🧱 SOC 2 Readiness
Purpose: surface what we already do that maps to SOC 2 Trust Services Criteria, what's missing, and what the realistic path looks like. Meant for internal use before engaging Vanta / Drata / an auditor.
What SOC 2 actually buys
- Credibility with B2B buyers, coaching academies, federation partners.
- A structured excuse to formalise controls that we informally already do.
- Shortens security questionnaires from clients by 80%.
What SOC 2 does not buy
- GDPR compliance (separate regime, but substantial overlap).
- Better security on its own — SOC 2 is documentation of controls, not a magic shield.
- Fast turnaround. Expect 3–6 months to a Type I, 6–12 months to a Type II.
Trust Services Criteria — where we stand
Rough self-assessment. 🟢 in place · 🟡 partial · 🔴 missing.
Security (CC — Common Criteria, mandatory for all SOC 2)
| CC | Control | Status | Evidence / gap |
|---|---|---|---|
| CC1.1 | Board / leadership demonstrates integrity + ethical values | 🟡 | Values documented informally; need a signed Code of Conduct |
| CC1.2 | Governance structure with oversight | 🟡 | Small team; governance is implicit. Doc it. |
| CC2.1 | Information security policy | 🔴 | No formal InfoSec policy yet — draft required |
| CC2.2 | Internal comms re: security | 🟢 | Slack #security channel, on-call rota |
| CC2.3 | External comms (customers, regulators) | 🟢 | dpo@, privacy@, accessibility@ live |
| CC3.1 | Risk assessment process | 🟡 | DPIA exists for privacy risk (compliance/dpia.md); need broader security risk register |
| CC3.2 | Identifies + analyses risk (fraud, IT) | 🔴 | Not formal yet |
| CC4.1 | Ongoing monitoring | 🟡 | Firebase + Google Cloud logging; no SIEM / alerting runbook |
| CC5.1 | Logical + physical access controls | 🟢 | IAM on Firebase; no physical offices to secure |
| CC6.1 | Logical access — authentication | 🟢 | Firebase Auth; Sign in with Apple; 2FA on all admin accounts |
| CC6.2 | Prior to issuing credentials | 🟢 | Developer onboarding checklist (informal) — needs formalisation |
| CC6.3 | Access to data / functions | 🟢 | Firestore + Storage rules; Cloud Function admin isolation |
| CC6.6 | Transmission + disposal of confidential info | 🟢 | TLS 1.3 everywhere; Storage objects age-out at 30 days |
| CC6.7 | System boundaries | 🟡 | Architecture doc at architecture/overview.md — needs a security-boundary overlay |
| CC6.8 | Malware protection | 🟢 | N/A for server-side Cloud Functions; macOS devs use XProtect; no Windows machines |
| CC7.1 | Threat detection | 🟡 | Firebase App Check available but not enforced on all callables |
| CC7.2 | Incident response | 🟢 | compliance/breach-response.md is the runbook |
| CC7.3 | System monitoring | 🟡 | Basic Cloud Logging; no uptime pager for non-prod alerts |
| CC7.4 | Incident recovery | 🟡 | Backup strategy relies on Firestore point-in-time recovery; not tested |
| CC7.5 | Security reviews | 🔴 | No recurring pen-test / security review cadence |
| CC8.1 | Change management | 🟡 | Git + PR reviews; no formal change-advisory log |
| CC9.1 | Risk mitigation (identified risks) | 🟡 | Tracked in commit history; needs a risk register |
| CC9.2 | Vendor + sub-processor oversight | 🟡 | Sub-processor DPAs in flight (see compliance/dpas/) |
Availability (optional category — relevant for subscription SaaS)
| Criterion | Status | Gap |
|---|---|---|
| A1.1 Capacity planning | 🟡 | Firebase auto-scales; RunPod pods autoscale; no documented capacity model |
| A1.2 Recovery objectives (RTO / RPO) | 🔴 | Not defined |
| A1.3 Recovery testing | 🔴 | Not performed |
Confidentiality
| Criterion | Status | Gap |
|---|---|---|
| C1.1 Classification + restriction | 🟢 | Data classification implicit in Firebase rules + compliance docs |
| C1.2 Disposal | 🟢 | 30-day Storage aging + account-deletion cascade via deleteUserDocument |
Processing Integrity + Privacy
- Processing Integrity: not a priority target — our processing is not financial / transactional in the way SOC 2 PI intends.
- Privacy: largely covered by the GDPR alignment and our privacy docs. If a customer asks for SOC 2 Privacy, we'll layer it on.
Gap remediation plan
Ordered by effort × impact.
- Formal InfoSec policy (CC2.1) — 1-day doc, blocks several downstream items.
- Security risk register (CC3.1 + CC9.1) — spreadsheet / Notion; quarterly review.
- Code of Conduct + acknowledgement (CC1.1) — short doc, signed on hire.
- Change management log (CC8.1) — GitHub issue template + release-notes discipline.
- App Check enforcement on all
https.onCallendpoints (CC7.1) — minor code change. - Backup + recovery test (A1.3 + CC7.4) — one scheduled exercise; document results.
- Security review cadence (CC7.5) — either annual pen-test (~$8–15k) or quarterly Dependabot + advisory review (free).
- SIEM / alerting on Cloud Logs (CC4.1 + CC7.3) — lightweight: Cloud Logging log-based metrics → alerting policies.
Engagement path (when ready)
- Pick a compliance automation platform: Vanta ($12–20k/yr), Drata ($15–25k/yr), Secureframe, or Thoropass. They connect to Firebase + GitHub + 1Password + Slack and auto-collect evidence.
- Remediate gaps over 1–3 months using the platform's checklist.
- Engage a CPA firm for the attestation: PrescientAssurance, Sensiba, A-LIGN, Barr Advisory. Expect $8–25k for Type I.
- Type I → Type II transition: six months of operational evidence = Type II readiness.
Current posture
- Ready for a security questionnaire: yes — could answer 80% of a typical SaaS DDQ today from the docs in this directory.
- Ready for a SOC 2 Type I attestation: no — ~6–8 weeks of remediation + platform setup needed first.
- Should we start now: only if there is a specific B2B sale gated on SOC 2. Otherwise keep the readiness doc fresh and pull the trigger when revenue justifies the ~$25–45k first-year spend.
Approver sign-off
| Role | Name | Decision | Date |
|---|---|---|---|
| Founder / CEO | (to assign) | — | — |
| Eng Lead | (to assign) | — | — |
Draft — not yet approved.
Was this page helpful?