A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A buyer, board, or regulator just told you to get compliant. We are the audit-prep experts who get you there fast, SOC 2, ISO 27001, HIPAA, PCI DSS, and privacy law. Fixed scope, real timelines, no auditor-speak.
Book a free 30-minute readiness callServing startups and mid-market across Canada and the US.
The trigger is almost always the same: revenue or funding is at risk, and you do not have time to figure this out yourselves. That is exactly what we remove.
Go through Phase 1 and Phase 2 with us, the gap analysis and the remediation support, and if your audit or certification returns a qualified opinion, a major nonconformity (MNC), or the equivalent on a control we prepared, we provide the remediation support to resolve it at no charge.
We run readiness and audit prep across the frameworks that gate enterprise deals and regulated markets, including ISO 42001 (AI) readiness for teams shipping AI features. Each links to a full breakdown of scope, what drives timing, and what buyers expect.
The guides above explain what each standard asks for. These are the fixed-scope engagements that get you there, each with a defined scope and a published starting price. See full pricing.
Adverse opinions are real, and ISO 27001 withholds certificates at Stage 2. The commoner outcome is worse: the auditor reaches fieldwork, finds nothing testable, and recommends stopping.
You have then paid five figures for an audit with no report at the end of it, and re-entering fieldwork means paying again. A Type II gap can add a fresh three to twelve month window on top. The full cost breakdown.
The audit itself has to be signed by an independent CPA firm. Everything before that, the part that actually takes the time and causes the pain, is what we own, and it is the only thing we do.
Gap assessment, policies, control implementation, evidence collection, and auditor coordination. You get an outcome and a date, not a stack of templates.
Our principal is a published security researcher, so controls are designed around real attacker behavior. When your buyer asks a hard technical follow-up, the answer holds.
Already have a compliance-automation tool but stuck at 60 percent green? We finish it. Starting from zero? We stand it up. Either way you get to audit-ready.
You know the deliverable, the timeline, and the price before you commit. No open-ended hourly meter and no fabricated numbers.
Phase 1 is a fixed-price gap analysis. Phase 2, remediation and audit support, is a fixed price scoped from what the gap finds. Timing depends on the gaps, the observation period and your auditor's schedule. See full pricing.
Phase 1 gap analysis: every control assessed, a ranked gap report and a roadmap. Phase 2 remediation and audit support is scoped from the gap, for Type I or Type II.
Phase 1 gap analysis, then ISMS build-out, Statement of Applicability, and internal audit ready for Stage 1 and Stage 2.
Risk analysis, safeguards, BAAs, and PHI policies for digital health teams facing a deadline.
Deciding how to get compliant? Start here.
The same control-by-control checklist we use to get clients audit-ready. Read it free, or grab the editable version for your team.
Open the checklistWhatever the trigger, a blocked deal, an investor ask, or an expiring audit, we will build the plan to meet it. Free 30-minute readiness call, no pressure.
Book a readiness callPhase 1 ends in a written gap assessment. Here is a full specimen: where a company stands against every in-scope criterion, the controls that are not fully in place ranked worst first, what it takes to close each one, the controls claimed with nothing behind them, and what Phase 2 does about it. The client and the answers are invented. The format is the one you get.
Sample Phase 1 gap assessment All sample reportsIt depends on three things: the gaps the Phase 1 gap analysis finds, the observation period, and your auditor's schedule. A SOC 2 Type I commonly takes a few months from start to report. A Type II adds an observation window of 3, 6 or 12 months once your controls are operating, followed by the auditor's fieldwork and report. The gap analysis gives you a dated plan for your own situation.
Budget two separate line items: the auditor (an independent CPA firm, often USD 10k to 30k+ depending on scope) and readiness help. Our SOC 2 readiness starts with a Phase 1 gap analysis from $3,000, and Phase 2 is a fixed price scoped from the gap, so you know the number before you commit. We are open about both from the first call and never inflate scope.
We do readiness and audit prep: gap assessment, policies, evidence collection, control remediation, and auditor coordination. We do not sign the attestation, because SOC 2 and ISO 27001 require the preparer and the auditor to be independent. We work alongside your auditor so the exam goes smoothly, and readiness and audit prep is the only thing we do.
If your buyers are mostly North American SaaS and enterprise, SOC 2 usually comes first because that is what their security questionnaires ask for. If you sell into Europe or globally, ISO 27001 often carries more weight. The control sets overlap heavily, so doing one gives you a strong head start on the other. We help you sequence them so you never build the same evidence twice.
Yes, though not as a pass or fail stamp. A CPA firm issues an opinion, and adverse opinions and disclaimers are both real, damaging outcomes. ISO 27001 is more binary still, and a major nonconformity at Stage 2 blocks the certificate until you remediate and pay for the re-check. But the outcome that catches most unprepared companies is worse than a bad report: the auditor reaches fieldwork, finds the evidence is not testable, and recommends pausing. You have then paid for an audit that produced nothing you can send a buyer, re-entering fieldwork means paying a firm again, and a Type II gap can cost you a fresh three to twelve month observation window on top. The full breakdown is here.
Before the observation window opens, not before fieldwork starts. A Type II tests whether each control operated across the whole stated period, typically three to twelve months. Turning a control on partway through leaves the earlier months exposed, and the usual remedy is to move the window, which pushes your report date by months. Setting the window start after your controls are live and producing dated evidence is one of the decisions that matters most in the programme.
Yes, and it is common. Compliance automation tools track controls, but they do not write your policies, close your gaps, choose your auditor, or interpret an ambiguous control. We work on top of your existing Vanta or Drata instance to get you from 60 percent green to actually audit-ready.
Yes. We are based in Toronto and work with startups and mid-market companies across Canada and the United States. Frameworks like SOC 2, ISO 27001, HIPAA, and PCI DSS are international, and we deliver readiness remotely across both countries.
Every readiness programme needs a control library, an evidence register, policies and a score for the board. Being quoted five figures a year for that is normal. Paying it is not required, and it is not required to work with us either.
| traztech Workspace | Other GRC platforms | |
|---|---|---|
| Licence cost | $0. Free forever, no card, no paid tier | $7,500 to $50,000 a year, on an annual contract |
| Control library, evidence register, policy templates, risk register, vendor questionnaires, readiness scoring | Included | Included |
| What it costs inside an engagement with us | $0. You need a workspace either way | Unchanged. The subscription sits on top of the fee |
| What it does to your audit quote | A documented readiness position the audit firm can scope and price against | Nothing. The audit firm prices your readiness, not your tooling |
Platform pricing is a publicly reported range, since none of them publish a number. The fuller comparison, including when a paid platform is the better buy, is on the Workspace page.
Track record
We would rather show you the work than a wall of logos. Here is what is behind the advice.
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
The printer is the one that matters on a compliance page: an asset nobody counts as a computer, on a flat network, downed by a device that never had to log in. Auditors ask how controls fail. We have found out first-hand.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.
The platform stayed in production throughout, which is the part most readiness projects get wrong: controls are easy to design and hard to retrofit onto a system people already depend on.
For a Waterloo data centre operator we ran SOC 2 Type II and ISO 27001:2022 together rather than one after the other, across a production campus, an AI compute platform and a self-hosted collaboration stack. Scoped so further Ontario and Quebec sites enter as they reach production. Findings delivered and remediated.
For an Ontario medtech company putting an AI clinical assistant in front of practitioners, we ran the gap analysis and built the evidence programme behind their SOC 2.
Free PDFs, no card
The gap checklist as a PDF, with the rest of the set, including the SOC 2 readiness checklist for when a North American buyer asks for that instead. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.