SOC 2 questions, answered

B2B SaaS startups, usually between two and fifty people. Running a cloud product, handling customer data, closing enterprise deals that require SOC 2. If the founder is the one reading this, you're the target. We are not for Fortune 500s with 200 person compliance teams. We are for the founder who just got the security questionnaire and needs to move fast.

Security is always in scope, because every SOC 2 report includes it. The other four trust services categories, Availability, Processing Integrity, Confidentiality and Privacy, can be added in the assessment, and each one you add is then part of your report, your engagement letter and the auditor’s examination.

Sign up and answer the intake, with nothing to pay and no card to enter, and you get a readiness score out of 100, every gap category with exact counts, and two or three of your own findings written out in full. If it finds gaps, your account opens a free workspace where you see every gap with its steps, close gaps and upload up to ten proof files. AI help, policy writing beyond one sample policy, the report and the audit come with a paid plan, and there is no free report to download.

Star is $2,000 one time. Orbit is $7,800 a year and Constellation is $10,800 a year, each with your SOC 2 Type 2 audit included every year. The assessment is free.

The whole 12 months, on both sides. You are committing to the full term rather than to a month at a time, and across it we are committing to keep you audit-ready: evidence collection from your connectors, guided monthly check-ins that flag a control that stopped holding, deviation tracking, and that year's SOC 2 Type 2 audit, with no separate auditor invoice. The first starts on its own once your 3-month observation window completes, and each later one runs when the plan renews, a year after the examination before it. Orbit and Constellation are billed yearly. If you came through Star you can pay for Orbit monthly instead, and the commitment is the same 12 months either way. The exact terms are in the Terms of Service, and you accept them in writing before the first charge.

Orbit and Constellation run on a 12-month term. If you cancel before the term ends, access continues through the end of the 12 months, including that year's SOC 2 Type 2 audit. In your first year that audit starts on its own once the 3-month observation window closes. If you pay for Orbit monthly, billing continues to the end of the term as well. Then the plan stops, and your issued reports stay accessible forever. Starting a new term picks up where the last one left off.

You get a seven-day grace period. Day zero we email you and show a banner in your dashboard. Day three we send a reminder. If your card is still failing on day seven, Type 2 features pause until you update your payment method. Any report already issued is never affected. The seven-day window is deterministic on our end regardless of what Stripe's retry schedule is doing in the background.

Because we built Polara Labs for one narrow slice of the market, startups under fifty people, and we don't have the overhead the bigger platforms carry. No enterprise sales team, no SF office, no marketing blitz. Built the pipeline ourselves and cut the fat. Big platforms are built for companies with an enterprise compliance budget. That isn't you right now, and we don't want it to be us either.

You outgrow us when the tool stops fitting your company, not on any deadline we set. Usually that's around 100 people, once you need a framework we do not cover (we cover SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, PCI DSS and NIST CSF 2.0), or the moment you hire a dedicated GRC lead. At that point Vanta, Drata, or a bigger enterprise GRC is a better fit than us, and we will tell you. Your audit history and policies move with you. We are a launchpad, not a lifer subscription. That is the whole point.

One SOC 2 Type 2 examination in each contract year of Orbit or Constellation, by an independent licensed U.S. CPA firm, with no separate auditor invoice. The first starts once your 3-month observation window completes. After that, your plan renews on its anniversary, and each contract year includes one more examination, which starts after that year's observation window.

Your plan renews on its anniversary, and each contract year includes one more examination, which starts after that year's observation window. Orbit renews at $7,800 a year and Constellation at $10,800 a year, each with that year's audit included. Polara never reprices your term.

$2,000 more on top of Star, so $4,000 in total if you buy both together. You can also add a Type 1 report on Orbit for $2,000.

Within 12 months of paying for Star, your first year of Orbit is $5,800: your $2,000 comes off the $7,800 price. It renews at $7,800 with your annual audit included. The offer shows in your dashboard while it applies.

Orbit is billed yearly. If you came through Star, you can take Orbit at $700 a month on a 12-month term instead, which is $8,400 over the term. Your Star payment comes off the yearly price only, so paying for the year makes your first year $5,800.

Yes. You pay the difference between the two plans, prorated to your term.

