SOC 2 for Startups in 2026: Type 1 vs Type 2, $10K to $80K+, and Delve

Most startups meet SOC 2 the same way: a security questionnaire arrives with a large deal, and the line that matters is not about encryption or firewalls. It is "Please attach your most recent SOC 2 Type 2 report." No report, no procurement ticket. That is still how SOC 2 for startups works in 2026: a buyer's vendor-risk team wants an independent CPA's opinion on your controls, and nothing you write yourself substitutes for it. This post explains what a SOC 2 report is, Type 1 versus Type 2, the trust services criteria, what published cost and timeline ranges actually say, what Vanta, Drata and Secureframe automate, why the Delve allegations made auditor independence a live question this year, and what the engineering team ends up building. The step-by-step AWS side lives in the sibling post, How to Implement SOC 2 Technical Controls on AWS with Terraform.

What is SOC 2, and who actually asks for it?

SOC 2 is an attestation report, not a certificate. A licensed CPA firm examines a service organisation's controls against criteria the AICPA publishes and issues an opinion. The AICPA's own SOC page describes the SOC suite as services "CPAs may provide" and notes the AICPA "promulgates the professional standards for SOC engagements". That detail matters later: only a CPA firm can sign the opinion, and the software platform you buy is not the auditor.

The people asking are almost always customers' security and procurement teams, usually once deal sizes reach the point where a vendor-risk review is mandatory. The report is shared under NDA. Even AWS works this way: its SOC 2 reports are issued twice a year, each covering the previous 12 months, and you download them through AWS Artifact after accepting an NDA. That AWS report covers AWS's controls, not yours. Your auditor will treat AWS as a subservice organisation and test what you configured on top of it.

SOC 2 Type 1 vs Type 2: which report should a startup get first?

A Type 1 report says your controls were suitably designed and in place on a single date. A Type 2 report says they also operated effectively across a period, the observation window, which Secureframe describes as typically 3 to 12 months, and Vanta puts in the same three to twelve month range.

The practical difference is evidence. For Type 1 the auditor looks at configuration and policy once. For Type 2 the auditor samples: pick 25 pull requests from the window and show each was reviewed, pick terminated employees and show access was removed on time, pick quarters and show the access review happened. A control that existed on day one and lapsed in month four is an exception in the report.

My usual advice is to go straight to a Type 2 with a short first window if the buyer will accept it, because most enterprise questionnaires ask for Type 2 anyway and a Type 1 delays rather than replaces it. A Type 1 makes sense when a specific deal needs something in weeks. Either way, the clock that matters is the observation window: it cannot start until the controls actually run.

SOC 2 trust services criteria: what is actually in scope?

The criteria are the AICPA's 2017 Trust Services Criteria, with points of focus revised in 2022. Per Linford & Co's walk-through of TSP Section 100, the 2022 revision changed the points of focus, not the criteria, and across all five categories there are 61 criteria and almost 300 points of focus. Only Security is required.

Category	Required?	What it covers	Typical startup choice
Security (common criteria CC1 to CC9)	Always	Control environment, risk assessment, logical access (CC6), system operations (CC7), change management (CC8), vendor risk (CC9)	In scope
Availability (A1)	Optional	Capacity, backups, recovery	Add if you sell an uptime SLA
Confidentiality (C1)	Optional	Identifying and disposing of confidential data	Common for B2B data products
Processing Integrity (PI1)	Optional	Complete, accurate processing	Payments, billing, data pipelines
Privacy (P1 to P8)	Optional	Personal information lifecycle	Rare in a first report

Sources: Linford & Co on TSP Section 100; AICPA SOC suite.

The criteria are deliberately outcome-shaped. CC6.1 does not say "use MFA"; it asks for logical access controls that protect information assets, and you choose the controls that meet it. That flexibility is why scope decisions dominate both cost and pain. Every system, team and category you add multiplies the evidence you produce for the life of the programme.

How long does SOC 2 take and how much does it cost in 2026?

