Skip to main content

​
SOC 2 Readiness Guide — GoCloudera

​
What SOC 2 Actually Is

SOC 2 is an audit framework by the AICPA that proves to customers your SaaS handles their data securely. There are two types:
  • Type I — Point-in-time: “Do your security controls exist?” An auditor checks your policies, configs, and processes on a single date. Takes 4-8 weeks of prep, costs 15K−15K-30K with a compliance platform.
  • Type II — Over time: “Do your controls work consistently?” An auditor monitors your controls over 3-12 months, then reports on whether they held up. Takes 6-12 months, costs 30K−30K-60K.
For pre-seed: You don’t need certification yet. You need to (a) understand the requirements, (b) start building the controls into your workflow now so certification is fast when you need it, and (c) be able to tell investors and prospects “we’re SOC 2 audit-ready and will certify when we close our seed round.”

​
The Five Trust Service Criteria

SOC 2 audits evaluate your organization against these criteria. You pick which ones apply (Security is mandatory; the rest are optional but expected for SaaS):

​
1. Security (Required)

Access controls, firewalls, encryption, intrusion detection. This is the baseline. What GoCloudera already has:
  • JWT authentication with refresh tokens
  • Tenant isolation middleware (every query scoped to tenant_id)
  • Role-based access control (member, admin, global_admin)
  • API key authentication for agents (X-API-Key header)
  • gRPC with TLS support for agent communication
  • AWS STS AssumeRole with external ID for cross-account access (15-min temp credentials)
  • Parameterized SQL queries (no string concatenation)
  • Input validation on all routes
  • CORS configuration
  • Rate limiting (configurable per tenant)
What you need to add:
  • Enable encryption at rest on your RDS instance (one AWS console toggle)
  • Enable encryption in transit (enforce SSL on all database connections)
  • Set up AWS CloudTrail for API audit logging
  • Set up AWS GuardDuty for threat detection
  • Document your password policy (minimum length, complexity, rotation)
  • Implement session timeout (JWT expiry is set but verify it’s enforced)
  • Set up vulnerability scanning (Dependabot is free on GitHub)

​
2. Availability

Uptime commitments, disaster recovery, backup procedures. What you need:
  • Define an SLA (99.9% is standard for SaaS)
  • Set up automated database backups (RDS automated backups, verify retention)
  • Document a disaster recovery plan (how long to restore from backup)
  • Set up uptime monitoring (UptimeRobot free tier, or AWS CloudWatch)
  • Your /health and /health/detailed endpoints already exist — wire them to monitoring
  • Document your incident response procedure (who gets paged, escalation path)

​
3. Confidentiality

How you protect confidential customer data. What GoCloudera already has:
  • Tenant data isolation (all queries filtered by tenant_id)
  • Sensitive config values masked in API responses (webhook URLs truncated, routing keys masked)
  • Data retention settings per tenant (configurable 30-365 days)
  • DataRetentionJob for automated data cleanup
What you need to add:
  • Classify your data: what’s PII, what’s confidential, what’s public
  • Document data handling procedures for each classification
  • Encrypt sensitive fields in the database (API keys, webhook URLs, cloud credentials)
  • Implement data deletion on tenant offboarding (right to deletion)
  • NDA template for employees/contractors

​
4. Processing Integrity

Data is processed accurately and completely. What GoCloudera already has:
  • Analysis audit log capturing every anomaly detection decision
  • Inference feedback loop tracking accepted/rejected/modified recommendations
  • Action queue with full lifecycle tracking (pending → approved → executing → completed/failed)
  • Event persistence (EventLog table) for audit trail
  • Enforcement policy trigger counts and success/failure rates
What you need:
  • Document your data processing pipeline (agent → sync → storage → analysis → action)
  • Verify data validation at each step (you have route-level validation; add model-level)
  • Monitor for data loss (compare agent-sent metrics count vs. backend-received count)

​
5. Privacy

How you handle personal data (relevant if you process user PII). What you need:
  • Privacy policy on your website
  • Document what personal data you collect (email, name, IP addresses from auth)
  • Document where it’s stored and who has access
  • Implement data subject access request (DSAR) process
  • Cookie policy if you have a marketing site

​
SOC 2 Readiness Roadmap

​
Phase 1: Foundation (Weeks 1-4) — Do This Now, Costs $0

These are things you should do immediately because they cost nothing and protect you:
  1. Write 5 core policies as Google Docs:
    • Information Security Policy (who has access to what, how access is granted/revoked)
    • Acceptable Use Policy (what employees can/cannot do with production systems)
    • Incident Response Plan (what happens when something goes wrong)
    • Change Management Policy (how code gets to production — your GitHub Actions CI/CD documents this)
    • Data Classification Policy (what data you have, how each type is handled)
  2. Enable free AWS security features:
    • Turn on CloudTrail (logs all AWS API calls — free for management events)
    • Turn on RDS encryption at rest (free, requires a brief maintenance window)
    • Turn on RDS automated backups if not already (free up to DB size)
    • Enable MFA on your AWS root account and all IAM users
    • Review IAM policies — follow least-privilege principle
  3. Enable free GitHub security features:
    • Turn on Dependabot alerts (automatic vulnerability scanning)
    • Turn on secret scanning (catches accidentally committed credentials)
    • Require PR reviews before merging to main
    • Require status checks (your CI tests) to pass before merging
  4. Document your architecture:
    • Your docs/architecture-flows.md is a great start
    • Add a data flow diagram showing where customer data travels
    • Add a network diagram showing your AWS infrastructure

