A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →SOC 2 is an auditing standard from the AICPA that reports on how a service organization manages customer data against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. A licensed CPA firm performs the audit and issues an attestation report. Software and SaaS vendors use SOC 2 reports to prove their security controls to enterprise customers.
In practice, SOC 2 is the report enterprise buyers ask for before they sign. Their procurement and security teams read the report instead of running their own audit of your environment, so a clean SOC 2 shortens sales cycles.
The security criterion (the Common Criteria) is mandatory; the other four are optional and scoped to what your product actually does. Most startups start with a Type I covering security only, then add a Type II observation period and additional criteria as customers demand them.
traztech delivers SOC 2 readiness and audit coordination for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
SOC 2 shows up first as a line in a procurement email, usually phrased as "can you send us your SOC 2 report". What the buyer means is a current Type II from a licensed CPA firm, delivered under NDA. A Type I will often get you into the conversation, but the follow-up question is when the Type II lands.
Inside an engagement, SOC 2 is not one thing to do. It is a scope decision, a control set, an observation window and an evidence habit. The scope decision is the one that carries the rest: which systems, which criteria beyond Security, and which dates the window covers.
No. SOC 2 is an attestation, not a certification. A licensed CPA firm examines your controls and issues an opinion in a report. Nobody issues a certificate, and there is no logo you are entitled to display the way there is with ISO 27001.
A Type II report covers a stated observation period and buyers generally expect one no older than twelve months. That is why SOC 2 becomes an annual cycle rather than a one-off project.
No. Security, the Common Criteria, is mandatory. Availability, Confidentiality, Processing Integrity and Privacy are optional and should be scoped to what your product actually does and what your buyers ask about.
Everyone on our list also gets The Compliance Brief, one email every Tuesday on what changed in security and compliance that week. Read the latest issue.