Can I get SOC 2 without a compliance platform?

There are three realistic routes for a small company: spreadsheets, a low cost tool you run yourself, or a big platform sold through a sales team. We sell the middle one, so weigh our view with that in mind. We will still tell you plainly when either of the other two is the better choice for your situation.

Route one: spreadsheets and a shared drive

This is the oldest way to do it and it still works. You pick the Trust Services Criteria in scope,³ write a control against each, draft the policies, and collect evidence into folders an auditor can follow. The cash cost is close to nothing until the audit.

The cost is attention. Someone has to own it, often the most senior engineer, and the hours come out of product work that would otherwise ship. Policies are the slow part, because each one has to describe what your company really does rather than what a template assumes. So is keeping evidence current once the first burst of energy fades.

With a consultant

Some teams hand the spreadsheets to an outside expert who has done this before. That saves hours and spends money, sometimes more money than a platform would have cost. Here is one published range for that kind of help.

• Comp AI states that a vCISO or compliance consultant might charge $150 to $400 an hour, which can total $20,000 to $50,000 for a full SOC 2 prep engagement. Source, checked 2026-07-30.

Route two: a self-serve tool

This is the route we built. You still do the work. The software gives you the structure: policy drafts, a control list mapped to the criteria, evidence tracking and a gap list that says what is still missing. It is the spreadsheet route with the blank page taken away.

Our software is $199 a month, cancel any time, or $2,189 a year, pay for eleven months, get twelve. When you want the SOC 2 report, audits come with access to our preferred pricing program, and you see the price in your account before you book. With a focused team, the target is audit-ready starting at about a week.

Route three: a big platform

The large platforms do everything route two does and a great deal more. Wide integration catalogs, many frameworks, account managers. They sell through a sales team, and the contracts reflect that. Here is what buyers reported paying through one procurement marketplace.

• Vendr reports a median annual contract value of $20,000 for Vanta, based on purchases completed through its marketplace. Source, checked 2026-07-30.
• Vendr reports a median annual contract value of $24,601 for Drata, based on purchases completed through its marketplace. Source, checked 2026-07-30.
• Vendr reports a median annual contract value of $20,000 for Secureframe, based on purchases completed through its marketplace. Source, checked 2026-07-30.

Those are subscription figures. The audit comes on top. For a company of a hundred people and several frameworks, that can be money well spent. For a company of eight, most of it pays for depth nobody will open.

The three routes on one page

These are the rows that matter to a small team. Where a figure is not ours, it stays in the sourced lists above rather than in a cell, so every number you see can be traced.

The audit is its own bill on every route

Software does not sign anything. A licensed CPA firm examines your controls and issues the report,² and it bills for its hours. Hours go down when evidence arrives complete and labeled. That is true whichever route produced it.

Two published sources are worth reading here. One gives an hours floor. The other is a warning about low fixed audit fees, which applies to our model, so we show it to you.

• One published practitioner breakdown puts a Security-only Type 2 at 60 to 80 auditor hours, at partner rates of $250 to $350 per hour and staff rates of $100 to $175, giving a stated floor near $9,000. Source, checked 2026-07-30.
• Linford and Company warns buyers to be careful when a compliance tool has a partner audit firm with a set fee far below other bids, citing a case where one firm issued the same form report to every client with only the names changed. Source, checked 2026-07-30.

Audits through our preferred pricing program can come in under that floor for a plain reason. The software does most of the work, so the auditor only has to verify evidence that arrives prepared. We negotiate the fee on your behalf. Still, check any firm yourself. Get the name in writing, look up its license with the state board,⁴ and read whether a low-priced audit can be legitimate.

How to choose

Answer three questions honestly, ideally in writing and with whoever will own the work in the room. The route mostly picks itself after that, and none of the answers depend on which vendor you happen to like or which one called you first.

Is a deal waiting on the report?

If yes, elapsed time is the problem, and spreadsheets are the slowest route. A tool or a platform will get you there sooner. Our page on SOC 2 with a deal deadline covers the timing.

Who owns the work?

Name one person with protected hours each week. If you cannot, do not start on spreadsheets, because a project that belongs to everyone a little will stall at the policies and restart from nothing a quarter later.

How big is the scope?

One product, one cloud, a few people and Security only? Any route works, and the lower-cost ones win. Many systems and many frameworks? That is where a big platform earns its price.

A sensible next step

Whichever route you lean toward, first find out how far away you are. Our free readiness assessment takes about 15 minutes and gives you a gap list you can use on any route, spreadsheets included. Every cost line is on the SOC 2 cost page, and our plans are on the pricing page.