Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A buyer, board, or regulator just told you to get compliant. We are the audit-prep experts who get you there fast, SOC 2, ISO 27001, HIPAA, PCI DSS, and privacy law. Fixed scope, real timelines, no auditor-speak. Serving startups and mid-market across Canada and the US.
The trigger is almost always the same: revenue or funding is at risk, and you do not have time to figure this out yourselves. That is exactly what we remove.
We run readiness and audit prep across the frameworks that gate enterprise deals and regulated markets, including ISO 42001 (AI) readiness for teams shipping AI features. Each links to a full breakdown of scope, timeline, and what buyers expect.
The guides above explain what each standard asks for. These are the fixed-scope engagements that get you there, each with a defined scope and timeline. See full pricing.
Adverse opinions are real, and ISO 27001 withholds certificates at Stage 2. The commoner outcome is worse: the auditor reaches fieldwork, finds nothing testable, and recommends stopping.
You have then paid five figures for an audit with no report at the end of it, and re-entering fieldwork means paying again. A Type II gap can add a fresh three to twelve month window on top. The full cost breakdown.
The audit itself has to be signed by an independent CPA firm. Everything before that, the part that actually takes the time and causes the pain, is what we own.
Gap assessment, policies, control implementation, evidence collection, and auditor coordination. You get an outcome and a date, not a stack of templates.
Our founder is a published security researcher, so controls are designed around real attacker behavior. When your buyer asks a hard technical follow-up, the answer holds.
Already have a compliance-automation tool but stuck at 60 percent green? We finish it. Starting from zero? We stand it up. Either way you get to audit-ready.
You know the deliverable, the timeline, and the price before you commit. No open-ended hourly meter and no fabricated numbers.
Productized readiness engagements with a defined scope, timeline, and price. See full pricing.
Our flagship end-to-end readiness sprint to audit-ready, delivered with a vetted CPA partner.
Point-in-time Type I when a buyer needs proof now and you will follow with Type II.
ISMS build-out, Statement of Applicability, and internal audit ready for Stage 1 and Stage 2.
Risk analysis, safeguards, BAAs, and PHI policies for digital health teams facing a deadline.
Deciding how to get compliant? Start here.
The same control-by-control checklist we use to get clients audit-ready. Read it free, or grab the editable version for your team.
Open the checklistWhatever the trigger, a blocked deal, an investor ask, or an expiring audit, we will build the plan to meet it. Free 30-minute readiness call, no pressure.
Book a readiness callMost clients reach audit-ready in 8 to 12 weeks with our SOC 2 in 75 Days track, and a Type I can be as fast as about 10 weeks. Timing depends on how mature your controls already are. The Type II observation window (typically 3 to 6 months) then runs after readiness is complete, so plan for roughly 4 to 9 months from kickoff to a Type II report.
Budget two separate line items: the auditor (an independent CPA firm, often USD 10k to 30k+ depending on scope) and readiness help. Our readiness work is fixed-scope so you know the number before you commit. We are transparent about both up front and never inflate scope. Book a call and we will give you a real range for your situation.
We do readiness and audit prep: gap assessment, policies, evidence collection, control remediation, and auditor coordination. We do not sign the attestation, because SOC 2 and ISO 27001 require the preparer and the auditor to be independent. We work alongside your auditor so the exam goes smoothly, and we are the prep experts, not a Big 4 generalist.
If your buyers are mostly North American SaaS and enterprise, SOC 2 usually comes first because that is what their security questionnaires ask for. If you sell into Europe or globally, ISO 27001 often carries more weight. The control sets overlap heavily, so doing one gives you a strong head start on the other. We help you sequence them so you never build the same evidence twice.
Yes, though not as a pass or fail stamp. A CPA firm issues an opinion, and adverse opinions and disclaimers are both real, damaging outcomes. ISO 27001 is more binary still, and a major nonconformity at Stage 2 blocks the certificate until you remediate and pay for the re-check. But the outcome that catches most unprepared companies is worse than a bad report: the auditor reaches fieldwork, finds the evidence is not testable, and recommends pausing. You have then paid for an audit that produced nothing you can send a buyer, re-entering fieldwork means paying a firm again, and a Type II gap can cost you a fresh three to twelve month observation window on top. The full breakdown is here.
Before the observation window opens, not before fieldwork starts. A Type II tests whether each control operated across the whole stated period, typically three to twelve months. Turning a control on partway through leaves the earlier months exposed, and the usual remedy is to move the window, which pushes your report date by months. Setting the window start after your controls are live and producing dated evidence is one of the highest-leverage decisions in the programme.
Yes, and it is common. Compliance automation tools track controls, but they do not write your policies, close your gaps, choose your auditor, or interpret an ambiguous control. We work on top of your existing Vanta or Drata instance to get you from 60 percent green to actually audit-ready.
Yes. We are based in Toronto and work with startups and mid-market companies across Canada and the United States. Frameworks like SOC 2, ISO 27001, HIPAA, and PCI DSS are international, and we deliver readiness remotely across both countries.
Every readiness programme needs a control library, an evidence register, policies and a score for the board. Being quoted five figures a year for that is normal. Paying it is not required, and it is not required to work with us either.
| traztech Workspace | Other GRC platforms | |
|---|---|---|
| Licence cost | $0. Free forever, no card, no paid tier | $7,500 to $50,000 a year, on an annual contract |
| Control library, evidence register, policy templates, risk register, vendor questionnaires, readiness scoring | Included | Included |
| What it costs inside an engagement with us | $0. You need a workspace either way | Unchanged. The subscription sits on top of the fee |
| What it does to your audit quote | $11,000 off a five-figure quote on one engagement, for a documented readiness position | Nothing. The audit firm prices your readiness, not your tooling |
Pricing in the right column is what compliance automation platforms are publicly reported to charge; none of them publish a number, so treat it as a range rather than a quote. The $11,000 came off the audit firm's own number once the readiness position was documented (the engagement). Where a paid platform is the better buy, and the fuller comparison, is on the Workspace page.
Track record
We are deliberately not a large firm, and we would rather show you the work than a wall of logos. Here is what is behind the advice.
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
The printer is the one that matters on a compliance page: an asset nobody counts as a computer, on a flat network, downed by a device that never had to log in. Auditors ask how controls fail. We have found out first-hand.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.
The platform held 99.9% uptime throughout, which is the part most readiness projects get wrong: controls are easy to design and hard to retrofit onto a system people already depend on.
For a Waterloo data centre operator we ran SOC 2 Type II and ISO 27001:2022 together rather than one after the other, across a production campus, an AI compute platform and a self-hosted collaboration stack. Scoped so further Ontario and Quebec sites enter as they reach production. Findings delivered and remediated.
For an Ontario medtech company putting an AI clinical assistant in front of practitioners, we ran the gap analysis and built the evidence programme behind their SOC 2.
Before you go
Short, practical notes on Compliance. Unsubscribe in one click, and replies reach me directly.
From Jacob Masse, founder of traztech. No spam, unsubscribe in one click.