A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →The Trust Services Criteria (TSC) are the five categories a SOC 2 report can be built on, defined by the AICPA: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security, known as the Common Criteria, is mandatory in every SOC 2; the other four are optional and included only when they fit what the service does. The criteria you select set the scope of the whole examination.
Scope discipline is the whole game here. Each additional criterion brings its own controls, evidence, and audit effort, so the criteria you select should map to real product behaviour and real buyer demand, not to a wish to look thorough.
The criteria also shape the observation window, because every selected criterion needs evidence across the period. Adding one late can reset timelines, which is why the selection belongs at the start of readiness, not partway through.
traztech delivers SOC 2 readiness scoped to the right criteria for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
The TSC become a live decision the moment you scope a SOC 2, because choosing them wrong is expensive in both directions. Omitting a criterion a buyer cares about means a re-scope later; including one you do not need adds controls and evidence you did not have to produce. Getting this right is the start of SOC 2 readiness.
Most companies start with Security alone and add others as customers ask. Availability suits products with uptime commitments, Confidentiality fits sensitive non-personal data, Processing Integrity matters where you transform data for others, and Privacy applies when you handle personal information under your own control.
Only Security, the Common Criteria. The other four are optional and should be scoped to what your product actually does and what your buyers ask about.
Only when you control personal information in a way the Privacy criterion addresses, and buyers are asking for it. It adds meaningful scope, so it is a decision to make deliberately rather than by default.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.