We recently completed our SOC 2 Type 2 audit at Aithena. It's an important milestone for us, but there's more to what this process has taught us. It has been eight months of research, technical work, policy writing, difficult conversations between Will and I as co-founders, and a lot of learning about what it means to build and operate a trusted SaaS company. These are some of the things I've noticed that I thought were worth sharing.
What we knew, and what we didn't
We always knew privacy and security would be important for Aithena. Indeed, they matter for all companies, but they are truly important to us. Our previous careers in the pharma industry had shown us how seriously everyone treats customer data.
What we didn't know, early on, was what "good" actually looked like from a formal assurance perspective. Which frameworks would future customers ask about? How did SOC 2 differ from ISO 27001 / SOC1/3, HITRUST CSF? Those questions became more urgent as our customer conversations matured.
An early instinct was to not rush into it until the tech stack stopped changing so often. It felt like a control signed off on Monday might need attention again by Friday, so starting the audit too early would mean doing the same work several times over.
But also, if you wait too long, a customer's security review can come before you, and you won't have anything to show them.
I guess, the lesson we'd give another founder is: Be aware of SOC 2 early. Don't necessarily begin the audit early.
Understanding the framework while making early architecture, design, and procurement decisions means fewer of them need undoing later.
The research phase
Our first proper step was days of research on SOC 2, ISO 27001, GDPR, HIPAA, and the wider landscape of security regulation affecting SaaS companies. The overlaps and jurisdictional variations were initially overwhelming.
But the research forced us to answer questions we'd otherwise have deferred. What sits inside our tech stack? What customer data do we need, and why? Where does it live? How would we respond if something went wrong?
We completed Type 1 first. It's a point-in-time assessment: are the controls suitably designed and implemented? That was a useful early milestone that helped us to reassure the security team assessing our info sec posture. Type 2 feels like the next level up. It's an observation of whether those controls operate consistently over time.
For Aithena, the observation window was around four months, and the whole journey took around eight. During those eight months, compliance became part of daily work, reviewing alerts, supplying evidence and correcting issues. We had to make sure that when systems changed, controls stayed aligned with them.
By the time the Type 2 report arrived, we didn't feel dramatically different. It confirmed the way we'd learned to operate in business-as-usual mode.
The hardest part wasn't the technology
Our development team established a lot of solid practices, so many technical foundations were already in place. The audit still pushed us to formalise areas like encryption, device management, secure development, access control, change management, penetration testing, and incident-response exercises. The harder work was elsewhere.
SOC 2 relates to technology, people, and company operations. Doing it well requires someone to hold a view across the whole organisation. For a young company, that also means formalising practices larger organisations already have. We wrote around 25+ new company policies during the process. Some decisions were straightforward, while others needed proper conversations between us. Many were not mandatory but surfaced our unique gaps for our particular team make-up.
By the end of the audit, Aithena emerged as a stronger, more mature company, building and deploying cutting-edge AI solutions for companies in one of the most stringent industry sectors.
So, here's a list of what I would tell another founder:
- Learn about the framework early, even if you're not ready to begin the audit. It shapes architecture, procurement, and hiring decisions.
- Don't confuse awareness with starting immediately. A rapidly changing stack makes continuous compliance harder than it needs to be.
- Don't wait until a missing report costs you a contract. Being prepared, as with most things, is key.
- Treat it as a company-wide initiative. Leadership across people, policies, and operations is where most of the effort goes. The practices don't stop when the audit ends.
- Create practices you genuinely intend to follow. Compliance done properly should feel like how you already work.
- Use the process to learn. Curiosity and adaptability matter more than being the deepest technical expert.
Completing our SOC 2 Type 2 audit is an achievement we're proud of, and thank you to our development team and everyone who helped us get there. More importantly, the process has made Aithena a stronger company and of course, the work continues.
