SOC 2 questions, answered.

B2B SaaS startups, usually between two and fifty people. Running a cloud product, handling customer data, closing enterprise deals that require SOC 2. If the founder is the one reading this, you're the target. We are not for Fortune 500s with 200 person compliance teams. We are for the founder who just got the security questionnaire and needs to move fast.

Sign up and answer the intake. There is nothing to pay and no card to enter. When you submit it you get a readiness score out of 100, the tier that score lands in, how many of the controls scored are already passing, every gap category with exact counts of what needs remediating and what needs evidence, and two or three of your own findings written out in full with what closing each one takes. It also tells you exactly how many findings are in the rest of your report. The score lives in your account and recomputes whenever you change an answer. What it is not is a document you can download and take elsewhere: the full written gap list and the remediation tooling come with an entry payment, and you can ask for a readiness review from your results page, where you name the times that suit you and a member of the team confirms one within a business day.

The assessment is free. Then most teams pay $2,000 once to get audit-ready, and start SOC 2 Type 2 at $600 a month on a 12-month term, or $6,600 paid up front for the first 12 months. Your first SOC 2 Type 2 audit is included in the term, so the first year all in is $9,200 with a Type 2 report at the end. If you need a SOC 2 Type 1 report sooner, add the Type 1 examination for $2,000 more, auditor engagement fee included, at checkout or any time before your Type 2 starts; that makes the entry $4,000 and the first year $11,200.

The whole 12 months, on both sides. You are committing to the full term rather than to a month at a time, and across it we are committing to keep you audit-ready: continuous evidence collection, guided monthly check-ins, drift alerts when a control slips, and your first SOC 2 Type 2 audit, which starts on its own once the 3-month observation period completes and carries no separate auditor invoice. Pay it as $600 a month or settle it up front as one $6,600 invoice; the commitment is identical either way and paying up front is the cheaper of the two. The exact terms are in the Terms of Service, and you accept them in writing before the first charge.

Type 2 isn't a one-time thing the way Type 1 is. It's an examination of your controls operating consistently over a window of time, which means we have to actually be watching your controls during that window. A subscription matches that work: continuous evidence collection, monthly check-ins, and deviation tracking. The audit at the end of the window is part of the term rather than a separate purchase, which is the reason the term is a commitment on both sides.

Type 2 runs on a 12-month term, so the term runs its full 12 months and you keep complete access to the end of it, including the first Type 2 audit, which starts on its own once your 3-month observation window closes. After that the Type 2 features pause, meaning the monthly check-ins, deviation tracking and the active observation window, while your issued reports stay accessible forever. Starting a new term picks up where the last one left off.

You get a seven-day grace period. Day zero we email you and show a banner in your dashboard. Day three we send a reminder. If your card is still failing on day seven, Type 2 features pause until you update your payment method. Any report already issued is never affected. The seven-day window is deterministic on our end regardless of what Stripe's retry schedule is doing in the background.

Because we built Polara Labs for one narrow slice of the market, startups under fifty people, and we don't have the overhead the bigger platforms carry. No enterprise sales team, no SF office, no marketing blitz. Built the pipeline ourselves and cut the fat. Big platforms are optimized for companies that can pay $25K a year without blinking. That isn't you right now, and we don't want it to be us either.

You outgrow us when the tool stops fitting your company, not on any deadline we set. Usually that's around 100 people, once you need a framework we do not cover (we cover SOC 2 and ISO 27001), or the moment you hire a dedicated GRC lead. At that point Vanta, Drata, or a bigger enterprise GRC is a better fit than us, and we will tell you. Your audit history and policies move with you. We are a launchpad, not a lifer subscription. That is the whole point.

Type 1 proves your controls are designed correctly at a single point in time. You can get one starting at about a week, and enterprise buyers usually accept it to unlock a deal. Type 2 proves your controls actually worked over an observation period. Polara Labs locks your first Type 2 observation at 3 months, the minimum first-year window under SOC 2, so customers reach their first Type 2 audit on a predictable schedule. The subscription runs continuously during and after that window on a 12-month term, and the audit at the end of the first window is inside it.