​
Phase 2: Tooling (Weeks 5-8) — Budget ~$500/mo

  1. Sign up for a compliance automation platform. These dramatically reduce audit prep time:
    • Vanta (3,000−3,000-6,000/year for startups) — most popular, integrates with AWS/GitHub/GCP
    • Drata (3,000−3,000-5,000/year) — similar to Vanta, good UI
    • Secureframe (4,000−4,000-8,000/year) — popular with startups
    These platforms will: auto-scan your AWS configs, check GitHub settings, generate policy templates, track employee security training, monitor for compliance gaps, and produce the evidence package your auditor needs.
  2. Set up monitoring/logging:
    • Centralized logging (AWS CloudWatch Logs, or Datadog free tier)
    • Uptime monitoring for your API and dashboard
    • Error tracking (Sentry free tier)
  3. Background checks:
    • Run background checks on all team members who have production access
    • Set up security awareness training (KnowBe4, or free SANS modules)

​
Phase 3: Audit Prep (Weeks 9-12) — When You’re Ready to Certify

  1. Select an auditor:
    • For Type I, budget 15K−15K-25K
    • Good startup-friendly auditors: Prescient Assurance, Johanson Group, Schellman
    • Your compliance platform (Vanta/Drata) will recommend auditors they work with
  2. Readiness assessment:
    • Your compliance platform runs a gap analysis
    • Fix any gaps identified (usually takes 2-4 weeks)
    • Collect evidence: screenshots, configs, policy sign-offs
  3. Type I audit:
    • Auditor reviews your controls on a specific date
    • Takes 2-4 weeks from engagement to report
    • You get a SOC 2 Type I report you can share with prospects

​
What to Tell Investors Now

When investors ask about SOC 2:
“We’re building SOC 2 readiness into our development process from day one. Our platform already implements tenant data isolation, role-based access control, encrypted communications, automated data retention enforcement, and full audit trails for every AI analysis decision and enforcement action. We have CI/CD with required test coverage and code review. We plan to complete Type I certification as part of our post-seed milestones, using Vanta for compliance automation. Our architecture was designed for multi-tenant security — every database query is tenant-scoped, API keys use secure rotation, and cross-cloud access uses temporary credentials with 15-minute expiry.”
This is all true based on your current codebase.

​
What to Tell Enterprise Prospects

When prospects ask “are you SOC 2 compliant?”:
“We’re currently in SOC 2 Type I preparation and expect to complete certification in [timeline]. In the meantime, I can walk you through our security architecture: we use tenant-isolated data storage, JWT authentication, role-based access, encrypted communications, and automated audit logging. We’re happy to complete a security questionnaire or do a call with your security team.”
Most early-stage enterprise deals will accept this if you can answer their security questionnaire well. The questionnaire matters more than the certificate at pre-seed.

​
Cost Summary

PhaseTimelineCost
Foundation (policies + AWS hardening)Weeks 1-4$0
Compliance platform (Vanta/Drata)Ongoing3,000−3,000-6,000/year
Type I auditWhen ready15,000−15,000-25,000
Type II audit (6-12 months later)Post-seed30,000−30,000-50,000
Total to SOC 2 Type I: ~20K−20K-30K — typical seed-round milestone.

​
GoCloudera-Specific SOC 2 Strengths

Things you’ve already built that auditors love to see:
  1. AnalysisAuditLog — every anomaly detection run is logged with baseline stats, method scores, and confidence levels. This is processing integrity evidence.
  2. InferenceFeedback — human-in-the-loop documentation for every AI recommendation. Shows you don’t blindly act on AI output.
  3. EventLog — persistent event trail replacing ephemeral Redis events. Shows data processing integrity.
  4. DataRetentionJob — automated data lifecycle management with configurable per-tenant retention. Shows you handle data responsibly.
  5. MaintenanceWindow — documented maintenance procedures that suppress alerts/enforcement. Shows operational maturity.
  6. EscalationPolicy — incident response automation with multi-level escalation. Shows you have incident response procedures.
  7. ActionQueue audit trail — every enforcement action tracked from creation through approval to completion with source attribution. Shows change management.
  8. TenantBrandingContext — white-label capability shows enterprise readiness.
  9. 2,500+ tests — shows software development lifecycle maturity.