The security certificate your biggest deals are waiting on.
SOC 2 is the independent report enterprise buyers ask for before they'll sign with a smaller supplier. We handle the whole road to it — the policies, the controls, the evidence, the tooling, and the auditor — so your team can keep building. Most clients are audit-ready in 8 to 12 weeks.
SOC 2 isn’t a security project. It’s a sales project that happens to involve security.
Nobody wakes up wanting SOC 2. It arrives as an email from a prospect's procurement team, right when the deal was about to close, asking for a report you've never heard of. SOC 2 is simply an independent auditor confirming that you actually do the sensible things you say you do with customer data — that access is controlled, that changes are reviewed, that someone would notice if something went wrong. Get it, and a whole tier of customers becomes reachable.
The mistake is treating it as a paperwork exercise: 200 pages of policies nobody reads, bought from a template, that fall apart the moment an auditor asks for proof. We do it the other way round. We fix the handful of things that genuinely need fixing, set up tooling that gathers the evidence automatically in the background, and write policies short enough that your team will actually follow them. The certificate is the by-product of a company that runs properly — not a costume worn for a week.
What’s included.
An honest gap assessment
We compare where you are against what the auditor will ask for, then hand you one prioritised list: what's fine, what needs work, and what it will cost in time and money. No surprises later in the process.
Policies your team will actually read
The written rules an auditor requires — access, passwords, incident response, vendors, joiners and leavers — written for your company in a few readable pages each, not copied from a 200-page template.
Fixing what's genuinely broken
The real work behind the certificate: tightening who can reach what, turning on two-step login everywhere, encrypting the right things, and setting up proper backups you've actually tested restoring from.
Evidence that collects itself
We set up Drata, Vanta, or Secureframe — compliance platforms that watch your systems and quietly gather the proof the auditor needs, all year, so nobody spends a week screenshotting things the night before.
Reviews and training that stick
Quarterly access reviews, background checks, security training for staff, and a vendor list — set up as calendar-driven routines that keep running after we leave.
Choosing and managing the auditor
We introduce you to audit firms we trust, help you compare quotes honestly, and then handle the back-and-forth: gathering evidence, answering questions, and keeping the audit moving.
Answers to client security questionnaires
The long spreadsheets enterprise buyers send before signing. We build you a reusable answer library so your sales team stops losing three days per deal to them.
Keeping it alive year after year
SOC 2 renews annually. We set up the routine that keeps you compliant continuously, so year two is a fraction of the effort and cost of year one.
Who needs this.
Software companies selling to big buyers
The single most common trigger. A large customer's procurement team asks for a SOC 2 report and the deal stops dead until you have one.
Anyone handling other people's data
If your product stores your customers' customers' data, you'll be asked eventually. Starting before the deal is on the table is far calmer than starting after.
Companies raising or being acquired
Investors and acquirers now check security posture during due diligence. A clean report removes an entire category of awkward questions.
Teams that need more than SOC 2
ISO 27001 for European and Gulf buyers, HIPAA for US health data, PCI DSS for card payments, GDPR for European privacy. Most of the work overlaps — we map it once and reuse it.
How we get you there.
Scope it properly
We work out which report you actually need — Type 1 confirms your controls exist on a given day, Type 2 confirms they worked over several months — and which topics beyond security you should include. Getting this right saves months and real money.
Find the gaps
Two to three weeks of reviewing your systems, cloud setup, code process, and current practices. You get one clear document: everything the auditor will ask for, and exactly where you stand on each item.
Close the gaps
The main stretch. We write the policies, fix the technical issues, set up the automated evidence collection, and run the training — alongside your team, at a pace that doesn't stop your roadmap.
Rehearse the audit
We run a full dress rehearsal, playing the auditor ourselves. Every gap found here is one you fix quietly and cheaply, rather than in front of the real auditor.
The observation window
For a Type 2 report the auditor watches your controls run for three to twelve months. We monitor it with you and fix anything that drifts before it becomes a finding.
Audit and beyond
We sit alongside you through the audit itself, then hand over the annual routine — the calendar, the owners, and the checklist that keeps year two straightforward.
Tools we work with.
Engagement models.
Gap Assessment
from $25k
Three weeks to find out exactly where you stand, what it will take, and what it will cost. Many clients start here before committing to the whole programme.
- Full review against every SOC 2 requirement
- Prioritised gap list with time and cost estimates
- Advice on which report type you need
- Introductions to audit firms we trust
Readiness Programme
from $65k
The whole road to audit-ready: policies, technical fixes, automated evidence, training, and us alongside you through the audit itself.
- Policies written for your company
- Technical gaps fixed by our engineers
- Compliance platform set up and configured
- Rehearsal audit plus support through the real one
Multi-framework
custom
SOC 2 alongside ISO 27001, HIPAA, PCI DSS, or GDPR — mapped once so the same evidence satisfies several buyers at the same time.
- Several standards mapped to one control set
- Evidence collected once, reused everywhere
- Ongoing compliance retainer
- Client security questionnaires handled for you
Frequently asked.
5 questions answered. Still have one? Reach out.
An independent accounting firm examines how you protect customer data and writes a report saying whether you do what you claim. That report is what enterprise buyers ask to see before signing. There's no certificate on a wall and no pass mark set by a government — it's a professional opinion, renewed every year.