When you choose. Step 1 has no clock: work through your gaps and policies at your own pace. Once your package is built you start SOC 2 Type 2 from your dashboard whenever you are ready, and the 12-month term and the 3-month observation window begin that day. Your first Type 2 audit starts on its own when the observation window closes, and it is included in the term.

Yes. Add the SOC 2 Type 1 examination for $2,000 more, auditor engagement fee included, at checkout or any time before your Type 2 starts. Your package goes to an independent partner auditor as soon as it is built, and once the Type 1 report is issued you can still start Type 2 whenever you are ready.

There is no published price for it, deliberately. You ask for an audit quote from your dashboard, our team negotiates with independent audit firms on your behalf, and the engagement is quoted before it begins. Publishing a figure would mean pricing an audit firm's time before anyone has looked at your systems, and a number set that way tells you nothing about what your own engagement will run.

Once your Type 1 report is issued, the dashboard offers the Type 2 subscription with either way of paying for the term. Your assessment data, policies, evidence and audit history all carry over, so there is nothing to re-enter. The 3-month observation window starts the day your subscription activates, and your first Type 2 audit begins on its own the day that window closes.

Type 1 goes audit-ready starting at about a week of focused work. Intake takes about 15 minutes for the half that returns your score, and the rest can wait. Evidence upload and remediation depend on how prepared you are, but the platform tells you exactly what is needed and tracks progress live. Once you hit 100 percent, auditor review typically takes a few business days. Type 2 then runs on top, quietly, through its observation window.

Yes. The intake reads like a founder survey in plain English, not a GRC questionnaire. The dashboard tells you what to fix and what to upload in order. If something needs engineering help, it says so plainly. You do not need a compliance manager, a security engineer, or a consultant on retainer to finish a SOC 2 with Polara Labs.

Yes. We generate the full policy set, control matrix, and evidence checklist that auditors expect, then hand the entire package to an independent partner auditor, a licensed U.S. CPA firm. You implement the controls we outline. The auditor does the examination. We stay aligned until your report is issued, and through Type 2.

The industry had a recent high profile scandal where a venture backed compliance platform was caught producing hundreds of SOC 2 reports with identical boilerplate and pre written auditor conclusions. We built the opposite. Our gap analysis is a deterministic rules engine, not AI. Policies are generated from your data and fail loudly rather than fabricating claims. Examinations are performed by independent partner auditors with no referral fees. Every report is unique because every company is different. See the ethics section on the homepage for the full architecture.

They are independent partner auditors, licensed U.S. CPA firms. Polara Labs is not a CPA firm and does not issue the opinion. The specific firm on your engagement is disclosed to you on request before you sign the engagement letter, so you can verify their credentials with the state board. If you already work with a CPA firm that meets AICPA independence requirements, we can onboard them.

Your data stays in the pipeline. The AI we use to draft policies processes information to generate output but does not store or train on it. Evidence files are encrypted at rest in S3 with presigned URLs, and only you and your assigned auditor can access them. Each engagement is isolated. No cross customer learning.

Every policy is built from your actual assessment answers and uploaded evidence, not templates with your logo swapped in. The system traces each claim back to your data. If your evidence doesn't support a statement, generation fails rather than guessing. You can edit any policy before it reaches the auditor, and the auditor independently reviews everything before signing. Two layers of human verification on top of the AI output.

Nothing. Really. You don't need existing policies, you don't need a GRC hire, you don't need to know what SOC 2 means. You just need about 15 minutes to answer questions about your company, your cloud provider, the tools you use, and how you handle customer data. The platform takes it from there and tells you exactly what to do next.

You keep everything. Your audit reports are yours, the policies we generated for you are yours, your evidence is yours. Export the whole package and walk, in the formats the next platform can read. Nothing is held back to make leaving harder, and you do not have to ask us for a copy of your own file.

We generate policies, evidence checklists, and remediation guidance. You stay responsible for implementing controls and owning the audit outcome. Before final documents reach your auditor, it is a good idea to have qualified internal or external reviewers look at them, the same way you would with any compliance output. We never represent our output as a substitute for legal or professional advice.