The Polara Preferred Pricing Network. When you need an outside party beyond the CPA firm, such as an ISO or AIUC-1 certification body or a penetration test, Polara arranges it and the party quotes its fee before you sign.

Only your plan and your team size. Polara never reprices a term after it starts.

Type 1 proves your controls are designed correctly at a single point in time. You can be audit-ready starting at about a week and have the report in about five to six weeks, and enterprise buyers usually accept it to unlock a deal. Type 2 proves your controls actually worked over an observation period. Polara Labs starts your first Type 2 on a 3-month observation window, so you reach your first Type 2 audit on a predictable schedule. Three months is a common floor among CPA firms, not an AICPA rule, and the window can be extended if a buyer asks for a longer one. The subscription runs continuously during and after that window on a 12-month term, and the audit at the end of the first window is inside it.

When you choose. Step 1 has no clock: work through your gaps and policies at your own pace. Once your package is built you start SOC 2 Type 2 from your dashboard whenever you are ready, and the 12-month term and the 3-month observation window begin that day. Your first Type 2 audit starts on its own when the observation window closes, and it is included in the term.

Yes. A SOC 2 Type 1 report is $2,000 more on top of Star, at checkout or later from your dashboard. Your package goes to an independent licensed U.S. CPA firm as soon as it is built, and once the Type 1 report is issued you can move to Orbit whenever you are ready.

Type 1 goes audit-ready starting at about a week of focused work. Intake takes about 30 minutes for the half that returns your score, and the rest can wait. Evidence upload and remediation depend on how prepared you are, but the platform tells you exactly what is needed and tracks progress live. Once you hit 100 percent, auditor review typically takes a few business days. Type 2 then runs on top, quietly, through its observation window.

Yes. The intake reads like a founder survey in plain English, not a GRC questionnaire. The dashboard tells you what to fix and what to upload in order. If something needs engineering help, it says so plainly. You do not need a compliance manager, a security engineer, or a consultant on retainer to finish a SOC 2 with Polara Labs.

The industry had a recent high profile scandal where a venture backed compliance platform was caught producing hundreds of SOC 2 reports with identical boilerplate and pre written auditor conclusions. We built the opposite. Our gap analysis is a deterministic rules engine, not AI. Policies are generated from your data and fail loudly rather than fabricating claims. Examinations are performed by independent partner auditors with no referral fees. Every report is unique because every company is different. The full architecture is in our ethics commitment.

They are independent partner auditors, licensed U.S. CPA firms. Polara Labs is not a CPA firm and does not issue the opinion. The specific firm on your engagement is disclosed to you on request before you sign the engagement letter, so you can verify their credentials with the state board. If you already work with a CPA firm that meets AICPA independence requirements, we can onboard them.

AI drafting runs on Anthropic Claude models hosted on Amazon Bedrock inside our own AWS account, in the United States. Our commercial agreement with AWS forbids training on your data, Bedrock does not store prompts or outputs, and only the minimum data each task needs is sent. Evidence files stay encrypted in our own AWS storage, reachable only by you and your assigned auditor through short-lived links. Each company is isolated.

Every policy is built from your actual assessment answers and uploaded evidence, not templates with your logo swapped in. The system traces each claim back to your data. If your evidence doesn't support a statement, generation fails rather than guessing. You can edit any policy before it reaches the auditor, and the auditor independently reviews everything before signing. Two layers of human verification on top of the AI output.

Nothing. Really. You don't need existing policies, you don't need a GRC hire, you don't need to know what SOC 2 means. You just need about 30 minutes to answer questions about your company, your cloud provider, the tools you use, and how you handle customer data. The platform takes it from there and tells you exactly what to do next.

You keep everything. Your audit reports are yours, the policies we generated for you are yours, your evidence is yours. Export the whole package and walk, in the formats the next platform can read. Nothing is held back to make leaving harder, and you do not have to ask us for a copy of your own file.

We generate policies, evidence checklists, and remediation guidance. You stay responsible for implementing controls and owning the audit outcome. Before final documents reach your auditor, it is a good idea to have qualified internal or external reviewers look at them, the same way you would with any compliance output. We never represent our output as a substitute for legal or professional advice.