Skip to content

Security-first compliance
for SOC 2

Strac Comply tracks all 61 Trust Services Criteria and tests your systems every day. AI drafts your policies, and vulnerability scanning checks your web apps. An AI vCISO answers your questions in Slack.

Start free trialBook a demo

14-day free trial. No credit card.

Read our SOC 2 guide
Trust Services Criteria
61
Trust Services Criteria
Automated tests
100+
Automated tests, run daily
Evidence base
1
Evidence base for every framework

What is SOC 2?

SOC 2 Type II

Service Organization Control 2

Security, availability and confidentiality

SOC 2 is the security audit most B2B buyers ask for. The AICPA created it.

A Type I report checks the design of your controls on one date. A Type II report checks that they worked over an observation period of 3 to 12 months.

Security is the one required category. The other 4 are optional: Availability, Confidentiality, Processing Integrity and Privacy.

How long does SOC 2 take? See the timeline

Why Strac Comply for SOC 2

Most SOC 2 tools start from the auditor's checklist. Strac Comply starts from security.

Tests run on your real systems every day, and Strac Comply's own security features add to the same evidence. Strac Comply pins every item your auditor sees to the exact version they reviewed. So next year's audit starts where this one ended.

Your engineers write code, not screenshots.

How Strac Comply runs SOC 2

Strac Comply collects evidence every day, not the week before your audit.

  • Daily tests on AWS, Google Workspace, Okta, Slack, GitHub, Jamf, CrowdStrike and more. Your evidence arrives on its own, every day

  • Strac Comply's own security features add evidence too: SaaS security tests, access reviews, and Shadow IT and AI discovery on Security-First. The Strac endpoint agent adds evidence from your laptops

  • One evidence base for every framework you run. A test or document you add for SOC 2 also counts toward ISO 27001, PCI DSS, HIPAA, NIST CSF 2.0 and more

  • Vulnerability scanning of the web apps on your own domains, on demand. It is an automated scan, not a pen test. Strac Comply files its report under your CC4.1 and CC7.1 evidence

  • An auditor portal that opens by magic link. Your auditor reviews there, never inside your account. Strac Comply pins every item to the version they saw

61 Trust Services Criteria. One evidence base.

A sample of the evidence behind the controls auditors look at first.

How long does SOC 2 take?

About 4 months

To a first Type II report. A Type I takes about 1 to 2 months.

  1. Step 1

    Get ready

    1 to 2 weeks

  2. Step 2

    Observation period

    3 months, often

  3. Step 3

    Audit and report

    2 to 6 weeks

See the full SOC 2 timeline

Frequently asked questions

How long does SOC 2 take?

A Type I report takes about 1 to 2 months. It covers one date. A first Type II report takes about 4 months with a 3-month observation period. Longer periods take longer.

Strac Comply collects evidence from the day you connect your systems. Once your controls work, you and your auditor can agree on when your observation period starts.

Do you support both Type I and Type II?

Yes. Both draw on the same evidence. Your auditor issues the report, not Strac.

Want the audit done too? The Certified plan includes one SOC 2 Type II audit a year from an independent licensed CPA firm. Security-First adds a human-led pen test.

Which Trust Services Criteria do you cover?

All 5 categories: Security (required), Availability, Confidentiality, Processing Integrity and Privacy. That is 61 criteria in all. Pick the categories in your audit scope, and the rest drop out of your score.

Also in Strac Comply

ISO 27001PCI DSSNIST CSF 2.0HIPAAand more

Get SOC 2 done without a last-minute rush.

Connect your systems, and your SOC 2 tests run today.

Start free trialBook a demo

14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations