For such a small company I would probably expect that data like that would probably just live in a cloud service like GSuite that’s already SOC2 compliant, then

For such a small company I would probably expect that data like that would probably just live in a cloud service like GSuite that’s already SOC2 compliant, then if you’re running software integrations against that data, you’re spinning up isolated SOC2-compliant cloud servers to do so. Unfortunately unless you get ridiculously creative and put in a bunch of extra time instead of cloud service spend, SOC2 compliance is gonna be expensive