SOC2: The screenshots will continue until security improves
I think one of the things that you are missing out on big time with your existing SOC 2 report is the design of controls that are specific to your business and shows your customers the steps that you take to protect their data.<p>It sounds like you are doing amazing things from a security perspective, but that those are not included in your report, which means that your customers are missing out on. As you mentioned, sure you can put it in a white paper, but who is to say that you are actually doing it? That&#x27;s the point of the SOC 2 report.<p>My hunch on this comes from the fact that you mentioned that SOC 2 comes from answering a giant spreadsheet from your auditors. It doesn&#x27;t really, however that is how a lot of auditing firms get their clients to become compliant with SOC 2. They need something, and a spreadsheet is a good place to start.<p>You&#x27;re right, some businesses won&#x27;t need AV, or Background checks, but in your case if it makes sense to have a control that mentions &quot;The company only leverages memory-safe languages&quot;, you should be able to, and even explain it further in your Section 3. The key is to design controls that address the SOC 2 criteria but also are 100% reflective of how you are operating your business. It sounds to me like you got to SOC 2, but that you could get a lot more out of it. This is unfortunately super common.<p>Source: I help SaaS companies with SOC 2 and I have been for 7 years now. Currently helping companies in unusual spaces such as crypto exchanges and making sure that all the amazing work they put in security is reflected in their report. I&#x27;d love to chat more in depth if you are interested, I am very passionate about this and I&#x27;ve worked with a lot of companies you probably use one way or another in your stack, or that are in a similar space as yours. Don&#x27;t hesitate to reach out and good luck!