SOC2IQ Start free
SOC 2 readiness · the price is on this page

Get SOC 2 ready without the sales call.

SOC2IQ checks your company against every SOC 2 criterion, explains each gap in plain words, tells you the next step that closes the most, and keeps evidence your auditor can re-check. See your gaps today. See the price before you talk to anyone.

Start the free readiness checkHow SOC 2 works

No demo call · no card for the check · built and hosted in Canada

SOC2IQ

What most SOC 2 tools keep behind a demo

PriceBook a demo to get a quote$199 a month, on our pricing page
Getting startedA sales call firstStart the readiness check right now
TimelineSOC 2 in days, not monthsReady in weeks; a Type II report after a 3+ month observation period
AuditorUse their partner or their own firmAny CPA firm you choose; we never audit our own work

Read on 13 Nov 2026 across eight SOC 2 tool websites: none published a price or offered a self-serve start.

How it works

Four steps, in the order an auditor needs them

  1. 01

    Answer five questions

    Who you are, why SOC 2 now, and which categories apply. Security is always in scope.

  2. 02

    See every gap

    All SOC 2 criteria checked and explained in plain words, with what the auditor will ask.

  3. 03

    Close them in order

    Approve ready-made policies, connect read-only sources, and attest what only you can know.

  4. 04

    Hand over the evidence

    Give your auditor a package where every item carries its fingerprint, so it can be re-checked.

One number, not a dashboard maze

Know exactly how far you are from an auditor

Every criterion is covered, partly covered or a gap, and the next steps are ranked by how many gaps each one closes. What a connected system collected is kept apart from what you vouch for yourself, so nobody mistakes a promise for proof.

What is in the box

The full SOC 2 criteria library61 criteria and 79 controls, mapped and explained.
21 policy templatesApprove each one; the approved version is fingerprinted.
Read-only connectionsGitHub, Cloudflare and Oracle Cloud today, collecting original evidence.
Evidence you can re-checkCollected and owner-attested evidence kept apart, each with a SHA-256 fingerprint.
Access reviews and vendorsQuarterly access reviews and a vendor list with risk notes.
Risks and incidentsA risk register and an incident log with a timeline.
Customer questionnairesAnswer security questionnaires from your approved evidence.
Your data stays yoursHosted in Toronto, Canada. Export everything at any time.
The honest timeline

Ready in weeks. The report takes longer, and we say so.

Software can get you ready. A Type II report also needs your controls to run for an observation period, at least 3 months, before a CPA firm can sign. Anyone promising a Type II report in days means readiness, not the report.

Day 1Gap listYou, with SOC2IQ
WeeksClose the gapsYour pace decides
OptionalType I auditA point-in-time report from your CPA firm
3 to 12 monthsObservation periodControls run; SOC2IQ keeps the evidence
AfterType II reportIssued by your CPA firm

How SOC 2 works, step by step →

What SOC 2 really costs a small company

Most of the money goes to the auditor and the penetration test, not the software. We show the whole bill, with where each number came from.

See our price and the full cost table →

Type II audit (CPA firm)$12K to $20K
Penetration test$5K to $15K
Typical tool, price on request$4K to $30K a year
SOC2IQ$199 a month (USD)
Ranges from Drata, Probo and Scrut public cost pages, read 13 Nov 2026. Vendor sources; your auditor's quote decides.

Straight answers

Is SOC2IQ an auditor?

No. SOC2IQ gets you ready and keeps the evidence. Only an independent CPA firm can issue a SOC 2 report, and you choose which one.

Can I bring my own auditor?

Yes, on every plan. Your auditor gets a read-only view and an export of the evidence.

Is there a free plan?

The readiness check is free. Paid plans are $199 and $399 a month, on the pricing page.

How long until I have a SOC 2 report?

Readiness depends on your gaps. A Type I can follow as soon as you are ready; a Type II needs at least a 3-month observation period first.

What happens to my evidence if I leave?

You export it, with its fingerprints, and take it to any tool or auditor.

See your SOC 2 gaps today.

Answer five questions. Get your first steps. Keep them, whether or not you buy.

Start the free readiness check