SOC 2 compliance
Get your SOC 2 without the guesswork
Scope it correctly, collect the evidence from your systems, and hand your auditor what they actually asked for.
What SOC 2 is
SOC 2 is a report produced by an independent auditor describing how your company handles customer data. It is not a certification and there is no certificate, you receive an attestation report, which is what your enterprise buyers are asking for when they say they need "your SOC 2."
The report covers up to five trust services categories. Security, built on the common criteria, is required. Availability, confidentiality, processing integrity, and privacy are optional, and you add them when your customers or your commitments call for them.
A Type I report describes whether your controls are designed appropriately at a point in time. A Type II report describes whether they actually operated over a period, usually three to twelve months. Buyers who know the difference want Type II.
Who needs SOC 2
You're selling software to companies in the United States and one of them has sent a security questionnaire. You've reached the deal size where procurement gets involved. Or your existing customer's renewal now requires it.
How TrustLynce helps with SOC 2
Scope the report
Decide which trust services categories apply and which systems are in scope, with exclusions recorded and justified.
Collect the evidence
Configuration, access lists, and system state pulled from your connected systems continuously across the observation window.
Monitor through the window
Type II covers a period, not a day. Controls are tested throughout, so a failure in month two is caught in month two.
Hand off to your auditor
Evidence exported with source attribution and timestamps, in the structure audit firms expect.
What the audit actually involves
Almost no competitor writes this down. Knowing the shape of it is most of what makes a first audit survivable.
You choose an independent CPA firm
An independent CPA firm performs the audit, not TrustLynce, and not any compliance platform. You choose the firm.
They select an observation period
For Type II they select a period to observe, typically three months for a first report.
They sample your evidence
During the window they sample your evidence: not every access review, but several, chosen by them. They will ask how you know a control operated, which is why evidence needs a source and a date rather than a screenshot.
You receive a report to share
The output is a report you share under NDA with buyers who ask.
SOC 2 questions
It depends on your starting point and the observation window your auditor sets, commonly three months for a first Type II. We can't quote a timeline for your company without seeing your systems.
If a customer is waiting, Type I demonstrates your controls are designed correctly and is faster. Type II is what most buyers ultimately want. Many companies do Type I then Type II.
No. Only a licensed CPA firm can. We prepare the evidence and connect you with audit firms.
Audit fees go to the audit firm and are separate from trustlynce. They vary with scope and firm.
No, but someone must own it. The platform collects evidence and identifies gaps; fixing them is engineering work.
You'll see it when it happens. Failures during the observation period are discussed with your auditor, remediated promptly with evidence is a very different conversation from discovered at the end.
Other frameworks
Evidence collected for one framework carries into the next.
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
CCPA / CPRA
California comprehensive privacy
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.