When we started the journey to SOC 2 Type II certification at Fugo, we didn’t really know what we were in for. As a small digital signage software company, tackling a security audit of this scale felt daunting—but also necessary.
With our focus on serving enterprise and large infrastructure clients, SOC 2 wasn’t just a nice-to-have; it was quickly becoming a must-have.
Now that we’ve crossed the finish line, we want to share what we learned along the way. If you’re a startup considering SOC 2, this guide is for you: a mix of practical advice, hard-earned lessons, and insights to help you navigate the process.
What is SOC 2, and why does it matter?
SOC 2 (System and Organization Controls 2) is a compliance framework developed by the AICPA. It’s designed for companies that handle customer data, especially SaaS providers. At its core, SOC 2 is about proving that your organization has the controls in place to protect that data across five key areas: security, availability, confidentiality, processing integrity, and privacy.
How do I know if SOC 2 is relevant to my startup?
For startups, deciding whether to pursue SOC 2 certification can feel like a tough call, given the time & financial resource you'll have to commit to it. If your business doesn’t handle sensitive customer data or operate in industries where security is a top concern, it might seem like something you can delay.
At Fugo, the decision to work toward SOC 2 wasn’t only about meeting customer requirements—it was about proving that we take security seriously. As a digital signage platform that helps businesses share protected, internal data like operational metrics and performance insights, we knew trust and security were essential.
Pursuing SOC 2 early gave us a chance to establish those values in a structured way, forcing us to think critically about our processes and systems. If your startup works with customer data or wants to compete in markets where enterprise clients expect security assurances, SOC 2 might be more relevant than you think. It’s a signal that you’re serious about what you’re building.
The process: what to expect
The SOC 2 process will be broken into two main phases: Type I and Type II.
- Type I: Evaluates whether you have the right controls in place at a specific point in time. This is your starting point, where you design and implement the policies and processes that align with SOC 2 standards.
- Type II: Takes things further by assessing how effective those controls are over a period of time (usually 3–12 months). This is where the rigor comes in, as auditors want evidence that your systems and processes are not just designed well but consistently followed.
For us, Type I felt like setting up the foundation—mapping out processes, writing policies, and getting everything in order. Type II, on the other hand, required us to live by those processes and provide proof that they work.
How long does it take?
The timeline depends on your starting point. If you already have strong security practices in place, the process can move quickly. For Fugo, it took about 4 weeks from kick-off to completing Type I and another six months to wrap up Type II.
We were fortunate to work with Thoropass, whose compliance platform and hands-on support made the process much smoother. Their platform made evidence submission and documentation incredibly intuitive, allowing us to focus on what mattered without getting bogged down in complexity. They guided us through every step, from preparing policies to conducting penetration testing, ensuring we stayed on track throughout the audit.
Lessons we learned
Choose the right partner
Tackling SOC 2 on your own is possible, but having the right partner can make all the difference—especially for small teams with limited bandwidth. Here’s what to look for:
- Experience with startups: Pick a partner that knows how to work with businesses your size. Ask for references from similar clients who faced challenges like tight budgets and growing tech stacks.
- Hands-on support: A good partner assigns a dedicated account manager to guide you through the process, answer questions, and help navigate complexities like penetration testing and evidence collection.
- A strong compliance platform: Look for a platform that automates evidence collection, integrates with your tech stack, and provides templates for policies. It should offer dashboards for tracking progress and alerts to keep you on schedule.
- Responsiveness & flexibility: Choose a partner that’s fast to respond and adaptable to your needs. SOC 2 involves moving parts, so your partner must stay aligned with your pace and priorities.
- Balance cost & value: While cost matters, cutting corners can hurt. A reliable partner may cost more upfront but saves you time, stress, and potential mistakes down the line.
Thoropass, for example, simplified our process by combining intuitive tools with clear guidance, making everything from document submission to testing manageable.
