Trust & Security — TRUST-005

SOC 2 Type II — Certification Roadmap

Last updated: May 19, 2026 — Internal & enterprise-facing — Estimated effort: 5–8 j/h internal + external budget

SOC 2 Type II certification is the de-facto trust credential for B2B SaaS sold to mid-market and enterprise clients. For APSOLU Pro, achieving it unlocks procurement approval from large hotel groups, AMO firms, and real-estate developers that mandate it as a vendor requirement. This document covers the gap analysis against all nine Common Criteria (CC1–CC9), a phased 6–12 month plan to reach the audit observation period, auditor selection guidance, and a realistic budget.

Important distinction: SOC 2 Type I certifies that controls are designed correctly at a point in time. SOC 2 Type II certifies that they operated effectively over a minimum observation period (typically 6 months). The roadmap below targets Type II directly — skipping Type I saves 3–4 months and one audit fee.

1. What APSOLU Pro already has — audit-ready assets

Several controls are already implemented or inherited from certified sub-processors. These reduce the gap significantly and should be documented formally before the observation period begins.

🔐SOC 2 certified

Clerk Auth — SOC 2 Type II

Authentication, session management, MFA, and user lifecycle managed by Clerk (clerk.com). Their SOC 2 Type II report covers access control, authentication logging, and credential management.

🗄️SOC 2 certified

Supabase PostgreSQL — SOC 2 Type II

PostgreSQL database hosted in Frankfurt (EU). Supabase holds a SOC 2 Type II report covering availability, confidentiality, and data encryption at rest (AES-256). Daily backups with 30-day retention.

🚀SOC 2 certified

Vercel — SOC 2 Type II

Application hosting on Vercel Edge Network. Immutable deployments, HTTPS enforced, HSTS enabled. Vercel's SOC 2 Type II covers change management, availability, and infrastructure security.

☁️SOC 2 certified

Cloudflare R2 — SOC 2 Type II

File storage (photos, documents) on Cloudflare R2 EU region. AES-256 at-rest encryption. Cloudflare's SOC 2 Type II covers physical and logical access to storage infrastructure.

🔒Strong

Multi-tenant isolation — architectural

All queries scoped by orgId from Clerk JWT. getOrgIdOrThrow() guards every API route. Cross-org data access is structurally impossible — no path exists in the application code.

👤Strong

RBAC — 2-layer model

5 project roles (OWNER → VIEWER) + Clerk org roles (admin/member). Documented at /trust/permissions. Enforced at the API layer on every request.

🌐Strong

Transport security

TLS 1.3 enforced. HSTS active via Vercel. Content-Security-Policy configured. Rate limiting: 100 req/min (API), 20 req/min (AI routes) at Edge middleware.

📋Partial

Audit trail — partial

Timestamps on all records. SHA-256 checksums on uploaded files. EXIF metadata preserved for photos. Full audit_log table exists for mutations — needs formal retention policy.

📄Strong

DPA — GDPR compliant

Data Processing Agreement published at /legal/dpa. Data residency in EU (Frankfurt). Right to erasure implemented. Sub-processor list maintained.

Clerk, Supabase, Vercel, and Cloudflare R2 are all SOC 2 Type II certified. Their reports can be referenced as sub-processor controls in the APSOLU Pro audit package — this is called the “complementary sub-service organization controls” (CSOC) model and significantly reduces the scope of controls APSOLU must own directly.

2. Gap Analysis — Trust Service Criteria (TSC)

The SOC 2 Security category comprises nine Common Criteria (CC1–CC9). The table below maps each criterion to APSOLU Pro’s current state, identifies gaps, and assigns a traffic-light status.

Criterion	Description	Current state	Gaps to close	Status
CC1	Control Environment — governance, ethics, accountability	No formal InfoSec policy or organizational security charter.	Draft and approve: InfoSec Policy, Acceptable Use Policy, Code of Conduct. Designate a security owner (DPO-equivalent).	Gap
CC2	Communication & Information — internal/external comms about security	Security@ email exists. /trust/* pages document controls publicly.	Internal security awareness training (annual, documented). Security incident reporting process communicated to all team members.	Partial
CC3	Risk Assessment — formal risk identification and management	No formal risk register or risk assessment process.	Annual risk assessment exercise. Risk register (threats, likelihood, impact, mitigations). Risk treatment plan.	Gap
CC4	Monitoring Activities — continuous monitoring, internal audit	Vercel deployment logs. Supabase query logs. No SIEM or centralized alerting.	Centralized log aggregation (Axiom / BetterStack / Datadog). Anomaly alerting. Quarterly access reviews. Annual internal audit cadence.	Gap
CC5	Control Activities — policies and procedures for system controls	PR review process exists (GitHub). Lint + build CI gates active.	Formal Change Management Policy. Documented SDLC process. Vendor Management Policy. Documented deployment procedures.	Partial
CC6	Logical & Physical Access — authentication, authorization, network	Clerk auth (SOC 2 Type II). RBAC documented. TLS 1.3. Rate limiting. orgId isolation.	MFA enforcement for all admin/privileged accounts (not just optional). Formal access provisioning/deprovisioning procedure. Quarterly user access review documented.	Partial
CC7	System Operations — monitoring, incident detection and response	Vercel/Supabase platform alerting. No formal incident response plan.	Incident Response Policy (definition, roles, SLAs). Tabletop exercise (annual). Post-incident review process. Documented security incident log.	Gap
CC8	Change Management — SDLC, code review, deployment controls	Git workflow documented (CLAUDE.md). PR + review process. Husky pre-push hooks (lint + tsc). Immutable Vercel deployments.	Formal Change Management Policy referencing the existing process. Emergency/hotfix change classification (HF-xxx circuit exists — document formally). Rollback procedure documented.	Partial
CC9	Risk Mitigation — vendor mgmt, business continuity, insurance	Sub-processors documented in DPA. Supabase 30-day backups.	Formal Vendor Management Policy + periodic assessments of Clerk/Supabase/Vercel/Cloudflare/OpenRouter. BCP/DR plan with defined RTO/RPO. Annual DR test. Cyber insurance evaluation.	Gap

