Most SaaS founders discover SOC 2 the hard way — a Fortune 500 prospect blocks the deal at the procurement stage because the vendor doesn't have a Type II report. The conversation shifts from product to compliance overnight. We just shipped a multi-tenant healthcare SaaS through a Type II audit in 90 days. Here's how.
There is a myth that SOC 2 takes 6–12 months. It doesn't. It takes 6–12 months if you treat it as a paperwork exercise done after the product is built. If you build the controls into the engineering process from sprint zero, 90 days is realistic. This article walks through the seven control families we built, the audit evidence we automated, and what we'd do differently.
The seven control families we built
SOC 2 doesn't prescribe specific technology. It prescribes outcomes: confidentiality, availability, processing integrity, privacy, security. Each of those breaks down into control families. We focused on the seven that the auditor would test most heavily:
- Access control — RBAC, MFA, just-in-time elevation, quarterly access reviews
- Change management — pull requests, code review, automated tests, deployment approvals
- Risk assessment — quarterly risk register, threat modelling on every new feature
- Monitoring — full observability stack (Grafana + Prometheus + OpenTelemetry)
- Vendor management — sub-processor list, SOC 2 collection, annual reviews
- Incident response — documented runbook, on-call rotation, post-incident reviews
- Data retention — automated retention policies, immutable backups, right-to-erasure
Automating the audit evidence
The single biggest time-saver was automating evidence collection. We built a small internal tool — call it 'audit-bot' — that runs continuously and pulls evidence into a single dashboard. Every control maps to one or more automated checks:
- RBAC changes → audit log → daily evidence snapshot to S3
- Every PR merged → record with reviewer, files changed, tests passed
- Every production deploy → record with approver, diff, rollback path
- Every access request → recorded with the 4-eyes approval
- Quarterly access review → automated user-list + manager attestation
“When the auditor asked for 90 days of access-control evidence, we pointed them at a Grafana dashboard. They asked one follow-up question and moved on. That's the bar to aim for.”
What we'd do differently
Three things, in hindsight:
First, we'd build audit-bot earlier. We shipped it in week 4 and spent the first three weeks manually collecting evidence for the auditor's pre-audit review. With audit-bot from sprint zero, we'd have skipped those three weeks.
Second, we'd bring the auditor in earlier. We didn't engage them until week 6. Had we engaged them at sprint zero, they could have guided control design and saved us a re-write of two controls.
Third, we'd run a mock audit at week 8, not week 11. The mock surfaced three gaps that took a week each to close. Running it three weeks earlier would have given us breathing room.
The bottom line
SOC 2 in 90 days is achievable if you treat compliance as an engineering problem, not a documentation problem. Build the controls into the SDLC from day one, automate the evidence, and bring the auditor in early. The report is a side-effect of running a mature engineering organisation — not the goal.
Author
Vikram Iyer
Head of AI & Data, Globantis Labs
Vikram writes about engineering at Globantis Labs. Reach out if you'd like to discuss this article or your own project.
