SOC 2 compliance software for preparing your SOC 2 examination

Compliance has a SOC 2 catalog based on the 2017 Trust Services Criteria with the 2022 revised points of focus. It holds the Common Criteria for Security and the criteria for Availability, Processing Integrity, Confidentiality and Privacy. CC6.1, for example, is "Logical access security: registration and authorisation".

Every SOC 2 report includes the Common Criteria. You pick the other categories for your report scope. On the Applicability page you mark each criterion Applicable or Excluded.

You link evidence, findings and register records to the criteria they meet.

A CPA firm examines your controls and issues the SOC 2 report. SOC 2 is an attestation report, not a certification. Compliance is where you keep the evidence, findings and records the CPA firm asks to see.

Crosswalk mappings connect matching requirements across the frameworks you adopt. Evidence, findings and register records can meet requirements in several frameworks.

One access control record, for example, meets ISO 27001 A.5.15, SOC 2 CC6.1 and GDPR Art. 32. The crosswalk also marks SOC 2 CC8.1 and ISO 27001 A.8.32 on change management as equivalent.

Your SOC 2 examination and your ISO 27001 audit stay separate, because each one covers its own framework. A supplier review covers one supplier, and it does not span frameworks either.

Compliance has registers for policies, risks, assets, suppliers, evidence and findings, among others. The registers are shared between the frameworks you adopt, so SOC 2 and ISO 27001 use the same records.

Compliance scores each risk on a 5×5 likelihood and impact matrix. Treatment actions lower the residual risk score.

Compliance creates recurring review tasks for policies, risks, assets and requirements on schedule. Every task has an owner and a due date, and all tasks appear in one inbox.

Compliance also has an AI assistant on every page. It runs on AI credits, billed in USD, and it is not part of the trial unless you buy AI credits.

Michiel van der Meer built Compliance after taking over an ISMS at Jewel and seeing how much hand-work it took. He needed a better solution, so he built one.

SOC 2 is €999 per framework per year, excl. VAT. Users in your organisation are unlimited. The price includes $10 of AI credit per year, billed in USD, and you can buy extra credits.

You pay for each framework you adopt separately. Each framework is €999 a year, so adding SOC 2 to ISO 27001 is another €999 a year.

Try Compliance for 30 days without a credit card. The trial gives you full access to every framework. The AI assistant is not part of the trial unless you buy AI credits.

See all Compliance pricing →