-reality-owned-3pl-gig-drivers/)

[Aseem Sinha](https://locus.sh/blogs/author/aseem_locus/)

Last updated: Jul 18, 2026