Free · no signup

How SOC 2-ready are you?

Fifteen plain-English questions across the controls that actually sink seed-stage companies. Get a readiness score and the exact gaps to close first — before you pay a consultant to find them.

Access control

Is MFA required for all employees on email, code hosting, and cloud?

Do you use SSO / a central identity provider instead of per-app passwords?

When someone leaves, is their access revoked the same day, by a documented process?

Is access least-privilege — no shared admin logins, people only have what their role needs?

Change management

Does code require review (an approved PR) before it merges to production?

Is there a record of what shipped and when (a deploy history)?

Vulnerability management

Do you scan your code and dependencies for vulnerabilities?

Do you fix critical/high vulnerabilities within a defined time window?

Do you scan your cloud configuration for misconfigurations?

Monitoring

Do you collect and retain logs from your app and cloud?

Would you be alerted if something broke or someone accessed something they shouldn't?

Data & vendors

Do you know which third-party vendors / sub-processors touch your customer data?

Is customer data encrypted at rest and in transit?

Governance

Do you have written security policies your team acknowledges?

Is there a named person accountable for security?

0/15 answered