We help prepare the policies, controls and evidence for a SOC 2 examination — practical readiness support for UK and European businesses serving enterprise buyers.
SOC 2 readiness means having the policies, controls, and evidence in place before your auditor begins their examination. A readiness programme identifies the gap between your current state and what the AICPA Trust Services Criteria require — then closes it systematically, so your audit observation period produces clean evidence from day one. A SOC 2 report is issued by an independent audit firm following the examination — it is an attestation report, not a certificate in the ISO sense. See the AICPA's overview of SOC services.
This service is for UK and European SaaS and AI companies selling into US or multinational enterprise accounts. You may be a founder-led team with no dedicated security hire, a scale-up whose first report is approaching renewal, or an engineering-led business that has good technical practice but no audit-ready evidence trail. It is particularly useful when a customer’s procurement team has made SOC 2 a condition of signing or production access.
We are not the audit firm and we do not promise a particular audit opinion. We prepare the operating system around your service, help you select an independent CPA firm, and stay accountable for the readiness work while your team retains ownership of the controls.
A prospect sends you a security questionnaire. Or an enterprise deal stalls because you don't have a SOC 2 report. You look into "how to get SOC 2" and discover it requires many policies, continuous evidence collection, access reviews, vulnerability management cadence, vendor assessments, and an auditor relationship you have no idea how to manage.
Then you look at your team: a handful of engineers, limited dedicated ops capacity, and founders already wearing every hat. Compliance platforms carry a recurring subscription cost before you even start, and consultant quotes are often hourly, with no commitment to the outcome.
That is the problem ProtectifyAI helps solve. We implement the readiness programme with you, support the auditor relationship, and agree a fixed fee upfront tied to the report landing — not hourly billing.
If the trigger was a US customer asking for “your SOC 2 report”, start by confirming whether they mean Type I or Type II, which Trust Services Criteria they require, and the date they need the report. Our guide to SOC 2 for UK SaaS companies covers the customer, auditor and commercial questions; the Type I vs Type II guide helps you turn the buyer’s wording into a workable milestone.
Procurement questions tend to cluster around five things: your current SOC 2 report and report period; where customer data is hosted and which subprocessors you use; access, encryption, vulnerability and incident controls; resilience and notification commitments; and whether you can answer follow-up questions consistently. A customer may ask for a Type II report while its security team separately requests a penetration-test summary, data-flow diagram, insurance certificate and completed questionnaire.
We help you answer the request accurately rather than sending a generic policy folder. That means documenting the system boundary, report type and criteria, data locations, customer responsibilities and the evidence behind each material claim. The SOC 2 evidence checklist shows the access reviews, change tickets, vendor assessments, incident records and other source evidence an auditor will expect.
Full set of policies aligned to the Trust Services Criteria — tailored to your stack and team, not renamed templates.
RBAC design, joiners/movers/leavers process, MFA enforcement, and quarterly access review cadence.
Scanning cadence, remediation SLAs, penetration test scoping, and evidence packaging for auditors.
Vendor inventory, risk tiering, due diligence questionnaires, and annual review process.
Automated and manual evidence workflows, mapped to each control, ready for auditor export.
IR policy, tabletop exercise, notification procedures, and post-incident review process.
Change control process, approval workflow, and evidence trail for infrastructure and code changes.
Auditor selection support, kick-off facilitation, PBC list management, and response drafting throughout the examination.
For access control, we establish an identity-provider export and reviewer sign-off for each quarterly access review, with joiner, mover and leaver tickets linked to the decision. For change management, we connect a production deployment to an approved ticket, code review, test result and rollback path. For vendors, we create a risk-tiered register, due-diligence record, contract and annual review date. For incidents, we keep the incident log, exercise record, notification decision and post-incident actions together.
