The report
that unblocks
the deal.
- Issued by
- A licensed CPA firm — never a consultancy
- Governed by
- AICPA Trust Services Criteria
- Type I
- Controls designed correctly, at a point in time
- Type II
- Controls operated effectively, over a period
- Renewal
- Annually
SOC 2, without the sales gloss.
SOC 2 is an attestation report written by an independent, licensed CPA firm about how well your company protects customer data. It is not a certificate and there is no pass/fail badge — the output is a report an auditor signs, which your customer's security team then reads.
Every SOC 2 covers the Security criterion. You then choose which of the other four Trust Services Criteria to include — Availability, Confidentiality, Processing Integrity and Privacy — based on what you actually promise customers. Scoping this well is the difference between a tight engagement and a year of unnecessary work.
Type I looks at whether your controls are designed appropriately on a given date. Type II watches them operate across an observation window, usually three to twelve months, and is what most enterprise buyers eventually insist on. Many companies do Type I first to unblock a deal, then roll straight into the Type II window.
Any one of these is enough.
- A prospect's security review has stalled your contract
- You are moving upmarket from SMB to enterprise deals
- An existing customer's renewal now requires it
- Your investors or board asked what your security posture is
- You handle customer data in a cloud product and have never formalised how
The route to SOC 2.
Typical spans for a company starting from a normal engineering baseline. Your scoping call replaces these with real dates.
Deliverables, not a slide deck.
Scoping memo
Which criteria, systems and entities are in — and the defensible reason each one is or isn't.
Policy pack
Every policy the criteria require, written for how your company actually operates.
Control implementation
Access reviews, change management, logging, onboarding and offboarding, vendor management — built with your team.
Evidence programme
Automated where your stack allows, documented where it doesn't.
Auditor management
Selection, fee negotiation, fieldwork coordination, and we answer the auditor directly.
The report
A signed SOC 2 report you can put in front of procurement, plus a summary your sales team can actually use.
Three ways in.
You need to know exactly how far you are, and what it will cost to close the gap.
- Scoping workshop — systems, people and data in scope
- Gap assessment against every applicable control
- Written policy pack, tailored, not templated
- Evidence map: what to collect, from where, how often
- Remediation plan with owners and dates
- Readout with your leadership team
You have a deal, a customer or a board deadline and you need the report in hand.
- Everything in Readiness
- Hands-on control implementation with your engineers
- Evidence collection run by us, not homework for your team
- Auditor selection from our partner panel, plus fee negotiation
- We sit in the audit and answer the auditor's questions
- Findings triaged and closed through to clean report
You are certified and you want to stay that way without hiring a compliance team.
- Everything in Certification
- Continuous control monitoring and evidence capture
- Annual surveillance audits and re-certification managed end to end
- Vendor and sub-processor risk reviews
- Security questionnaires and customer due-diligence answered for you
- Named compliance lead on your Slack
Every engagement is quoted as two separate numbers: our fee, and the external auditor's fee. We negotiate theirs on your behalf and never bundle the two into one price.
Straight answers.
How long does SOC 2 take?
Can you issue our SOC 2 report?
Type I or Type II — which do we need?
How much does SOC 2 cost?
Do we need a compliance automation tool?
Rarely just one framework.
ISO 27001
The international standard for running an information security management system. The certificate European and global enterprise buyers recognise on sight.
HIPAA
US law governing protected health information. There is no official HIPAA certificate — there is a compliance programme, and independent validation of it.
GDPR
The EU's data protection regulation. It applies by where your users are, not where your company is — which catches more companies than expect it.
Get SOC 2 scoped properly.
Thirty minutes, a founder on the line, and an honest read on scope, sequence and the date you can realistically promise your customer.