Close the deal that's waiting on SOC 2.

Keep it. We work alongside any compliance platform. Dashboards tell you which controls are failing; they don't fix your IAM policies, write policies your team will follow, or manage your auditor. Most first-audit teams end up hiring engineering help anyway, usually after six months of red checkmarks. We're that help, priced up front.

Read-only, via a scoped IAM role you deploy from our template: external-ID protected, CloudTrail-logged, revocable by you at any time. We carry E&O and cyber liability insurance, and anything inside your application code goes to your engineers as a ticket. We never ship changes to an app we didn't build.

SOC 2 isn't pass/fail. It's an attestation, and the deliverable is a CPA's opinion. What we commit to in writing: every in-scope criterion maps to a working control with evidence before fieldwork, and if your Type 1 opinion, issued by one of our partner audit firms, is qualified on a control we implemented, we keep working at no charge until it's clean.

Best fit: a 5–100 person AWS-native SaaS startup pursuing its first SOC 2 (Security criteria), with an executive sponsor and a little engineering capacity for app-level fixes; teams above roughly 50 people get scoped individually at the gap assessment. Not a fit right now: multi-cloud or significant on-prem estates, or bundled HIPAA/FedRAMP programs. We'd rather tell you that in the first call than discover it in week four.

Security, the Common Criteria that every SOC 2 report includes, is the core of every engagement. Availability and Confidentiality are scoped in when your own customer contracts already commit you to them (an uptime SLA, a confidentiality clause in your MSA or DPA), at no change in price. We read the commitments you already carry during the gap assessment and scope accordingly. Privacy and Processing Integrity stay out; they are separate programs most seed-stage startups don't need for a first report.

Six to eight weeks from kickoff to audit-ready for a typical AWS-native startup: scanning in weeks 1–2, remediation in weeks 2–6, evidence collection in weeks 5–7, mock audit and auditor hand-off at week 8. The Type 1 examination follows within a few weeks of that. A Type 2 report then needs an observation window, commonly three to twelve months, which is what the Type 2 Window Package covers. Full breakdown in the SOC 2 timeline guide.

Most first-year journeys with us land around $20 to 25K all-in: the $2,500 gap assessment credited toward readiness from $10K, the audit itself (typically $5 to 10K, paid to the CPA firm directly), and the Type 2 window from $1K/mo. Teams assembling the same outcome from consultants and audit shopping commonly spend $30 to 65K. We break down every line item in the SOC 2 cost guide.