A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →What SOC 2 actually asks of you, in plain language: the five criteria, the controls, and the evidence auditors want.
SOC 2 is built on five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Only Security (the "common criteria") is mandatory; you add the others based on what you promise customers. Meeting the requirements means having documented policies, technical controls (access control, encryption, logging, change management), and evidence that they operated over time, not just on paper.
The numbers
The figures that shape the short answer above. Where they come from is cited in the sections that follow.
SOC 2 does not hand you a fixed checklist of controls. Instead it organizes everything around five categories, and you choose which apply based on the promises you make to customers.
Start with Security, because it is mandatory. Add the others only when you actually commit to them. If you offer an uptime SLA, include Availability. If you handle sensitive personal data, Privacy and Confidentiality may matter. Adding criteria you do not need just adds cost and evidence burden, so scope deliberately.
Underneath the criteria, the work is concrete. Most startups end up with somewhere between 60 and 100-plus controls across a familiar set of categories.
The single biggest reason audits slip is evidence. It is not enough for a control to exist; for a Type II report you must show it operated consistently over the observation window. That means collecting tickets, logs, review records, and approvals over months. Start evidence collection on day one, not the week before the auditor arrives.
| Criterion | Required? | Include when |
|---|---|---|
| Security | Yes (always) | Every SOC 2. The common criteria baseline. |
| Availability | Optional | You commit to uptime or an SLA. |
| Processing Integrity | Optional | Your system transacts or processes customer data. |
| Confidentiality | Optional | You handle data customers designate confidential. |
| Privacy | Optional | You collect and process personal information. |
Only one. Security, also called the common criteria, is mandatory in every SOC 2 report. The other four (Availability, Processing Integrity, Confidentiality, and Privacy) are optional and added only when they reflect commitments you make to customers.
There is no fixed number. SOC 2 defines criteria, not a rigid control list, so the count depends on your scope and systems. Most startups end up with roughly 60 to 100-plus controls once you account for policies, access management, encryption, logging, and change management.
For a Type II report, the auditor wants proof that controls operated over the whole observation window: access review records, change approvals, logs, ticket histories, and policy acknowledgements. Designing a control is not enough; you have to show it ran consistently.
No, and you usually should not. Adding criteria you do not actually commit to just increases cost and evidence work. Include Security plus only the additional criteria that match what you promise customers.
Criteria are the high-level objectives (for example, "logical access is restricted"). Controls are the specific things you do to meet them (MFA, quarterly access reviews, offboarding within 24 hours). You map your controls to the criteria and then prove they work.
traztech Workspace has all 61 criteria of SOC 2 written in plain English, with what the standard asks for, what to do about it, and somewhere to attach the proof. You answer them, it scores you, and nothing is locked behind an upgrade.
No credit card, no trial clock, no locked features. We make money when someone wants help closing the gaps, not from the Workspace.
| traztech Workspace | Other GRC platforms | |
|---|---|---|
| Licence cost | $0. Free forever, no card, no paid tier | $7,500 to $50,000 a year, on an annual contract |
| Control library, evidence register, policy templates, risk register, vendor questionnaires, readiness scoring | Included | Included |
| What it costs inside an engagement with us | $0. You need a workspace either way | Unchanged. The subscription sits on top of the fee |
| What it does to your audit quote | A documented readiness position the audit firm can scope and price against | Nothing. The audit firm prices your readiness, not your tooling |
Platform pricing is a publicly reported range, since none of them publish a number. The fuller comparison, including when a paid platform is the better buy, is on the Workspace page.
Run the free SOC 2 readiness tool, or have us scope your criteria and run the program end to end.
Book a strategy callFree PDFs, no card
The SOC 2 readiness checklist, the ISO 27001 gap checklist and the vendor security questionnaire, as PDFs you can print or hand to your team. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.
Everyone on our list also gets The Compliance Brief, one email every Tuesday on what changed in security and compliance that week. Read the latest issue.