Testing 1/10. No automated tests and no enforced type check.
No release gate
Nothing stopped a broken change from reaching production, and previews were using production data. An auditor testing change management would find no evidence to look at.
Vibe code audit
SOC 2 Readiness for AI-Built Startups
An enterprise buyer asked for SOC 2 and your app was built with AI tools. Before you pay an audit firm, we check your code and operations against the controls they will test, build a control matrix and rank the gaps to close. We prepare you for the audit. We do not perform it.
- Readiness only. We do not issue SOC 2 reports.
- We read source, never your production or customer data.
What is a SOC 2 readiness assessment?
A SOC 2 readiness assessment checks your product and team against the SOC 2 criteria before an auditor does. SOC 2 is a report on how a company protects customer data, issued by an independent CPA firm. Readiness finds the gaps early, while you still control the timeline and the order of the fixes.
We are not a SOC 2 auditor. We do not issue SOC 2 reports and we do not attest to anything. We prepare your product and its evidence, so you go into the audit with a licensed firm knowing where the gaps are.
SOC 2 readiness checklist: what do we check?
We check the controls that live in your code and your operations: access control, change management, monitoring and alerts, incident response, backup and recovery, vendors, data retention and secrets. For each one we record what exists, what evidence an auditor could see, and the fix when something is missing.
| Control area | What we check | Typical gap in an AI-built app |
|---|---|---|
| Access control | Database access rules tested as real user roles, multi-factor sign-in, admin access. | A private record readable by another member of the same account. |
| Change management | Release gate with tests, type check and scans, branch protection, reviews. | The build only transpiles, so errors reach production. |
| Monitoring and alerts | Alerts on failed payments, stale jobs, error rates and AI spend. | No alert fires. Users find failures first. |
| Incident response | Runbooks for failed payments, provider outages and leaked credentials. | No runbooks. Nobody knows how to replay a failed job safely. |
| Backup and recovery | Recovery objectives and evidence that a restore of the database and stored files has been tested. | Backups exist and nobody has ever restored one. |
| Vendor management | Every third party the code sends data to, compared with your policies. | The processor list does not match the integrations in the code. |
| Data retention | Retention periods and tested deletion across every store and provider. | No retention schedule for AI chat logs. |
| Secrets | Keys out of client code and git history, rotated after exposure. | Secrets exposed in git history and not yet rotated. |
Gaps come from our anonymised sample report and an anonymised production readiness audit. A runbook is a written, step-by-step procedure for a known incident.
What did a readiness check find?
In one pre-launch audit, operations and incident readiness scored 2 out of 10 and disaster recovery scored 2 out of 10. There were no runbooks, no alerting shown to fire, no recovery objectives and no rehearsed restore of the database together with file storage. Testing scored 1 out of 10.
Operations 2/10, disaster recovery 2/10: no runbooks, no alerts, no tested restore.
Operations and recovery
The app was about to collect money from families every month. A full restore of the database and receipt storage had never been demonstrated, and the in-app data export is no substitute for infrastructure recovery. From our anonymised sample report.
Sample report based on a real audit. Client details and figures changed.
Get the sample report1625 tests passed. Backups, restore drill and alerts were still unverified.
Strong tests, unverified operations
A Next.js and Supabase business platform had mature code and a large test suite. Backup and point-in-time recovery state, a restore drill and alerting still had to be proven outside the repository.
What do I get from a SOC 2 readiness review?
For fintech, health and HR products, the vibe code audit report comes with a SOC 2 control matrix: each relevant control, its status in your code and operations, the evidence that exists, and the fix for each gap. A licensed CPA firm still performs the SOC 2 audit itself.
Audit
A senior engineer reviews the code across 8 areas with read-only access.
Control matrix
For fintech, health and HR products: each control mapped to what exists in the code and operations, with the gap and the fix.
Fix plan
Gaps ranked by priority, with a fixed-price quote for the work you want us to do.
Debrief
A call to walk through the matrix and decide what to close before you engage an audit firm.
Are you a SOC 2 auditor?
No. Only a licensed CPA firm can perform a SOC 2 audit and issue a SOC 2 report. We do readiness: we find the gaps in your code and operations, build the control matrix and help you close the gaps. When you are ready, you engage an audit firm of your choice.
How much does SOC 2 readiness cost with us?
Our part starts with the vibe code audit, from $199 at a fixed price. For fintech, health and HR products it comes with the SOC 2 control matrix. Closing the gaps is quoted at a fixed price after the audit. The fee for the SOC 2 audit itself is set by the audit firm you choose.
Frequently asked questions
SOC 2 stands for System and Organization Controls 2. It is a reporting framework from the AICPA, the American Institute of Certified Public Accountants. An independent CPA firm tests a company against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy, and then issues the report.
No law requires SOC 2. Enterprise buyers, banks and partners often ask for it before they sign or share data, so in practice it becomes a sales requirement. If nobody has asked yet, a readiness review tells you how far you are, so the request does not stall a deal.
A startup needs SOC 2 when its customers ask for it, usually when selling to larger companies or handling their data. Before that, readiness work still pays off: access rules, backups, alerts and a release gate are what a product that holds customer data needs anyway.
A readiness review finds and closes gaps before the audit, and anyone qualified can run it. The SOC 2 audit itself is performed by a licensed CPA firm, which tests your controls and issues the report. We do the readiness part only, and we tell you plainly what an auditor will look for.
A customer asked for SOC 2?
Book a 30-minute call. Tell us who asked and what the app does, and we will tell you what the readiness review covers.
Prefer to talk?