Strong — minor documentation only

Partial — controls exist, not formalized

Gap — control missing or not implemented

3. Phased Plan — 6 to 12 months to SOC 2 Type II

The plan is structured in four phases. Phases 1–3 close the gaps identified above. Phase 4 is the formal 6-month audit observation period (no control changes during this window — only evidence collection).

Phase 1 — Foundation (Months 1–2)

~2 j/h

Designate Security Owner (internal, no hire needed at this stage).
Write and approve core policies: InfoSec Policy, Acceptable Use Policy, Incident Response Policy, Change Management Policy, Vendor Management Policy, BCP/DR Plan.
Create Risk Register: enumerate 10–15 top risks, assign owners, document mitigations.
Inventory all sub-processors with their SOC 2 report references.
Set up compliance automation platform (Vanta or Drata) — connect GitHub, Vercel, Clerk, Supabase.
Select audit firm and issue RFP (see Section 4).

Phase 2 — Technical Gap Closure (Months 3–4)

~2 j/h

Enable Dependabot (GitHub) for automated dependency vulnerability alerts.
Add CodeQL or Semgrep SAST to CI pipeline — document findings and remediation SLA.
Set up centralized log aggregation: all API errors, auth events, and access attempts → Axiom or BetterStack.
Configure anomaly alerting (failed auth spikes, unusual data export volumes).
Enforce MFA for all org:admin Clerk accounts (set as required in Clerk dashboard).
Conduct first external penetration test — document findings and remediation plan.
Document and test the DR procedure: restore a Supabase backup, define RTO < 4h / RPO < 24h.

Phase 3 — Readiness (Months 5–6)

~2 j/h

Security awareness training for all team members — documented completion records.
First quarterly access review: audit all Clerk org members + project_members table — remove stale access.
Tabletop incident response exercise: simulate a data breach scenario, document lessons learned.
Auditor readiness assessment (pre-audit): auditor reviews control design, identifies remaining gaps.
Fix all critical/high findings from pentest and readiness assessment.
Compliance platform: achieve 85%+ control score on SOC 2 Security category before triggering observation period.

Phase 4 — Observation Period + Audit (Months 7–13)

~1–2 j/h

Observation period starts (6 months minimum for Type II): NO control changes — only evidence collection.
Compliance platform auto-collects evidence continuously: access logs, deployment records, vulnerability scans, training completions.
Monthly: review open risks, confirm no control exceptions.
Month 10: Auditor fieldwork begins — provide evidence packages, answer RFIs within 48h SLA.
Month 12–13: Auditor issues draft report. Review and respond to exceptions (if any).
Month 13: SOC 2 Type II report issued. Publish on /trust/soc2 or share via NDA with prospects.

Timing note: Starting the observation period in Month 7 means the earliest a Type II report can be issued is Month 13. If you start the program in June 2026, the report is achievable by July 2027 — well within the window needed for enterprise pipeline Q1 2028.

4. Auditor Selection

SOC 2 audits must be conducted by a licensed CPA firm. The choice affects cost, turnaround time, and the credibility of the report with prospects. Three tiers are relevant for APSOLU Pro at its current stage:

Specialist SaaS Firms

Recommended

A-LIGN, Schellman, Prescient Security, Coalfire

Pros

Deep SaaS / cloud-native expertise
Faster turnaround (8–12 weeks fieldwork)
Pre-integrated with Vanta/Drata (automated evidence import)
Fixed-fee pricing ($18–35k typical)
Startup-friendly scheduling

Cons

Less name recognition with very large enterprise buyers
May require NDA sharing vs. public report

Budget: $18,000 – $35,000

Mid-Tier CPA Firms

Grant Thornton, BDO, RSM, Mazars

Pros

Strong brand recognition
Good for regulated industries (finance, insurance)
Full-service (can also cover ISAE 3000 for EU)

Cons

Higher cost ($35–60k)
Slower scheduling (3–6 month lead time)
Less SaaS-specific experience — more prep work required

Budget: $35,000 – $60,000

Big 4

Deloitte, PwC, KPMG, Ernst & Young

Pros

Maximum credibility — accepted by all enterprise procurement teams
Useful when targeting Fortune 500 or financial sector clients

Cons

Very high cost ($60–120k+)
Long lead time (6–12 months to schedule)
Overkill for APSOLU Pro at current ARR stage

Budget: $60,000 – $120,000+

Recommended path:Use a compliance automation platform (Vanta or Drata) to automate evidence collection and integrate directly with GitHub, Vercel, Clerk, and Supabase. These platforms have pre-negotiated audit bundles with specialist firms (A-LIGN, Schellman, Prescient Security) at fixed fees, reducing both cost and coordination overhead. Vanta’s startup program offers discounted rates for early-stage SaaS.

