Evidence
What evidence does a SOC 2 auditor actually ask for?
The complete list: ten policies and eighteen operational artefacts, what satisfies each one, and the four requests that catch teams out.
9 min read
Guides
Specific answers to the questions founders actually ask before a first audit — what an auditor requests, what it costs, how long it takes, and what to do first. No gated PDFs, no "book a demo to learn more".
Evidence
The complete list: ten policies and eighteen operational artefacts, what satisfies each one, and the four requests that catch teams out.
9 min read
Getting ready
Week by week, from the first customer question to a repeatable cadence — and the five mistakes that cost the most.
9 min read
Cost
Audit fees, tooling, penetration tests, and the 100–300 hours of internal time that appears on no invoice.
8 min read
Policies
SOC 2 names no policies. Here are the ten that have become standard, what each must contain, and why templates cause failures.
8 min read
Basics
The real difference, what each costs, and how to choose without paying two audit fees.
7 min read
Comparison
What each actually is, how much work carries over between them, and how to decide which to do first.
7 min read
Timeline
2–4 months for a Type 1, 6–9 for a first Type 2 — and why the observation window is the one thing money cannot shorten.
6 min read
Questionnaires
What the buyer is really checking, why “no” rarely loses the deal, and how to answer once so the next one takes an hour.
7 min read
Evidence
The standard never names one. Most auditors expect one anyway. What to actually buy, when to run it, and what a scan does not cover.
8 min read
Readiness
The most common finding for startups, and the only one you cannot fix after the fact. What to review, what to keep, and how to make it recur.
8 min read
Readiness
What one engineer can realistically own alongside their actual job, what to defer, and the three things that genuinely cannot wait.
8 min read
Fundamentals
What the five criteria actually mean, why only one is mandatory, and why adding the others is the most expensive mistake in scoping.
8 min read
Policies
The standard specifies no minimum length and no rotation period. What the auditor really tests, and the policy wording that will not trip you up.
7 min read
Nineteen questions, then a personalised list of what you are missing and what proves each one. Fourteen days free, no card, runs in your browser.