Home › Compliance

A customer says they need SOC 2 before they'll sign. You have no idea where to start.

You're running production on AWS, an enterprise deal is on the line, and you don't have a full-time security person. We get you audit-ready — and stay to keep you there.

Book a free scoping call →

The email lands from your biggest prospect: "We'll need your SOC 2 report before procurement can approve." Suddenly a deal you've earned is blocked by a process nobody on your team has run.

The instinct is to hire a security lead or buy a compliance tool and hope it sorts itself out. Neither works on its own. The tool tells you what's wrong, but someone still has to fix it — harden your AWS environment, write the policies, and carry you through the audit. That's what we do.

Who this is for

AWS-based startups without a security team.

SaaS and fintech companies, roughly 10–50 people, running production on AWS or Linux — chasing or already committed to an enterprise deal that requires SOC 2 Type II, with no dedicated infrastructure-security hire. If that's you, you don't need to build a security team to get compliant. There's a faster path.

The engagement

Three steps, scoped to what customers actually ask for.

We lead with the SOC 2 Security criterion — the thing enterprise buyers actually require — so the work stays deliverable and your cost stays controlled.

01

Readiness & gap assessment

Fixed fee · 2–4 weeks

We inventory your AWS environment, map where you stand against the SOC 2 Security criterion, and hand you a prioritized remediation roadmap. Low-risk, fixed-scope, and yours to keep whether or not you continue with us. This is where everyone starts.

Fixed fee from $8,500
02

Remediation & implementation

Monthly engagement · scoped to your gaps

We close the gaps. Deploy and configure your compliance platform (Vanta or Drata), harden the AWS and Linux layer — IAM, CloudTrail, logging, access reviews — and write the policies auditors expect. You get working controls, not a checklist.

03

Continuous compliance

Ongoing retainer · scoped to your environment

SOC 2 Type II isn't a one-time badge; it requires a fresh report roughly every year. We keep your evidence current between audits so the next one is routine, not a fire drill.

The tool is not the work.

Vanta and Drata are the X-ray machine. We're the radiologist. The platform shows you what's out of compliance; getting compliant — and hardening the infrastructure the tool can't touch — is the expertise. We operate the platform so you don't have to become an expert in it.

We're not your auditor. SOC 2 is attested by a licensed CPA firm, and we'll bring one in for the attestation itself. Our job is getting you ready and keeping you ready.

For AI-native teams

SOC 2 and ISO 42001, one coordinated engagement.

Building an AI product? We're one of the few teams that can take you through SOC 2 and ISO 42001 — the emerging standard for responsible AI management — on the same AWS environment. Two frameworks that increasingly get asked for together, handled by one team.

Health-tech or telehealth? HIPAA readiness is part of our engagement roadmap. Demand there is deeper and more permanent than SOC 2 — and the liability is heavier — so we scope those engagements carefully, with clinical-compliance review before handling anything involving protected health information.

Common questions

What founders ask before starting.

How long does SOC 2 readiness take on AWS?
The readiness and gap assessment runs 2–4 weeks. From there, remediation depends on how many gaps you have, but most AWS-based startups reach an observation-ready state within a few months. We give you a realistic timeline for your specific environment on the scoping call.
Do we need to hire a security team?
No — that's the entire point. We provide the security and infrastructure expertise on a fractional basis, so you don't have to hire a full-time security lead just to close one enterprise deal.
Are you our auditor?
No. SOC 2 is attested by a licensed CPA firm. We handle readiness and remediation and coordinate with a CPA audit firm for the attestation itself. Keeping those roles separate is how the process is meant to work.
Vanta or Drata?
We work with both. The platform automates evidence collection, but it can't harden your AWS environment, write your policies, or fix your access controls. That's the work we do.
Start here

Find out what SOC 2 takes for your environment.

Book a free scoping call. We'll tell you honestly what SOC 2 will take — timeline, effort, and where you already stand. No cost, no pitch.