Are you SOC 2 certified?

SOC 2 is not a certification and no one is "SOC 2 certified"; it is an attestation report issued to a company by a licensed CPA firm. What we do is build software that supports the technical controls and evidence a SOC 2 examination tests, so your own report goes faster.

What is the difference between SOC 2 Type I and Type II?

Type I attests that your controls are designed appropriately at a single point in time. Type II attests that they operated effectively across an observation window, usually 3 to 12 months. We build the controls and evidence sources both types rely on; the audit and the window are run by you and your auditor.

Which Trust Services Criteria do you cover?

Security (the Common Criteria) is required and is where we do the most: access controls, MFA, encryption, change management, and logging. We also engineer for Availability, Confidentiality, and Processing Integrity. Privacy needs your notice, consent, and policy work on top of the technical layer, so we cover the technical side of it.

Do we still need a tool like Vanta or Drata?

Usually yes. Automation platforms like Vanta, Drata, or Secureframe continuously collect evidence and monitor controls, and most auditors expect one. We build so that platform has clean signals to read, real audit logs, IaC, and reviewed change history, rather than gaps it has to flag.

Can you get us through the audit itself?

We get the platform audit-ready and can support you through fieldwork, but the examination and the report are performed by an independent, licensed CPA firm. We are happy to recommend auditors and readiness consultants we have seen founders work well with.

SOC 2-Ready Software Development

We build software that supports SOC 2 Type II controls and audit evidence: access, change management, encryption, and logging engineered from week one, so your report goes faster.

Schedule a meeting See our status

Our status against SOC 2

Audit-ready builds

We build software that supports the technical controls and evidence a SOC 2 examination looks for. SOC 2 is an attestation issued to your company by a licensed CPA firm; it is not a certification a development shop can hold on your behalf.

Our status for each SOC 2 requirement
Requirement	Status	Note
Security (Common Criteria)	Met	The required TSC: RBAC, MFA, encryption, and logging designed in from day one.
Availability	Met	Monitoring, alerting, and backup/restore patterns that produce uptime evidence.
Confidentiality	Met	Data classification and encryption so confidential data is scoped and protected.
Processing Integrity	Met	Input validation, reconciliation, and error handling for accurate processing.
Privacy	Partial	We architect the technical side; the Privacy TSC also needs your notice, consent, and policy work.
Change management evidence	Met	PR reviews, CI checks, and protected branches produce an auditable change trail.
Type II observation window	Partial	Type II tests controls over 3–12 months of operating evidence; that window and the audit are yours to run.

The part of SOC 2 you cannot buy your way through

Every buyer asks when the report will arrive. The honest answer is a calendar one, because a Type II attests that controls operated over a period.

Timeline of a SOC 2 programme over twelve months. A gap assessment at month zero establishes what is missing; controls are implemented and in real use by month two and a half; the observation window opens around month five and evidence accrues daily until it closes between three and twelve months later, after which the Type II report is issued. — The only variable you control is how early the window opens, which is why controls go in before the sales pressure arrives.

What this means for your build

We engineer the technical controls a SOC 2 examination tests, access management, change management, encryption, and logging, rather than retrofitting them the month before your audit.
We make evidence a byproduct of how we build: PR reviews, CI gates, audit logs, and infrastructure-as-code all leave the trail an auditor asks for.
We scope the system boundary with you early, so it is clear which services, data stores, and subprocessors are in scope for the report.
We wire access controls around least privilege and MFA, and keep provisioning/de-provisioning steps auditable.
We can prepare the platform for a SOC 2 audit, but we do not issue the report; that is signed by an independent, licensed CPA firm.

How we ship SOC 2-compliant code

Least-privilege access controls

RBAC, MFA, named IAM roles, and time-bounded access, with provisioning and de-provisioning that leave an audit trail.

Change management via PR + CI

Protected branches, required reviews, and CI gates so every production change has a reviewed, evidenced approval path.

