Get audit-ready without hiring a compliance team
Enterprise buyers, marketplaces, and partners now ask for SOC 2 or ISO 27001 before they sign. We build the program, the policies, the controls, and the evidence trail, so you walk into the audit ready. Everything we build stays yours.
Where compliance gets stuck
- A customer security questionnaire is holding up a deal, and you do not have good answers yet.
- A marketplace or partner wants a data protection policy and proof that you follow it.
- Your policies live in a folder nobody reads, and nobody can show they are followed.
- Compliance platforms want a yearly contract before a single control is in place.
- Nobody on the team knows what an auditor will actually check.
- You have backups, but nobody has tested a restore.
Four ways we help
Readiness Assessment
Two weeks to find out exactly where you stand against SOC 2 and ISO 27001, with a ranked plan, timeline, and budget.
SOC 2 Compliance Prep
Scoping, policies, controls, and an evidence system you own, through your Type I audit.
ISO 27001 Compliance Prep
A working ISMS, risk treatment, Statement of Applicability, and Stage 1 and 2 support.
BCDR Planning and Implementation
Recovery targets, tested backups, runbooks, and a tabletop exercise, so an outage is a bad day, not a lost month.
Built by people who run the program themselves
The same program we run
We built and run a SOC 2 and ISO 27001 program for our own SaaS products. The controls we set up for you are ones we operate every day.
No platform required
Policies, controls, and evidence live in the tools you already use: your cloud, Google Workspace or Microsoft 365, and your code host. If you already pay for Vanta or Drata, we work inside it.
Built, not just written
We configure the controls ourselves: single sign-on and MFA, logging and alerts, backups, access reviews, and change management.
One team for both frameworks
SOC 2 and ISO 27001 overlap heavily. Do SOC 2 with us first and ISO 27001 prep drops to $12,000.
Written and fixed
Fixed prices, a dated written plan, and progress in writing. No sales calls.
You keep everything
Policies, runbooks, and evidence stay in your accounts. Nothing is locked in our tools.
Questions we get
Are you the auditor?
No. SOC 2 reports are issued by licensed CPA firms, and ISO 27001 certificates by accredited certification bodies. We prepare you, help you choose an auditor, and support you through the audit. Auditor fees are separate and paid to the auditor.
Which one do I need, SOC 2 or ISO 27001?
Most US buyers ask for SOC 2. ISO 27001 is more common in Europe and with global enterprises. If you are unsure, the readiness assessment covers both and tells you which one your customers will expect.
How long does it take?
About 8 to 12 weeks to SOC 2 audit-ready and 10 to 14 weeks for ISO 27001, depending on what is already in place and how quickly your team can review policies.
Is Broke Hold SOC 2 or ISO 27001 certified?
Not yet. We run a SOC 2 and ISO 27001 program for our own products, the controls are in place, and we are collecting the evidence for our audits. We will post the results on our Security page when the audits are complete. We never claim a certification we do not hold, and we will not let you either.
Tell us what is being asked of you
Send the questionnaire, the customer request, or a short note on where you are. You will get a written answer within one business day: what you need, how long it takes, and what it costs. No calls needed.
- Written reply within one business daySpecific to your store, with a price.
- No calls neededScope, price, and kickoff all happen in writing.
- NDA on requestYour data and numbers stay private.