Three packages, prices published.

One customer questionnaire answered truthfully, plus an answer bank and a security overview you keep and reuse.

Who it is for

A startup with a questionnaire or security review open in a live deal, and no SOC 2 report.

Scope

• One customer questionnaire.
• A short review of your real controls, from read-only access and interviews.

What you get

• The completed questionnaire, with truthful answers and compensating controls.
• An answer bank you own and reuse.
• A two-page security overview suitable for a trust page.
• A subprocessor list.
• A prioritized list of the gaps that will block the next review.
• One call with your customer's security reviewer, if asked.

Not included

• A SOC 2 audit or report.
• A penetration test.
• Remediation work.
• Legal review of your customer's contract or data processing agreement.
• Answers the evidence does not support.

Getting your company ready for SOC 2: scope, gap assessment, policies, control and evidence setup, choosing an auditor, and support through the audit.

Who it is for

A startup where a deal or contract now depends on a SOC 2 report.

Scope

• The Security criterion only, unless your customer requires more.
• One production environment on AWS, Azure or GCP.

What you get

• Scope and system description.
• Gap assessment.
• A lean policy set that matches how your company actually operates.
• Control configuration guidance in your compliance platform.
• An evidence plan.
• An auditor shortlist and introduction.
• Support through the audit, up to the Type I report your auditor issues.
• A plan for the Type II observation period.

Not included

• The audit itself, the report and the auditor's fee. I am not a CPA firm and give no opinion.
• The compliance platform subscription.
• An independent manual penetration test. If your customer requires one, it is arranged with a third party at cost.
• Engineering remediation beyond configuration guidance.
• Any guarantee of the audit outcome.

Someone to own security month to month: the roadmap, every incoming questionnaire, vendor and access reviews.

Who it is for

A startup past its first review that needs someone to own security month to month.

Scope

• Owner of the security roadmap and risk register.
• All incoming questionnaires, answered from the answer bank.
• Vendor reviews.
• Quarterly access reviews.
• An annual incident response exercise.
• Your side of each audit and its renewal. The audit itself stays with your independent auditor.
• One investor or board update per quarter.
• An AI use policy, and the AI section of customer reviews.

What you get

• A monthly status report.
• A maintained answer bank and trust page content.
• A quarterly roadmap review.
• Evidence kept current for the next audit.

Not included

• Round-the-clock monitoring, or an on-call incident response service.
• Staff-augmentation engineering.
• Legal advice.