Get SOC 2 compliant.Audited by an independent CPA firm.

Sign up and answer the intake. There is nothing to pay and no card to enter. When you submit it you get a readiness score out of 100, the tier that score lands in, how many of the controls scored are already passing, every gap category with exact counts of what needs remediating and what needs evidence, and two or three of your own findings written out in full with what closing each one takes. It also tells you exactly how many findings are in the rest of your report. The score lives in your account and recomputes whenever you change an answer. What it is not is a document you can download and take elsewhere: the full written gap list and the remediation tooling come with an entry payment, and you can ask for a readiness review from your results page, where you name the times that suit you and a member of the team confirms one within a business day.

The assessment is free. Then most teams pay $2,000 once to get audit-ready, and start SOC 2 Type 2 at $600 a month on a 12-month term, or $6,600 paid up front for the first 12 months. Your first SOC 2 Type 2 audit is included in the term, so the first year all in is $9,200 with a Type 2 report at the end. If you need a SOC 2 Type 1 report sooner, add the Type 1 examination for $2,000 more, auditor engagement fee included, at checkout or any time before your Type 2 starts; that makes the entry $4,000 and the first year $11,200.

The whole 12 months, on both sides. You are committing to the full term rather than to a month at a time, and across it we are committing to keep you audit-ready: continuous evidence collection, guided monthly check-ins, drift alerts when a control slips, and your first SOC 2 Type 2 audit, which starts on its own once the 3-month observation period completes and carries no separate auditor invoice. Pay it as $600 a month or settle it up front as one $6,600 invoice; the commitment is identical either way and paying up front is the cheaper of the two. The exact terms are in the Terms of Service, and you accept them in writing before the first charge.

Type 1 proves your controls are designed correctly at a single point in time. You can get one starting at about a week, and enterprise buyers usually accept it to unlock a deal. Type 2 proves your controls actually worked over an observation period. cybersoftware locks your first Type 2 observation at 3 months, the minimum first-year window under SOC 2, so customers reach their first Type 2 audit on a predictable schedule. The subscription runs continuously during and after that window on a 12-month term, and the audit at the end of the first window is inside it.

When you choose. Step 1 has no clock: work through your gaps and policies at your own pace. Once your package is built you start SOC 2 Type 2 from your dashboard whenever you are ready, and the 12-month term and the 3-month observation window begin that day. Your first Type 2 audit starts on its own when the observation window closes, and it is included in the term.

Yes. Add the SOC 2 Type 1 examination for $2,000 more, auditor engagement fee included, at checkout or any time before your Type 2 starts. Your package goes to an independent partner auditor as soon as it is built, and once the Type 1 report is issued you can still start Type 2 whenever you are ready.

Type 1 goes audit-ready starting at about a week of focused work. Intake takes about 15 minutes for the half that returns your score, and the rest can wait. Evidence upload and remediation depend on how prepared you are, but the platform tells you exactly what is needed and tracks progress live. Once you hit 100 percent, auditor review typically takes a few business days. Type 2 then runs on top, quietly, through its observation window.

They are independent partner auditors, licensed U.S. CPA firms. cybersoftware is not a CPA firm and does not issue the opinion. The specific firm on your engagement is disclosed to you on request before you sign the engagement letter, so you can verify their credentials with the state board. If you already work with a CPA firm that meets AICPA independence requirements, we can onboard them.

The industry had a recent high profile scandal where a venture backed compliance platform was caught producing hundreds of SOC 2 reports with identical boilerplate and pre written auditor conclusions. We built the opposite. Our gap analysis is a deterministic rules engine, not AI. Policies are generated from your data and fail loudly rather than fabricating claims. Examinations are performed by independent partner auditors with no referral fees. Every report is unique because every company is different. See the ethics section above for the full architecture.

Your data stays in the pipeline. The AI we use to draft policies processes information to generate output but does not store or train on it. Evidence files are encrypted at rest in S3 with presigned URLs, and only you and your assigned auditor can access them. Each engagement is isolated. No cross customer learning.