Audit logging

Centralized, tamper-evident logs for access and administrative actions, with retention that satisfies the observation window.

Encryption at rest and in transit

AES-256 with managed keys (KMS or equivalent) and TLS 1.2+, so the Confidentiality and Security criteria are covered by default.

Infrastructure as code

Terraform / CloudFormation so environment configuration is reviewable, reproducible, and self-documenting for auditors.

Monitoring and alerting

Uptime, error, and anomaly alerting that produces the Availability evidence and an incident-response record.

What SOC 2 does NOT cover

SOC 2 is an attestation issued by a licensed CPA firm; a development agency cannot certify or attest it for you.
SOC 2 is not ISO 27001. ISO 27001 is a separate international certification with its own ISMS requirements.
A SOC 2 report covers your organization’s system and controls, not a badge on us as a subprocessor.
SOC 2 does not replace HIPAA, GDPR, or PCI DSS; those regulate specific data types on top of it.
The written policies, HR/onboarding controls, vendor-risk program, and auditor engagement are yours; we cover the technical controls, not the org-wide program.

When you need a separate consultant

We engineer for SOC 2; we are not a law firm or a certifying body. Bring in a specialist when you need:

The SOC 2 examination and report itself → a licensed CPA / auditing firm (e.g. Prescient Assurance, Johanson Group, A-LIGN).
Continuous evidence collection and control monitoring → a compliance automation platform (e.g. Vanta, Drata, Secureframe).
Written information-security policies, risk assessment, and vendor-risk program → a security/GRC consultant.
A readiness assessment or gap analysis before the Type I → a SOC 2 readiness consultant.
We can recommend specific auditors and automation platforms on request.

Industries where SOC 2 applies

AI Fintech

Underwriting, risk, and payments platforms, where a SOC 2 report is table stakes for enterprise procurement.

Underwriting + risk models
Fraud detection
Document intelligence

Explore

AI Healthtech

Clinical and provider-facing tools that health systems will not buy without a SOC 2 report alongside a BAA.

Clinical copilots
Provider workflow tools
Medical document workflows

Explore

AI Marketing

Ad, outbound, and content platforms that store customer data and need SOC 2 to close mid-market and enterprise deals.

AI ad-creative platforms
Outbound + enrichment engines
Content + AEO tooling

Explore

Work we've shipped with SOC 2 requirements

CheckyPro

A custom checkout and payment platform for Shopify merchants: gateway integration, Apple Pay and Google Pay, multi-store installs, disputes and settlement reporting.

9 stalled pull requests and a 3-week bug backlog cleared; 3 held features then shipped.

Draft Deputy

A Shopify app that inverts order entry for live sellers: scan the product, and the draft order builds itself.

30+ SKUs scanned into one Shopify draft order; the old version choked on large ones.

2250

A 60-second skin scan on a pharmacy shelf that resolves into one of more than a thousand personalised formulas, handed to the customer the same visit.

1,000+ skincare formulas resolved from a 60-second phone scan in 55+ San Pablo pharmacies, before the customer leaves the store.

View all work →

Free tool

Tech Audit Checklist

A founder-grade checklist for pressure-testing your architecture before an auditor does: access controls, change management, logging, and the evidence gaps that slow a SOC 2 down.

Get the free checklist

Compliance lives in the architecture, not in a policy document

Encryption at rest, access controls, audit logging, and immutable decision trails are wired into the build from the first sprint. The posture on this page reflects how we actually ship.

Rows of server racks in a data centre corridor

Frequently asked questions

SOC 2 is not a certification and no one is "SOC 2 certified"; it is an attestation report issued to a company by a licensed CPA firm. What we do is build software that supports the technical controls and evidence a SOC 2 examination tests, so your own report goes faster.

Enterprise buyers asking for a SOC 2 report? Schedule a meeting.

No account managers. A direct conversation about your system boundary, the controls an auditor will sample, and what it takes to ship software that is audit-ready from week one.

Schedule a meeting See our full compliance posture