SiteOwl: from “trust us” to a SOC 2 report
Physical security SaaS, US, 2023
As SiteOwl moved toward larger customers, more and more prospects asked for a SOC 2 report before trusting SiteOwl with their data. I led the technical side of SOC 2 readiness, while SiteOwl’s Chief Product Officer ran the organizational side, with a compliance platform guiding the steps. That meant tightening the AWS network setup, turning the recovery and incident response plans into playbooks rehearsed in dry runs, and working with the penetration testers on the first external test. They found no serious gaps; we addressed what they flagged, and the fixes were retested and confirmed. SiteOwl’s offshore development team handled the work as ordinary tasks in its regular sprints.
SiteOwl completed SOC 2 Type 1, a point-in-time check, about six months after starting, and Type 2, which covers months of evidence, later the same year. From then on we renewed the report every year with an external auditor. Prospects and customers, including Fortune 500 companies, got an independent auditor’s report instead of just a promise that their data was safe.
Read the case study