Please share your SOC 2 report

Infinia · 2026-10-26

The enterprise deal is almost done. The champion loves the product. Legal has the contract. Then procurement sends one line:

"Please share your SOC 2 report."

If you run an AI-native company at $1M to $10M ARR, there's a good chance this is the moment you find out nobody on your team owns security.

Not because your engineers are careless. Because security has been everyone's side job, and SOC 2 doesn't grade side jobs. It grades whether someone owns the controls, and whether you can prove they worked.

Here's our position:

SOC 2 is not a compliance project. It's a leadership gap with a deadline attached.

And for most companies your size, the right person to close it is a fractional CTO, not a full-time hire and not a tool on its own.

What SOC 2 actually is

SOC 2 is an audit framework from the AICPA. An independent CPA firm checks whether your company has controls in place to protect customer data, against a set of criteria. Security is always included.

Availability, confidentiality, processing integrity and privacy can be added depending on what your customers care about.

There are two kinds of report:

• Type I says your controls were designed properly at one point in time.
• Type II says your controls actually worked over a period of time, usually several months.

Enterprise buyers increasingly want Type II.

Which means the clock that matters isn't "how fast can we write the policies." It's "how long until we have months of evidence that we followed them."

That's the part founders underestimate. The auditor doesn't want intentions. They want evidence.

Why tools alone don't get you there

Compliance automation tools are genuinely useful. They connect to your cloud, your code repository and your HR system, collect evidence, flag gaps and give you policy templates.

But a tool can't make the decisions an auditor will ask about:

• What's in scope. Which systems, which data, which environments. Scope too wide and you audit things you don't need to. Too narrow and the report doesn't cover what the customer cares about.
• Who gets access to production, and how that access is granted, reviewed and removed.
• How you handle an incident. Not the template. What actually happens at 2am, and who decides.
• How changes reach production. Code review, approvals, the hotfix someone pushed on a Friday.
• Which vendors touch customer data, and whether you've assessed them.

A template policy that doesn't match how your team really works is worse than no policy. It's a written promise you're about to be audited against.

Someone has to make those calls, make them true, and own them when the auditor asks.

The AI-native problem: where does the data go?

For AI companies, there's an extra layer every security reviewer now asks about.

Where does our data go? Is it used for training? Who are your subprocessors?

If your product sends customer data to a model provider, that provider is part of your security story. Reviewers want to know:

• which model providers you use, and under what data terms,
• whether customer data is retained by the provider, and for how long,
• whether it can be used for training,
• whether prompts and outputs are logged on your side, and who can read those logs,
• what happens when you switch models.

One security vendor that works with SaaS founders put the reviewer's view bluntly:

"A response that says an AI capability runs on a provider API rarely clears that review."

"The reviewer needs named systems, accountable owners, and records they can inspect."

If the honest answer today is "let me check with the engineer who set that up," the deal slows down. And deals that slow down in procurement have a habit of not restarting.

What a fractional CTO actually owns

This is the job. Not writing policies for a binder, but making them true:

1. Set the scope so you audit what customers need, and nothing you don't.
2. Fix access and logging before the observation period starts, not during it.
3. Map how customer data flows through your product and your model providers, and put the data terms in writing.
4. Pick the auditor and the tooling, and run the readiness work so the audit has no surprises.
5. Answer the security questionnaire that arrives while the audit is still in progress, so a deal doesn't wait three weeks for a reply.
6. Stay in the room when the auditor asks questions, so your best engineer isn't pulled off the roadmap for a month.

None of that needs someone 40 hours a week. It needs someone who has been through an audit before, knows which controls matter for a company your size, and will own it for a few days a month until the report is in hand.

"Can't my lead engineer just do it?"

Sometimes. Here's the honest test.

Your lead engineer can probably do it if they've been through a SOC 2 audit before, have the authority to change how the team works, and you're comfortable with them spending a meaningful share of their time on it for several months.

If any of those is a no, you're trading roadmap for compliance, and usually getting less of both. That's the gap a fractional CTO fills: senior ownership of security and architecture, without taking your best builder off the product.

When you don't need this

• No customer is asking yet. If you sell self-serve to small teams and nobody has requested a report, focus on good security habits and revisit when the first enterprise deal shows up.
• You already have a technical leader who has done this before and has the time. Give them the budget and get out of the way.
• You only need to answer a questionnaire, not pass an audit. That's a smaller job. You may need a few hours of help, not an engagement.

Three questions to answer this week

1. If a customer asked for your SOC 2 report tomorrow, who on your team would own the answer?
2. Can you list every model provider and vendor that touches customer data, and the data terms for each?
3. If an auditor asked who has production access and why, could you show them, today?

If you can't answer all three, security isn't an engineering problem. No one owns it yet.

If a SOC 2 request is about to land, or just landed, we'll introduce you to one fractional CTO who has taken companies like yours through an audit. Free: infinia.fun/for-businesses/intake

Quote source: DeepInspect, "For B2B SaaS founders" (deepinspect.ai/blog/for-b2b-saas-founders), a security vendor's guidance on AI security reviews.