Published numbers come mostly from vendors who sell compliance software, so treat them as ranges rather than quotes. They are still useful because they agree on shape. Drata's cost page, dated 25 March 2026, puts a small or midsize company's Type 1 audit at $7,500 to $15,000 and a Type 2 at $12,000 to $20,000, says most startups spend $25,000 to $50,000 all-in in year one, and estimates $15,000 to $40,000 a year to maintain. Vanta's cost guide puts the audit fee itself at $10,000 to $50,000 and the all-in first year at $10,000 to $80,000 or more, with preparation usually taking one to five months.

What the chart leaves out is the platform subscription. As of this week, Vanta's pricing page offers "personalized pricing" through a demo, Drata lists plan names without prices, and Secureframe shows only a floor: its Fundamentals package starts at $7,500 a year, with the higher tiers quote-only. Get two quotes, and ask what happens to the price when headcount doubles.

The other hidden cost is engineering time. Nobody publishes a reliable number for it, so I will not invent one. In my experience it is front-loaded: weeks of turning on logging, closing public buckets, wiring SSO and writing the policies, then a steady trickle of evidence and access reviews.

Vanta vs Drata vs Secureframe: what compliance automation actually does

All three do roughly the same core job. They connect read-only to your cloud accounts, identity provider, HR system, code host and endpoint agent, run continuous tests that map to SOC 2 controls, give you policy templates, track employee onboarding tasks such as security training and background checks, and hand the auditor a portal of evidence. The differences that matter to engineers are integration depth for your particular stack, how noisy the tests are, and which audit firms they work with.

AWS has more or less endorsed this split. On 30 April 2026 AWS Audit Manager stopped accepting new customers and moved to maintenance mode. The same page says AWS Config has no SOC 2 conformance pack ("SSAE-18 SOC 2: No equivalent"), that conformance packs cover only technical controls, and it points customers who need full evidence management to partner tools "such as those from Vanta and Drata". AWS will tell you whether a bucket is encrypted. It will not track whether your new hire signed the acceptable use policy.

What no platform does is operate your controls. A green dashboard means the integration saw a configuration. It does not mean anyone reviewed the alert, rotated the key or tested the restore. Auditors know this, which is why a Type 2 still samples tickets and records from the window.

The Delve allegations and why SOC 2 auditor independence matters

In March 2026 an anonymous former customer writing as "DeepDelver" accused Delve, a Y Combinator compliance startup that raised $32M at a $300M valuation in July 2025, of what TechCrunch summarised as "fake compliance". The allegations: auditor conclusions and test procedures generated before any independent review, fabricated evidence of meetings and tests, and nearly all clients routed through two related audit firms said to operate primarily in India with a nominal US presence. Delve denied it, saying it is an automation platform, that final reports come only from independent licensed auditors, and that it provides draft templates rather than pre-filled evidence.

What followed is on the record. LiteLLM dropped Delve on 30 March, moving to Vanta and hiring its own independent auditor. On 4 April Delve and Y Combinator "parted ways", and Delve said it would offer complimentary re-audits and remove audit firms that did not meet its standards. The core allegations have not been adjudicated, and TechCrunch did not report independently verifying them, so I treat them as allegations.

The lesson does not depend on how the story ends. The AICPA's position, as summarised by CPA firm Sensiba, is that auditors must not review their own work: no implementing controls, no management decisions about the system they then test. When the same commercial chain writes your evidence, picks your auditor and drafts the opinion, a customer reading your report cannot tell whether anyone independent looked. Before you sign, I would check three things: the CPA firm's licence in the state board lookup, whether you can choose a firm outside the platform's referral list, and whether the auditor will walk you through how they sample. If a vendor promises a Type 2 in two weeks, ask how the observation window fits.

