Compliance & AssuranceSOC 2
We scope the trust services criteria, close control gaps, set up continuous evidence collection and guide you through a Type I or Type II audit by an independent CPA firm, so a customer security questionnaire stops being a blocker.
01Overview
SOC 2 is an independent report on the controls a service organisation uses to protect customer data, produced by a licensed CPA firm against the AICPA Trust Services Criteria. A Type I report describes whether controls are suitably designed at a point in time, and a Type II report also tests whether they operated effectively over a period, typically three to twelve months.
Enterprise and international customers of SaaS, cloud, fintech and outsourcing providers, often during procurement.
Security is always included. Availability, processing integrity, confidentiality and privacy are optional criteria.
An independent CPA firm. GoAgile prepares you and supports the audit, but cannot issue the report.
Many start with Type I to unblock deals, then move to Type II, which carries more weight.
02What we do
Designed to minimise effort for your team.
Decide the systems, services and trust services criteria in scope, and plan the observation period with your auditor.
You receive: A scope that satisfies customers without over-reaching.
Compare existing controls with the criteria and rank the gaps.
Right-sized documentation mapped to the criteria.
Access, change management, logging, vendor risk and incident response built and operating.
Collect evidence from cloud, identity, HR, code and ticketing systems and watch control health continuously.
A customer-facing page that shares your security posture and documents on request.
03How we work
A typical Type II journey.
Phase 1 · Weeks 1 to 4
Boundary, criteria and gap assessment.
Phase 2 · Weeks 4 to 12
Policies, controls and tooling.
Phase 3 · Months 3 to 9
Controls operate and evidence accrues.
Phase 4 · Months 9 to 11
Auditor fieldwork and report.
04Reference
The choices that matter most.
| Type I | Type II | |
|---|---|---|
| What it tests | Design of controls at a point in time | Design and operating effectiveness over a period |
| Typical period | A single date | Commonly 3 to 12 months |
| Customer weight | Useful to start | Preferred by most enterprise buyers |
| Typical use | Unblock early deals | Ongoing assurance |
| Criterion | Question | Included |
|---|---|---|
| Security | Is the system protected against unauthorised access? | Always |
| Availability | Is it available as committed? | Optional |
| Processing integrity | Is processing complete, valid and accurate? | Optional |
| Confidentiality | Is confidential information protected? | Optional |
| Privacy | Is personal information handled as promised? | Optional |
05Evidence sources
Continuous evidence from the tools your teams already use.
Logos are trademarks of their respective owners and are shown to indicate platforms we work with.
06Saudi Arabia and the GCC
A passport to global customers, and a base for local compliance.
SaaS and fintech companies in the Kingdom selling to international enterprises are asked for SOC 2 early in procurement.
Many SOC 2 controls match ECC and ISO 27001 controls, so one programme serves several frameworks.
Customers may also ask where data is hosted. We document residency choices.
We help you choose an independent CPA firm with regional experience.
07Why GoAgile
Continuous compliance, less spreadsheet.
Talk to a security specialistFewer screenshots, more continuous proof.
Engineers build them with your team.
We manage requests so engineers stay on product.
SOC 2, ISO 27001 and NCA together.
Customer and regulator documents in both.
Credentials
08Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
Enterprise customers were asking for a SOC 2 report the company did not yet have.
Result: The audit completed with the report customers had asked for.
The insurer needed certified information security management to win larger corporate accounts.
Result: Certification achieved first time, with an ISMS the team now runs itself.
The bank needed evidence that its people, processes and detection would hold up against a realistic attacker, in line with SAMA expectations.
Result: Detection gaps were fixed, playbooks were updated and the board received a plain-language report.
Client names are withheld for confidentiality.
09Related services
Each service stands alone and works better with the others.
Tell us your product, customers and timeline. We will propose a plan to Type I or Type II.
Start SOC 210Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.