These examples are deliberately ordinary. Auditors need evidence of the controls your team actually operates, not a collection of impressive documents that no one can maintain. We automate reliable exports where that makes sense and retain human review for risk decisions, supplier acceptance and incident severity.
| Phase | Duration | What happens |
|---|---|---|
| 01 | Weeks 1–2 | Gap assessment, scope definition, auditor shortlisting, control mapping to Trust Services Criteria |
| 02 | Weeks 3–6 | Policy library creation, access control implementation, vendor management setup, evidence collection infrastructure |
| 03 | Weeks 7–10 | Vulnerability management cadence, incident response tabletop, change management wiring, remaining control gaps closed |
| 04 | Weeks 11–12 | Pre-audit readiness review, PBC list preparation, auditor kick-off facilitation |
| 05 | Months 3–9 | Type 2 observation period — ProtectifyAI monitors evidence quality, manages auditor queries, supports any remediation needed |
| 06 | Certificate | Examination complete, SOC 2 report issued. Outcome fee payable on report issuance. |
| Factor | Type 1 | Type 2 |
|---|---|---|
| What it covers | Controls designed appropriately at a point in time | Controls operating effectively over 3–12 months |
| Time to complete | 8–12 weeks from readiness | 12–18 months from readiness |
| Accepted by enterprise buyers | Provisionally (often a stepping stone) | ✓ Standard requirement |
| Useful for early deals | ✓ Shows commitment | ✓ Full trust signal |
| ProtectifyAI recommendation | Start here if you need a report within 3 months | Target this from the outset if your timeline allows |
The 47-point checklist we use internally before every SOC 2 readiness engagement. Covers policies, controls, evidence, vendor management, and pre-audit review. Enter your email to receive it.
Outcome-based pricing — aligned to the same model on our homepage. Fixed fee, no hourly meters, no scope-creep change orders.
No hidden fees. Auditor costs are separate and quoted independently. We are vendor-neutral — Vanta, Drata, Sprinto, or no platform.
SOC 2 readiness means having the policies, controls, and evidence in place before your auditor begins their examination. A readiness assessment identifies gaps between your current state and what the AICPA Trust Services Criteria require — and a readiness programme closes those gaps before the audit clock starts.
For most AI startups starting from scratch, SOC 2 readiness takes 8–12 weeks. The observation period for SOC 2 Type 2 then runs for a further 3–12 months depending on your target audit window. The full journey from engagement start to a Type II report is scope- and timeline-dependent — we provide an estimate after an initial assessment rather than a universal figure.
We agree a clear scope, deliverables and fee upfront, tied to the report landing — not hourly rates. This means the price does not change regardless of how many rounds of remediation the auditor requires. Auditor fees are separate, vary by firm and scope, and are quoted independently by the audit firm.
SOC 2 Type 1 confirms controls are designed appropriately at a point in time. SOC 2 Type 2 covers an observation period (typically 3–12 months) and confirms controls operated effectively throughout. Most enterprise buyers require Type 2, but Type 1 is a useful stepping stone if you need a report urgently.
US-headquartered or US-market-focused startups typically prioritise SOC 2 first. UK and European startups often pursue ISO 27001 first. AI startups targeting both markets frequently do both — the control overlap is significant, and pursuing both can be more efficient once the first is complete, though each remains a distinct assessment.
Yes. A compliance platform automates evidence collection and reduces manual effort, but it is not required. ProtectifyAI is entirely vendor-neutral. We will recommend whether a platform makes sense based on your team size, infrastructure, and budget — and we work with whichever platform you choose, or none.
We implement the readiness programme across policies, Trust Services Criteria control mapping, evidence collection, vendor management, access reviews, vulnerability management and incident response. We then support the auditor relationship from kick-off through the issued report.
Security (Common Criteria) is mandatory. Most AI startups also include Availability and Confidentiality, as these address the questions enterprise buyers ask most often about AI systems — uptime commitments and data handling. Processing Integrity and Privacy are less common but relevant if your AI processes financial transactions or personal data at scale.
Bring the customer email, deadline and current evidence. We'll spend 45 minutes on your actual situation and tell you exactly what it takes — with no follow-up sequences if we're not the right fit.
Book a 45-minute working session →