Short answer: pick one place to hold your controls, policies and evidence, connect the systems you already use so the evidence collects itself, close the gaps the readiness score shows, and then hand a clean record to an accredited auditor. Safeguard offers SOC 2 Type II for startups at USD 1,699 a year for companies under 10 people; audit fees separate.
Why this gets stuck
A customer's security team sends a questionnaire, then asks for your SOC 2 report before it will sign. You have no compliance lead. The evidence is in a dozen places: your cloud console, your identity provider, your code host, your ticketing tool, a folder of screenshots. Policies exist in someone's head or in an old document. The deal waits while you work out where to begin.
The fix is not working harder at the spreadsheet. It is making the evidence a by-product of the systems you already run.
The steps
- Decide the scope. SOC 2 covers the systems that hold or touch customer data. List them: cloud accounts, identity provider, code hosts, ticketing, device management, and the vendors that process your customers' data. Keep the list short and honest.
- Choose a single workspace for controls and evidence. Switching on the SOC 2 framework gives you the controls, the requirements a scan can check, and policy templates to adapt. You see which controls pass, which wait for evidence and which fail.
- Connect your systems. Link your cloud accounts, identity provider and code hosts. Automated tests then run against them and attach the result to the matching control. Connectors listed in the docs include Google Workspace, Google Cloud, GitLab, Jira and Cloudflare.
- Adopt policies you will actually follow. Start from templates for access control, incident response and vendor risk, then edit them to match how your team works. An auditor tests whether you follow your own policy, so a short policy you follow beats a long one you ignore.
- Attest what a scan cannot see. Some requirements need a person: a completed onboarding checklist, an access review, a training record. Attach the evidence and name the person who attests it.
- Keep a risk register and a vendor register. Record the risks you have identified and who owns them. List the vendors that touch customer data and what you checked about each.
- Watch the readiness score, and read it correctly. It is the share of in-scope requirements that pass. It is an assessment of what Safeguard can see, not an audit opinion, so treat it as your to-do list.
- Engage an auditor. The audit itself is a separate engagement with an accredited firm. The audit is arranged through an accredited auditor network and billed separately. Audit fees are separate from the subscription, and software and evidence stay in one place.
- Publish a Trust Center. Once you have a report, a Trust Center lets customers request it and see your posture without a long email thread.
What a Type II audit is looking for
A Type I report describes whether your controls are designed properly at a point in time. A Type II report covers whether they operated effectively over a period. That is why continuous evidence matters. A screenshot taken the week before the audit does not show that a control ran every month, while automated tests that run all period do.
Plan for the period to be part of the work. Start collecting evidence as soon as the controls are in place, and do not wait for the audit engagement to begin.
What Safeguard does
Safeguard puts the SOC 2 framework, controls, policy templates, evidence collection, continuous tests, questionnaires, risks, vendors and a Trust Center in one workspace. The same subscription also covers application and supply-chain security, so the tool that helps you pass the audit also scans the code you ship.
The price is public. It is USD 1,699 a year for companies under 10 people; audit fees separate. Above ten people the standard plans apply, which you can see on the pricing page. Safeguard helps you produce evidence and map controls. It does not make an organization compliant by itself, and the readiness score is not an audit opinion.
Download
Download the datasheet, US Letter (PDF)
Download the datasheet, A4 (PDF)
It is two pages: the problem, what it does, how it works, the capabilities, the inputs and outputs, and how data is handled.
