A structured, three-phase engagement — from first gap assessment through to a completed report, and the ongoing work that keeps it valid.
Before you can be audited, you need to actually be ready to be audited. Foundation is where that readiness gets built: a full gap assessment against the Trust Services Criteria relevant to your business, a control-by-control view of what's already in place versus what's missing, a policy library sized to your actual environment, and a clear, sequenced roadmap to audit-ready status. This phase also covers initial setup of your compliance automation platform, so evidence starts collecting automatically from day one rather than being reconstructed manually later.
This is the observation period — the months during which an auditor needs to see your controls actually operating, not just documented. We manage the operational side of that: collecting and organizing evidence as it's generated, preparing your team for auditor walkthroughs, and acting as the day-to-day liaison with your audit firm so technical and process questions get resolved without pulling your engineering or operations team off their actual work.
A SOC 2 report has a shelf life. Continuity keeps the compliance programme alive between audits — quarterly control reviews, ongoing evidence management so the next audit doesn't require another sprint, and renewal support when it's time to recertify. The aim is for compliance to become routine infrastructure, not a recurring emergency every time a deal depends on it.
No two engagements look the same, because no two companies are at the same starting point.
A 15-person team six months post-Series A needs a different shape of engagement than a 90-person company preparing for a Series C round with an existing security function already in place. Every StackBridge engagement is scoped individually around your team size, current maturity, and the timeline your buyers are actually asking about — which is exactly what a readiness call is for. As enterprise buyers increasingly evaluate vendors on AI governance and transparency alongside traditional security controls, the compliance foundation built today also becomes the foundation for whatever governance work comes next.
Type I confirms your controls are designed correctly at a single point in time. Type II confirms they operated effectively over a period — typically 3 to 6 months. Most enterprise buyers ultimately require Type II, though some companies start with Type I to demonstrate momentum early. We'll help you work out the right sequencing for the buyers you're actually selling to.
Foundation work typically runs several weeks depending on your starting point. The Type II observation period itself is set by the audit standard — usually 3 to 6 months — and can't be compressed, which is exactly why starting early matters more than most founders expect.
Meaningful time from a small number of people early on — mainly whoever owns security and IT decisions — then significantly less once evidence collection is automated. The engagement is built to minimise the drag on your engineering team specifically.
Our current focus is Australia and Singapore, reflecting where we have the strongest audit and platform partnerships. Get in touch and we'll let you know if we're a good fit for your situation.