What engineers actually build for SOC 2

The engineering work is less exotic than the framework language suggests. Most of it is turning on things you should already have, then keeping evidence that they stayed on. For an AWS startup the list usually looks like this:

• Logging and monitoring (CC7): an organisation CloudTrail with log file validation, retained past the audit window; GuardDuty in every account; Security Hub CSPM findings someone triages.
• Access (CC6): SSO through IAM Identity Center or your IdP with MFA, no long-lived IAM users for humans, quarterly access reviews, offboarding within a defined number of days. The AWS IAM explainer covers the policy side.
• Change management (CC8): branch protection with required reviews, CI checks, infrastructure through Terraform with plans reviewed. Tests for that code are covered in How to Test Terraform.
• Data protection and availability: encryption by default, no public buckets, backups with a tested restore, secrets out of Git (see Secrets Sprawl 2026).

Evidence is the part teams underestimate. I prefer small scripts that pull evidence from the source of truth over screenshots, because the auditor can rerun them. Here is the shape of one for change management and encryption:

#!/usr/bin/env bash
# Evidence pull for a SOC 2 Type 2 window. Flags checked against the help output
# of gh 2.49 and AWS CLI 2.27 (gh 2.103.3 is current); not run against a live account.
# Read-only: needs repo read access and AWS Config read permissions.
set -euo pipefail
REPO="acme/api"            # change to your repository
OUT="evidence/$(date +%Y-%m-%d)"
mkdir -p "$OUT"

# CC8.1: branch protection on main (required reviews, status checks)
gh api "repos/${REPO}/branches/main/protection" > "$OUT/branch-protection.json"

# CC8.1: merged PRs in the window, with reviewers, for the auditor's sample
gh pr list --repo "$REPO" --state merged --limit 500 \
  --search "merged:2026-07-01..2026-09-30" \
  --json number,title,mergedAt,author,reviews > "$OUT/merged-prs.json"

# CC6.1: EBS volumes and their encryption flag, from AWS Config
aws configservice select-resource-config \
  --expression "SELECT resourceId, configuration.encrypted WHERE resourceType = 'AWS::EC2::Volume'" \
  --output json > "$OUT/ebs-encryption.json"

shasum -a 256 "$OUT"/*.json > "$OUT/SHA256SUMS"   # tamper evidence for the bundle

Run something like it on a schedule, commit the output to a restricted bucket, and the auditor's sample request becomes a lookup instead of a scramble. Discipline like this is what separates a SOC 2 programme from a SOC 2 project, and it matters more, not less, when AI agents open a growing share of pull requests: "who reviewed this change" is exactly the question CC8 asks.

FAQ

How long does it take a startup to get SOC 2?

Preparation commonly takes one to five months according to Vanta's guide, then a Type 2 needs an observation window of three to twelve months plus the auditor's fieldwork and report writing. A realistic first Type 2 is therefore six to twelve months from a standing start. A Type 1 can arrive in weeks once controls are in place.

Is SOC 2 required by law?

No. SOC 2 is a voluntary attestation that customers request contractually. It is not a regulation, and there is no SOC 2 "certification" body; a licensed CPA firm issues an opinion on your controls against the AICPA criteria.

Do I need a penetration test for SOC 2?

The trust services criteria do not name penetration testing as a mandatory control, but most auditors and enterprise buyers expect one as evidence for risk assessment and vulnerability management. Drata's cost page budgets $5,000 to $15,000 for it. Ask your auditor before you buy one, so the scope matches what they will test.

Can I use AWS's SOC 2 report instead of my own?

No. AWS's report, downloaded from AWS Artifact under NDA, covers AWS's data centres and services. Your auditor uses it to carve AWS out of scope, and you still need to show that your own configuration, people and processes on top of AWS meet the criteria.

This quarter, if I were a 20-person startup with the first questionnaire on the desk, I would pick a CPA firm before picking a platform, scope the first report to Security only, turn on organisation-wide CloudTrail, GuardDuty and Security Hub CSPM in the first week, move every human to SSO with MFA, and start the observation window the day the access review and change-review controls actually run. The platform is a convenience. The controls are the product.

Related: AWS IAM Explained (2026): Users vs Roles, 9 Policy Types, SCPs and RCPs, Multi-Tenant SaaS Architecture Explained: Silo, Pool, Bridge, Cells (2026) and Secrets Sprawl 2026: 28.65M Leaked Keys and 64% Still Valid Years Later.