Compliance is a sales problem before it is a security problem.
A customer's security review wants proof that your controls exist and are being run. We get software companies ready for a SOC 2, ISO 27001 or ISO 42001 audit, and leave behind a company that runs the way its policies say it does. We prepare you for the audit. We don't perform it.
SOC 2
The report your customers' security teams ask for
An independent auditor's report that your controls meet the AICPA Trust Services Criteria. It's what most North American enterprise customers ask for, and most long security questionnaires are its criteria in disguise.
Answer it once, properly, and the next questionnaire takes an afternoon.
Book a call about SOC 2Type I
Your controls are designed and in place on a date. Usually first: most customers accept it with a Type II date on paper.
Type II
Your controls ran as designed over an observation window, typically three to twelve months.
What you get
- Policies your team will actually follow Written around how you already work, not a template pack nobody reads.
- Access that matches who's on the team New hires get what they need on day one, people who leave lose it the day they go, and someone checks it on a schedule.
- A record of who changed what Changes to code and infrastructure are reviewed and logged as part of how your engineers already ship.
- Weak spots dealt with as routine Vulnerabilities patched on a schedule, the suppliers who hold your data checked, and the whole team trained to spot what looks wrong.
- Proof that builds up as you work The evidence an auditor asks for, gathered in your compliance platform or a simple evidence pack, not a scramble the week before.
- An audit you're ready for We help you pick the auditor, brief them, and stay with you through their questions.
ISO 27001
The certificate European and public-sector buyers expect
Certification against the international standard for an information security management system. It's usually what a European or public-sector customer asks for.
Most of the control work overlaps with SOC 2, so doing one makes the other a smaller job.
Book a call about ISO 27001Customers asking for both? One set of controls can serve both. We'll say which to do first.
A certificate, not a report
An accredited certification body certifies you against the standard. SOC 2 ends in an attestation report instead.
A three-year cycle
A two-stage certification audit, then a surveillance audit in each of the next two years.
What you get
- A clear picture of your risks What could go wrong with your information, how likely it is and what you're doing about it, written down and kept current.
- One document that answers "which controls apply?" Every control the standard lists, which ones you use and why. Auditors and customers both ask for it.
- Security that fits how you work Policies, people controls and engineering controls built around your team, so they hold after we leave.
- A dress rehearsal before the real audit An internal audit and a leadership review find the gaps before the certification body does.
- The right certification body We help you choose one, then hand over with the evidence in order.
ISO 42001
The certificate for how you build and use AI
Certification against ISO/IEC 42001, the international standard for an AI management system: how a company decides where it uses AI, assesses the risks and the impact, and keeps people accountable for what it does. It's what customers are starting to ask AI vendors for.
It's built on the same management-system structure as ISO 27001, so it extends an information security program rather than sitting beside it.
Book a call about ISO 42001Already have ISO 27001? We extend the management system you run, rather than start a second one.
Impact, not just risk
Beyond the risks to your company, it asks what each AI system could do to the people and groups it touches, and what you do about it.
Pairs with ISO 27001
The same clauses and the same audit cycle, so one internal audit and one management review can cover both.
What you get
- A straight answer to "how do you use AI?" An AI policy your leadership signs off, with a clear line around what it covers.
- No AI running that nobody knows about A list of the AI you build and the AI tools your people use.
- Risks and harms thought through before launch Each AI system checked for what it could get wrong and who it could affect, with the decision written down.
- A team that knows the rules An AI operating standard people can follow, and a record that they've been trained on it.
- One document that answers "which controls apply?" The standard's AI controls, which ones you use and why.
- A dress rehearsal before the real audit An internal audit and a leadership review find the gaps before the certification body does.
What companies ask before they start
What is the customer's security team actually asking for?
Proof that the controls behind your product exist and are being run: access reviews, change management, logging, offboarding, with a record that it happened. A policy written last week isn't a control. Most long security questionnaires are the SOC 2 criteria in disguise, so answering them properly once makes the next one an afternoon's work.
Do we need SOC 2, ISO 27001 or both?
It depends on who's asking. North American enterprise customers mostly ask for SOC 2. European and public-sector customers mostly ask for ISO 27001. The control work overlaps heavily, so one set of controls can serve both. Tell us what the customer asked for and we'll say which fits, or which to do first.
We have ISO 27001. Do we need ISO 42001 too?
Only if customers are asking how you govern AI. ISO 27001 covers information security. It doesn't ask how you assess an AI system's impact or who answers for what it does. ISO 42001 adds that on the same management-system structure, so it extends the system you already run rather than starting a second one.
How long does it take?
Usually two to three weeks to a written gap assessment and a realistic date, then three to four months to be ready for the auditor. The assessment is a fixed fee, quoted up front.
Is it worth doing before a customer asks?
Often, yes. A first SOC 2, ISO 27001 or ISO 42001 puts structure around access, change management, onboarding and offboarding while the team is small enough for that to be easy, and the report or certificate is ready before the first questionnaire arrives. If it's early for you, we'll say so.
Do you do the audit?
No. The firm that audits you can't also design and build your controls — independence rules — so the build is a separate job. You hire and pay the auditor directly. We help you shortlist firms, compare their quotes and brief the one you choose.
We use Vanta or Drata already. Do we still need this?
Usually less of it. A platform collects evidence. It doesn't decide what your controls are, write the policies or run your access reviews. If a platform saves you time we'll say which and why.
What about the AI questions in the questionnaire?
They're arriving. The SIG's AI questions now reference ISO/IEC 42001, and some customers' reviews now ask for an AI usage policy and a training record. The readiness work writes the AI operating standard and sets up the record, so those questions stop being a surprise. If a customer wants a certificate rather than answers, that's ISO 42001.
Tell us what the customer is asking for
Thirty minutes is usually enough to say which of SOC 2, ISO 27001 and ISO 42001 fits, and what getting ready would take.
An audit firm with a client who isn't ready yet? Refer them to us