A customer sent a 200-question security questionnaire and we don't know what to answer
We build one answer base from your real practices. Future questionnaires take hours, not weeks.
SOC 2 or ISO 27001 for your SaaS, without the paperwork bloat
Enterprise buyers ask for a security attestation before they sign. We find what your product is missing, write the policies, set up evidence collection and prepare you for the auditor. The certificate itself comes from an independent auditor. We get you ready for that audit.
Quote and schedule after your brief
Who it's for
- SaaS startups that just received a security questionnaire or a SOC 2 request from a large customer
- Product companies selling into the EU, UK and US that need ISO 27001 for tenders
- Teams moving upmarket from SMB to enterprise buyers
- Companies that want to close security gaps before the audit, not during it
Problems we solve
We can't tell whether we need SOC 2 or ISO 27001
We look at who your buyers are and where. SOC 2 is more common in US deals. ISO 27001 is more common in the EU and in tenders. We recommend one to start, and reuse the work if you add the second later.
Consultants quote tens of thousands and hand over documents nobody reads
We write short policies that match how your team actually works. Each one maps to a requirement in the standard. We prepare a quote after your brief.
Collecting screenshots, access lists and change logs by hand eats engineering time
We connect a compliance automation platform (such as Vanta, Drata or Secureframe) to your cloud, git and ticketing. It collects much of the evidence itself. We pick the platform with you, and the licence is billed separately.
What's included
- Gap analysis against SOC 2 Trust Services Criteria or ISO 27001 Annex A
- Scope definition: which systems, data and people fall into the audit
- Risk register and a plan to close the risks
- Policies and procedures: access, code changes, incidents, backups, vendors, onboarding and offboarding
- Technical controls with your engineers: MFA, audit logs, encryption, backups, least-privilege cloud access
- Compliance platform setup and evidence collection
- Security awareness training and completion records
- Internal dry-run audit before the real one
- Auditor selection and support during the audit
- A trust page on your website that explains your security practices to buyers
Choose the scope
Use a package to describe what you need. We agree on the quote and schedule after reviewing your brief and requirements.
01
Gap Analysis
Teams still deciding whether they need a certificate and where to start
- Interviews with your tech lead and founder
- Gap analysis against the chosen standard
- Prioritised list of gaps
- Budget and timeline estimate for the full path
02
Audit Readiness
SaaS teams going for SOC 2 Type I or ISO 27001 who want to reach the auditor prepared
- Policies and procedures tailored to your product
- Risk register and remediation plan
- Technical controls configured with your team
- Compliance platform setup and evidence collection
- Dry-run audit and support during the audit
03
Full Cycle with Type II
Teams that need SOC 2 Type II (controls tested over a period) or ISO 27001 with surveillance audits
- Everything in Audit Readiness
- Monthly evidence reviews during the observation period
- Policy and risk register updates
- Preparation for follow-up and surveillance audits
- Trust page and ready answers for security questionnaires
How we work
Brief and requirements
You describe the task and current workflow. We clarify requirements, choose a first stage and prepare a quote.
Gap analysis
We review your infrastructure, code, processes and documents. You get a prioritised list of gaps with effort estimates.
Policies and technical controls
We write the documents and help configure access, logging, backups and encryption. All accounts and files stay yours under the agreed terms.
Evidence and dry run
The platform collects evidence automatically and we add the rest by hand. Before the auditor arrives, we run an internal check and fix weak spots.
Audit and after
We help you choose an auditor and answer its requests with you. After the audit we set up a monthly routine to keep you compliant.
Scope and limits
- We do not issue the certificate. An independent auditor or certification body does, and we cannot guarantee an audit outcome.
- Auditor fees and compliance platform licences are not in our price. They are separate costs, and we give a rough figure at the gap analysis stage.
- We cannot do it all for you. Without your tech lead, system access and interview time, readiness will drag.
FAQ
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an auditor's report on your security controls, most often requested by US customers. ISO 27001 is an international certificate for an information security management system, more common in the EU and in tenders. We help you pick based on your buyers.
What are Type I and Type II?
Type I confirms your controls are properly designed at a point in time. Type II tests that they work over a period, usually several months. Many enterprise buyers eventually ask for Type II.
How long does it take?
The schedule depends on scope, materials, access and external approvals. After your brief we agree on stages and acceptance criteria. For marketing outcomes, we also agree on how to measure progress: rankings, leads and sales depend on more than the work delivered.
Do we have to buy a platform like Vanta or Drata?
Not strictly, but it saves a lot of time on evidence. A very small team can manage with spreadsheets and scripts. We show both options with rough costs and you choose.
What do we need to provide?
Access to your cloud, git and ticketing (read-only where possible). Your tech lead's time for interviews and setup. Management decisions on risks and policies. A list of vendors and contractors that touch your data.
Can we start small?
Yes. The Gap Analysis package gives you a clear plan and budget. Then you decide whether to continue with us, another provider, or do it in-house. The documents and findings stay yours.
Start with your task
Describe your business, the outcome you need and your current workflow. We will clarify the requirements and prepare a quote after your brief.