A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Check off the evidence artifacts you already have, grouped by Trust Services Criteria. See your completion percentage and a clear list of what is still missing before your SOC 2 audit. Your progress is saved in this browser.
They are the categories a SOC 2 report is built on: Security (the required Common Criteria), plus optional Availability, Processing Integrity, Confidentiality, and Privacy. You choose which apply to your service, and the auditor tests controls against them.
It is a representative list of the artifacts SOC 2 audits commonly require. Your auditor sets the precise request list based on your scope, systems, and the criteria you include. Use this to prepare and close obvious gaps before the audit starts.
No. Having the artifacts is necessary but not sufficient. The auditor evaluates whether your controls were designed and operating effectively over the review period. This tracker helps you get organized; it does not make the audit judgment.
Yes, it is free with no signup. If gathering and organizing evidence is the bottleneck, our SOC 2 evidence collection service does it with you.
Not ready for a call yet?
A few short notes from Jacob on collecting SOC 2 evidence without the last-minute scramble. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Want it done for you?
SOC 2 Evidence Collection
We gather and organize your SOC 2 evidence with you so the audit goes smoothly.
Explore SOC 2 Evidence Collection →We gather, organize, and map your SOC 2 evidence to the Trust Services Criteria, so you walk into the audit prepared instead of scrambling.
See SOC 2 Evidence Collection Book a callThis gives you the shape of the problem. The full picture is all 61 criteria of SOC 2, each one explained in plain English, with somewhere to attach the evidence and a readiness score that moves as you close gaps. Start a free assessment and walk every control.
No credit card, no trial clock, no locked features. TrazTech makes money when someone wants help closing the gaps, not from the Workspace itself.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.
Everyone on our list also gets The Compliance Brief, one email every Tuesday on what changed in security and compliance that week. Read the latest issue.