Ok, so I’ve read the comments here and from a business perspective, none of them really hit the right answer. I noticed in your post you mention that your clie

Ok, so I’ve read the comments here and from a business perspective, none of them really hit the right answer. I noticed in your post you mention that your clients are really big companies. Which leads me to wonder how you haven’t seen a SOC2 request yet as it’s fairly prevalent among larger clientele. The real answer here lies in what your offering and who your target client is. If they’re large clients, going through a SOC2 audit and compliance cert is more than worthwhile as you’ve likely been lucky so far in not needing it. You’re going to need it once you’ve hit that stage where you aren’t just selling demos to team leads anymore and actually negotiating contracts with legal departments. I have 2 buddies that have built SAAS type solutions for enterprise (both ex enterprise engineers building solutions for the same jobs they left) that are solo and have gone through SOC2 because the clients they’re selling to require it. The real answer to this is more about who your building for and selling to. At the end of the day, it’ll be an annoying process, but not overly complicated for a 1-person company to go through. It’s largely documentation based, which most of that is easily c/p from a template all the overpriced consultants use. I don’t mean to downplay the integrity of the cert, it’s that the experience for just you isn’t going to be the compliance nightmare that it is for large teams of people that need to worry about door access control or group policy defaults. As long as all of the underlining tools and platforms you use are also Compliant, you’re audit will be easier. Just plan to have to spend a TON of time in MS Word.