5. Compliance Automation Tooling

Manual evidence collection for SOC 2 is extremely time-consuming. Compliance automation platforms reduce the internal effort by 60–70% by pulling evidence automatically from integrations.

VVantaRecommended

Market leader for startup/scale-up SOC 2 automation. Integrates with GitHub, Vercel, Clerk, Supabase, Cloudflare. Automated evidence collection, audit-ready dashboard. Startup program available.

$10,000 – $18,000/year /year

DDrata

Strong competitor to Vanta. Excellent UI and evidence workflow. Similar integrations. Slightly more expensive at early stage but stronger for multi-framework (SOC 2 + ISO 27001 + GDPR).

$14,000 – $22,000/year /year

SSecureframe

Cost-effective alternative. Good for companies at seed/early stage. Fewer integrations than Vanta/Drata but solid for the core SOC 2 workflow.

$8,000 – $14,000/year /year

6. Effort & Budget Estimate

All figures are estimates for a cloud-native SaaS at APSOLU Pro’s current maturity level. Prices are in USD, excluding VAT.

Item	Who	Low estimate	High estimate	Notes
Compliance automation platform (Year 1)	External — SaaS	$10,000	$18,000	Vanta recommended. Startup discount may apply.
External penetration test	External — security firm	$8,000	$15,000	Web app + API scope. Annual cadence required.
SOC 2 Type II audit fee	External — CPA firm	$18,000	$35,000	Specialist SaaS firm (A-LIGN / Schellman). Fixed fee.
Policy writing (if outsourced)	External — consultant or legal	$3,000	$8,000	Can be done internally (saves cost). Templates exist.
Security awareness training platform	External — SaaS	$500	$2,000	KnowBe4, Curricula, or free Teachable alternative.
Log aggregation / SIEM	External — SaaS	$1,200	$4,800	Axiom ($100/mo), BetterStack, or Datadog (higher end).
Cyber insurance (recommended)	External — insurer	$2,000	$5,000	Annual premium. Not strictly required for SOC 2 but expected by enterprise buyers.
Total external budget (Year 1)		$43,000	$85,000	Recurring ~50% from Y2 (audit renewal + platform)

Internal effort — 5–8 j/h (person-days of high-attention work)

1–1.5 j/h

Policy writing & approval

Security owner + Christophe

0.5–1 j/h

Risk register & vendor assessments

Security owner

1 j/h

Technical hardening (MFA, SAST, logs)

Developer

0.5 j/h

Access reviews (quarterly, 4×/year)

Security owner

0.5 j/h

Penetration test coordination & remediation

Developer + security owner

1 j/h

Auditor fieldwork (RFI responses, evidence packaging)

Security owner

0.5 j/h

Tabletop exercise + DR test

Full team (half-day each)

The 5–8 j/h estimate is the minimum if a compliance automation platform (Vanta/Drata) is in place from day one. Without tooling, internal effort easily triples (15–25 j/h) due to manual evidence collection, spreadsheet tracking, and auditor back-and-forth.

7. Quick Wins — Start This Week

Several high-impact actions require zero external budget and move the needle immediately on the gap analysis:

Enforce MFA for admins

High impact

Effort:30 min

In Clerk Dashboard → Organization Settings → require MFA for org:admin role. Closes CC6 gap immediately.

Enable Dependabot on GitHub

High impact

Effort:15 min

Settings → Code Security → Dependabot alerts + security updates. Automated vulnerability detection — required for CC7.

Add CodeQL to CI pipeline

High impact

Effort:1h

Add GitHub Actions workflow with CodeQL analysis on every PR. Satisfies SAST requirement for CC5/CC8.

Document the hotfix circuit formally

Medium impact

Effort:2h

The HF-xxx process in CLAUDE.md is excellent but informal. Extract it into a Change Management Policy document. Closes CC8 gap with almost zero effort.

Appoint a Security Owner

High impact

Effort:0 min

Designate Christophe (or a co-founder / CTO) as Security Owner in writing. Required for CC1 — no hire needed, just a formal designation.

Set up log forwarding

High impact

Effort:2h

Configure Supabase log drain + Vercel log drain → Axiom or BetterStack. Centralized audit trail for CC4 — critical for Type II evidence collection.

Questions about this roadmap or our security posture? security@apsolu.app

Permissions & RBAC | Transparence & Audit Trail | DPA (GDPR) | APSOLU Pro