Preparation is everything, so build a checklist
One of the first and most important steps in preparing for SOC 2 is building a comprehensive checklist. The SOC 2 audit covers a lot of ground, and without a clear plan, it’s easy to feel overwhelmed.
A good checklist ensures you’re organized, addresses any gaps in your current processes, and helps you stay on track throughout the journey.
Here’s how we approached it:
1. Identify the requirements
Start by understanding what the audit will evaluate. SOC 2 focuses on five trust service principles: security, availability, confidentiality, processing integrity, and privacy. Depending on your business, you might focus on all five or just a subset. Break down each principle into specific controls you need to address.
For example, under security, you might need to document processes for user access controls, encryption protocols, and vulnerability management. Knowing the scope helps you identify what’s missing in your current setup.
2. Assess where your gaps are
Once you know what’s required, do a gap analysis. This step is critical for understanding where your existing processes fall short. For us, it revealed areas like:
- Formalizing onboarding/offboarding processes to manage employee access to sensitive systems.
- Conducting regular penetration testing and vulnerability assessments.
- Documenting clear policies for incident response and change management.
Be honest about where you’re starting from—SOC 2 isn’t about perfection from day one. It’s about building and maintaining reliable systems over time.
3. Leverage your audit partner’s platform
The right audit partner can make all the difference. A good partner will provide an intuitive, comprehensive platform to streamline much of the checklist work. For us, working with Thoropass simplified the process significantly.
Their platform automated evidence submission, tracked requirements, and provided clear guidance for every step of the journey.
This allowed us to focus on what mattered most—improving our controls—while the platform handled much of the heavy lifting in terms of documentation and tracking.
4. Create a plan for evidence collection
SOC 2 auditors will need proof that your processes are in place and working effectively. This means gathering evidence like:
- Logs showing that access permissions are reviewed regularly.
- Reports from vulnerability scans and penetration tests.
- Records of employee training on security policies.
With a compliance platform, this step becomes far less intimidating. The platform can provide templates, automated reminders, and an easy way to upload and organize evidence.
5. Set recurring tasks
SOC 2 compliance isn’t a one-time project—it’s an ongoing commitment. To stay compliant, you’ll need to revisit certain tasks regularly, like:
- Reviewing and updating policies.
- Conducting security training for employees.
- Scheduling periodic penetration tests.
We set up recurring tasks to ensure these didn’t slip through the cracks. Using a compliance platform helped us automate reminders and track progress.
Involve the rest of your team early on
When you’re a startup, SOC 2 compliance might feel daunting, especially when your team wears multiple hats and “dedicated roles” aren’t a luxury you can afford. But the truth is, SOC 2 isn’t just about IT or engineering; it touches every corner of your organization.
Here’s how to make it work when resources are tight:
1. Make security everyone’s job
In a startup, every team member contributes to the company’s success, and SOC 2 compliance is no different. Start by helping your team understand why SOC 2 matters—not just for the audit, but for earning customer trust and unlocking enterprise opportunities.
You don’t need to turn everyone into compliance experts, but it’s essential they know how their day-to-day work impacts security. For example:
- Following secure password practices
- Keeping devices updated and secure
- Being mindful of how customer data is handled
Your compliance platform will likely include training materials on these topics, and require all employees to review them. So a lot of that work will be done for you with the right audit partner.
2. Assign responsibilities without overwhelming anyone
In a startup, your “team” might just be three or four people juggling multiple role. And that’s okay. For the purposes of the SOC 2 audit, what matters is assigning clear responsibilities, even if it means temporarily wearing a few extra hats.
Start by identifying the key areas SOC 2 will evaluate (e.g., HR, IT, legal, security policies) and designate one person to take ownership of each. It’s not about creating new job titles but ensuring every task has a clear point of accountability.
Here’s an example of how to assign roles in a small team:
- HR-related tasks: One person can handle documenting onboarding/offboarding processes, ensuring background checks are completed, and tracking employee policy acknowledgments. Choose someone who's been with the team the longest for this - they'll need to know start dates, offboarding dates, etc.
