>At this point I think it would be pretty hard to do deals with public companies without having Type 2, and our domain isn't even that security focused. Even i

>At this point I think it would be pretty hard to do deals with public companies without having Type 2, and our domain isn't even that security focused. Even if you avoid SOC2, the security questionnaires (mostly avoidable if you have SOC2) from large companies can be so onerous if you're doing any sensitive work for them that SOC2 would be cheaper and less effort than the time spent on the questionnaires and infrastructure changes to meet them.