Your enterprise prospect just asked: "Are you SOC 2 compliant?" Your stomach drops. You Google it. $30–50k, 4–6 months, type I then type II audit, and a binder of policies. Suddenly you're wondering if you need to mortgage the company. Here's the honest take: most AU small businesses don't. But *some* absolutely do.
SOC 2 (Service Organization Control 2) and ISO 27001 are trust certificates. They say "a third-party auditor verified our controls." Enterprise procurement teams, healthcare orgs, and financial-services clients use them as gates. If you're selling to them, you're blocked until you've got the cert. But if you're selling to SMBs? Your encryption + audit logs are usually enough.
When You Actually Need Them
Three scenarios trigger the formal audit: (1) you're selling to enterprise customers with mandatory compliance clauses in contracts, (2) you handle healthcare data (PIPEDA, HL7), or (3) you're storing payment card data (PCI-DSS, which often requires SOC 2 as evidence). Miss one of these and certs are overhead. Hit one and you're negotiating from weakness without them.
Example: a 3-person health-tech startup processing patient data needs ISO 27001 to legally operate in AU. A marketing SaaS with 100 SMB customers? Probably doesn't. Enterprise CRM? Dead in the water without SOC 2 type II (12-month audit proving continuous control).
What SOC 2 Actually Checks
An auditor walks through your infrastructure and asks five questions: (1) Are access controls in place? (2) Is data encrypted? (3) Do you log access? (4) Can you detect and respond to incidents? (5) Is there a disaster recovery plan? If you're building on Velocity X, you've already got layers 2, 3, and 4. Layer 1 is your hiring/authentication process. Layer 5 is your backup + failover strategy.
The auditor then writes a 100-page report proving each layer works. That report costs $30–50k and takes 4–6 months to earn (type I is a snapshot; type II proves 12 months of continuous controls). But the controls themselves? You can build those for free with good engineering.
What Velocity X Already Covers (80%)
Velocity X bakes encryption, RLS, and immutable audit logs into the database. Encryption at rest covers SOC 2's "data protection" control. Row-level security (RLS) covers access control—users only see their own data, enforced by the database itself, not app logic. Audit logs are immutable (insert-only, no updates), so auditors trust the timeline. Add IP allowlisting, session management, and a breach response playbook, and you're at 80% compliance maturity without paying an auditor.
The gap between "80% maturity" and "SOC 2 certified" is paperwork: write down your incident response process, create an access control matrix, document your vendor risk assessment, prove you've tested disaster recovery once a year. All of that is process + documentation, not engineering.
The Catch: Formal Audit Proves Continuity
You can have beautiful controls and still fail SOC 2 type II. Why? Because the cert requires *evidence* that controls ran consistently for 12 months. You need audit logs showing that access reviews happened monthly, that backup restore tests succeeded quarterly, that no unauthorized data access slipped through. Without the formal audit, you're claiming best effort. With it, an independent party swears you did it reliably.
Most startup founders cut corners on documentation and testing because the business is moving fast. An auditor walks in and says, "Show me proof you tested disaster recovery in the last 12 months." If you can't, control fails. Certs force discipline.
Six Quick FAQs
Can I claim SOC 2 compliance without a formal audit?
No. SOC 2 certification requires a third-party auditor. What you *can* do is build SOC 2–aligned controls (Velocity X does this automatically) and pass it off as "SOC 2–ready" or "SOC 2–maturity" to prospects. That's honest if your controls are real. It's also a negotiating point: "We're 6 months from type I if you need it."
Which comes first, type I or type II?
Type I (a one-time snapshot audit). Type II requires 12 months of historical evidence, so you do type I first (often just to buy time), then run controls for a year, then audit type II. The path is Type I → live controls for 12 months → Type II.
Does ISO 27001 give you SOC 2 for free?
No. They're different standards. ISO 27001 is a framework (what you *should* do). SOC 2 is an attestation (proof you *did* it). You can have ISO 27001 controls and fail a SOC 2 audit if you didn't document continuity. But if you're building to ISO 27001, SOC 2 is close.
What if a customer asks for "SOC 2–equivalent" controls?
That's your cue. Velocity X + written incident response + access logs + encryption inventory = "SOC 2–equivalent." Offer a demo of your controls and audit logs instead of the $50k cert. Many SMB buyers accept this. Enterprises won't.
Is PCI-DSS the same as SOC 2?
No. PCI-DSS is for payment card data only. If you're storing, processing, or transmitting credit cards, PCI-DSS is mandatory (sometimes via a payment processor who handles PCI on your behalf). SOC 2 covers everything else.
Can I do SOC 2 in-house?
You can build SOC 2–ready controls in-house. But SOC 2 *certification* requires an external auditor (AICPA-approved). That's the whole point—independence.
The Verdict
SOC 2 is a sales tax, not a survival tax. If 10% of your pipeline is enterprise and they block on compliance, a $50k cert pays for itself in one deal. If your pipeline is SMBs, Velocity X's encryption + RLS + audit logs get you 80% of the way there without the audit spend. Know your customer. If they're buying based on a trust checkbox in Gartner, you need the cert. If they're buying based on product fit and price, you don't. Build the controls either way. The cert just formalizes what good engineering already does.