- Infrastructure security: Someone with technical expertise (likely an engineer or founder) should focus on access controls, setting up security for systems, and addressing findings from penetration tests.
- Legal & policies: Another team member (often the founder or COO) can manage contract reviews, finalize compliance policies, and ensure privacy policies are in place.
- Evidence collection: Assign a person to gather and organize evidence, such as system logs or vulnerability scan reports, based on the audit checklist.
If you’re short on bandwidth, prioritize the most immediate gaps and lean on your audit partner for guidance—they’ll help you focus on what truly matters.
Test the waters before the audit
Even with a small team, testing your processes before the audit is invaluable. Run a mock incident response or double-check your access controls. You’ll catch potential issues early, avoid last-minute scrambles, and build confidence for the real thing.
Before the audit, test your processes to ensure they work as intended. This could mean running a mock incident response or conducting an internal review of access controls.
What SOC 2 has done for us
Achieving SOC 2 Type II certification has been transformative for Fugo. Here’s what it’s meant for our business:
1. Earned us trust
For enterprise clients, SOC 2 certification isn’t just a nice-to-have - it’s often a deal-breaker. Many large organizations simply won’t consider vendors that don’t meet rigorous security standards, and this certification has helped us break through those barriers.
By achieving SOC 2 Type II, we’ve been able to steadily move upmarket, positioning Fugo as a viable option for larger, enterprise-level clients. It’s opened doors to conversations that previously felt out of reach and has become a key credential that instantly builds trust.
Beyond that, it’s also differentiated us in a crowded digital signage market. While many smaller vendors haven’t yet invested in this level of compliance, SOC 2 has set us apart as a company that takes security seriously.
It’s allowed us to rise to the ranks of much larger industry peers who have already achieved similar certifications, helping us compete on a more level playing field.
2. Streamlined procurement
What surprised us the most was how the SOC 2 process started helping us even before we completed the audit. The moment we began working toward certification, it gave us a clear story to share with prospective customers who had compliance concerns. Many were reassured to know we were actively investing in security and working toward certification.
Now that we’ve achieved SOC 2 Type II, the impact is even greater. For IT and compliance teams evaluating Fugo as a vendor, the certification is a signal that we’ve done the work to meet their standards.
It simplifies procurement and due diligence, making it easier for champions within these organizations to get buy-in from stakeholders and push our platform through the approval process.
3. Improved our product
One of the most rewarding aspects of the SOC 2 audit process was the introspection it required. We weren’t just ticking boxes for compliance. e were reevaluating how we design, maintain, and secure our platform.
The process forced us to address key questions: Are our user permissions airtight? Are we prepared to respond to security incidents? Are our infrastructure and processes truly built to scale? Answering these questions led to meaningful improvements across the board, from implementing tighter access controls to refining our incident response protocols.
As a result, Fugo has become a stronger, more secure product—not just because it meets SOC 2 standards, but because we’ve built a culture of thinking critically about how to serve our customers better.
Would we do it again?
Absolutely. The SOC 2 journey wasn’t easy, but it was worth it. Like many startups, we started the process with the usual mix of dread and "oh-my-god-I’m-wasting-my-time" anxieties that come with tackling regulatory tasks. But looking back, it wasn’t just about checking a box; it was about learning, improving, and building something better.
We gained a lot of clarity about how we could strengthen our platform, and the process forced us to focus on areas that really matter to our customers. Plus, working with Thoropass made a huge difference. Their platform and guidance streamlined what could have been an overwhelming journey, and we couldn’t have done it without them.
For startups weighing the decision, our advice is to start early and embrace the process as an opportunity to improve, not a hurdle to clear.
If you’re a startup thinking about SOC 2 certification, we hope our experience gives you a clearer picture of what to expect. And if you’re already on this path, good luck—you’ve got this!
Want to learn more about our SOC 2 journey or see how it’s helped us serve our customers - check out our article here.
