Walk into your SOC 2 audit ready
We scope your audit, write the policies, configure the controls in the tools you already use, and set up an evidence trail an auditor can follow. Then we help you pick the auditor and stay with you through the Type I audit.
$18,000 fixed, about 8 to 12 weeks to audit-ready. Auditor fees are separate.
Everything an auditor will look for
Scoping
The systems, people, and Trust Services Criteria in scope. Security always, plus Availability or Confidentiality only if your customers need them.
Risk assessment
A written risk assessment and treatment plan, reviewed with you.
Policy set
Information security, access, change management, incident response, vendor management, and the rest, written for how you actually work.
Controls configured
Single sign-on and MFA, least-privilege access, logging and alerts, encryption, backups, and code review rules, set up in your tools.
People controls
Onboarding and offboarding checklists, security training, and background check guidance.
Vendor management
A vendor list with risk ratings and the reviews auditors expect.
Evidence system
A simple, organized evidence trail in your own accounts. Works with Vanta or Drata if you already use one.
Auditor selection
Two or three CPA firms with quotes, and help choosing.
Audit support
Readiness check, auditor requests handled, and the start of your Type II observation window.
Two ways to start
Not sure how far you are from ready? Start with the assessment. It is credited in full toward prep.
Readiness Assessment
See where you stand first
- Gap report for SOC 2 and ISO 27001
- Ranked fix plan
- Timeline and budget
- Auditor shortlist
- Two weeks
SOC 2 Compliance Prep
Ready for your Type I audit
- Scoping and risk assessment
- Full policy set
- Controls configured in your tools
- Evidence system you own
- Auditor selection and Type I support
Scope: one product and up to about 50 people. Larger scopes are quoted in writing.
How the project runs
Scope
We agree what is in scope and the criteria you need.
Write
Policies and the risk assessment, approved by you in writing.
Build
Controls configured in your cloud, identity, code, and HR tools.
Evidence
The evidence trail set up and the first evidence collected.
Audit
Auditor chosen, readiness check, and support through Type I.
Who it is for
A good fit if
- SaaS and commerce software companies selling to mid-market and enterprise customers
- Teams of up to about 50 people with one main product in the cloud
- Companies blocked by security questionnaires or a customer deadline
Not a fit if
- You need a finished report next week (a Type I audit itself takes weeks)
- You want someone to sign off on controls they did not check (no honest firm will)
Common questions
Are you the auditor?
No. SOC 2 reports are issued by licensed CPA firms, and ISO 27001 certificates by accredited certification bodies. We prepare you, help you choose an auditor, and support you through the audit. Auditor fees are separate and paid to the auditor.
Type I or Type II?
Type I checks that your controls are designed correctly on one date. Type II checks that they worked over a period, usually 3 to 12 months. Most companies start with Type I, then move to Type II. We set you up for both.
What does the audit itself cost?
It depends on the auditor and your scope. Small companies often see Type I quotes from a few thousand dollars up to about $25,000. We get you real quotes before you commit.
Do we need a compliance platform?
No. We set up an evidence system in the tools you already use. If you already have Vanta or Drata, we work inside it.
What happens after the audit?
Controls need to keep running. Our Fractional CTO plans can own that, or we hand everything to your team with a written calendar of recurring tasks.
Is Broke Hold SOC 2 or ISO 27001 certified?
Not yet. We run a SOC 2 and ISO 27001 program for our own products, the controls are in place, and we are collecting the evidence for our audits. We will post the results on our Security page when the audits are complete. We never claim a certification we do not hold, and we will not let you either.
Get a written SOC 2 proposal
Send your website, team size, where the product runs, and any customer deadline. You will get a written proposal within one business day. No calls needed.
- Written reply within one business daySpecific to your store, with a price.
- No calls neededScope, price, and kickoff all happen in writing.
- NDA on requestYour data and numbers stay private.