Compliance simplified.

2 monthsfrom kickoff to the SOC 2 Type 1 report and ISO 27001 certification

How Wyra reached SOC 2 Type 1 and ISO 27001 within two months

Wyra builds a go-to-market intelligence platform for cloud partners and SaaS companies. We built its security programme across five areas and kept our team on call around the clock, so a question from Wyra’s engineers or from the auditor never waited for the next working day.

Wyra had its SOC 2 Type 1 report and its ISO 27001 certification within two months of kickoff, and it has since come back to us for its Type 2.

• Cloud security
• Endpoint security
• People
• Infrastructure
• Policies and procedures

“What you’ve delivered for Wyra has been truly exceptional — SOC 2 and ISO 27001 in such a short timeframe is no small feat. Couldn’t have asked for a better partner on this journey.”

20 weeksfrom kickoff to the SOC 2 Type II report and the HIPAA risk analysis

How Assemblage Health got SOC 2 Type II and its HIPAA risk analysis in one programme

Assemblage Health builds Avnii, an AI app that helps healthcare providers with clinical documentation. It needed a SOC 2 Type II report and a HIPAA security risk analysis, and we ran the two as one programme.

We set up the risk register and the ePHI inventory in the first three weeks, wrote 35 policies and procedures, prepared the BAA and DPIA templates, trained the team and reviewed the AWS business associate agreement. Then we prepared the evidence, supported the auditor through the SOC 2 Type II examination across all five Trust Services Criteria, and delivered the HIPAA security risk analysis alongside it.

• HIPAA risk analysis
• SOC 2 Type II
• Policies and procedures
• BAA and DPIA templates
• Workforce training

4 monthsfrom the start of the audit period to the signed SOC 2 Type II report

How Arali AI earned its first SOC 2 Type II report in four months

Arali builds an agentic AI revenue platform that reads customer signals and surfaces the next best action for sales and customer success teams. It needed its first SOC 2 Type II report, and a penetration test of the platform to go with it.

We mapped the controls across Security, Availability, Confidentiality and Processing Integrity, built the evidence with Arali’s engineers and ran a grey-box penetration test of the platform, its CRM included. The auditor issued Arali’s first SOC 2 Type II report four months after the audit period began.

• SOC 2 Type II
• Processing integrity
• Penetration test
• Evidence
• Audit support

4 monthsfrom the start of the testing period to the SOC 2 Type 2 report

How Forsys reached SOC 2 Type 2 across all five criteria in four months

Based in Milpitas, California, Forsys implements revenue and quote-to-cash systems for large enterprises, and an enterprise deal was waiting on its report. The scope covered all five Trust Services Criteria, so every control had to be in place and operating before the testing period began.

We mapped Forsys’s own policies to the criteria, built the evidence programme with its security team and supported them through a Type 1 and then a Type 2 report. The auditor issued the Type 2 report four months after the testing period began.

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

“Our SOC 1 and SOC 2 journey couldn’t have been made more simple. TCSA guided us throughout and helped us unblock our enterprise deal.”

5 frameworksrun off one control set

How Cargoflash runs five frameworks off one control set

Cargoflash builds cargo management software for airlines, ground handlers and forwarders. We have been its virtual CISO for several years, and we provided virtual DPO services to its group, Group Concorde.

Rather than keep separate documents for each standard, we built one set of more than 200 controls that answers ISO 27001, SOC 1, SOC 2, GDPR and the DPDP Act, with evidence collected every quarter. Cargoflash holds ISO 27001 certification and SOC 1 and SOC 2 Type II reports, two more group companies are ISO 27001 certified, and the same programme now covers the AI tools its teams use.

• vCISO
• vDPO
• ISO 27001
• SOC 1 and SOC 2
• DPDP and GDPR

Type 1SOC 2 report across all five Trust Services Criteria

How Personaify reached SOC 2 Type 1

Personaify builds AI that reviews leases, design drawings and project documents for commercial real estate teams, so landlords and tenants can open new spaces faster. Its customers hand over their own documents, so they want to see how that data is protected before they sign.

We ran the gap assessment against the Trust Services Criteria, reviewed the policies and brought them in line with the criteria, built the control matrix with Personaify’s engineers and reviewed the evidence control by control. The auditor then examined the controls and issued Personaify’s SOC 2 Type 1 report.

• Gap assessment
• Policy review
• Control build
• Evidence
• Audit support