CyberSoftware

CyberSoftware is a team of security engineers in Houston, Texas that helps B2B SaaS startups between two and fifty people achieve SOC 2 compliance. They build software to guide teams through gap remediation and evidence collection, while independent licensed U.S. CPA firms perform the actual audits. The company is built for teams needing to move fast on their first security questionnaire rather than those with large compliance departments.

The process begins with a free readiness assessment that takes about 15 minutes and requires no payment or card. After scoring, teams pay a one-time $2,000 onboarding fee to receive custom policies written from their stack and an evidence binder. Finally, they enter a 12-month Type 2 term at $600 per month, which includes their first audit once the 3-month observation period completes.

The platform integrates directly with AWS, GitHub, and Google Workspace to pull evidence and trace it back to its source. It also connects to Google Workspace to enforce two-factor sign-ins and uses branch protection on main to secure code repositories. All evidence items link back to where they came from, ensuring nothing is made up during the audit.

The free readiness assessment provides a score out of 100, identifies gap categories with exact counts, and writes out two or three specific findings. This score recomputes automatically whenever a user changes an answer, and the full written gap list and remediation tooling are included after the one-time payment.

The initial onboarding fee is $2,000 one time, while the ongoing Type 2 subscription is $600 per month on a 12-month term. Teams can also pay $6,600 up front for the first year to save $600, or add an optional Type 1 examination for an additional $2,000 if needed sooner.

The company is located at 131 Continental Dr, Suite 305, Newark, DE 19713, US, though their team operates out of Houston, Texas. They offer a free readiness assessment with no card required, and customers can request a review call directly from their dashboard after logging in.

The 12-month term commits customers to continuous evidence collection, guided monthly check-ins, and drift alerts that trigger when a control slips. The first Type 2 audit starts automatically once the 3-month observation period completes, with no separate auditor invoice charged at that time.

Refunds are allowed within 7 days of payment for the entry fee or the first Type 2 charge, releasing the customer from the term. After this window, the full 12-month term applies with no prorated refunds, though access continues to the end of the cycle.

The platform generates custom policies and evidence checklists tailored to the user's stack rather than using templates with logos. Users remain responsible for implementing the actual controls and owning the audit outcomes, with final documents requiring review by qualified professionals.

The company is not a CPA firm; instead, it partners with independent licensed U.S. CPA firms to sign the reports. This separation ensures the report remains credible, as the software team handles the remediation guidance while the auditors perform the examinations.

The first Type 2 audit is included inside the 12-month term, meaning there is no second invoice from the auditor. The assessment itself is completely free, allowing teams to choose their path knowing their own score and gap list in front of them.

The software always shows users what comes next in the four-step process, from answering plain questions about their stack to receiving a signed report. No compliance team is needed to navigate the system, as the interface maps each answer to specific SOC 2 controls.

The readiness assessment includes a score out of 100 and identifies gaps such as MFA on every system, access control, and change management. It also highlights medium-risk areas like vendor risk reviews and incident response plans that need attention.

The company targets B2B SaaS startups with two to fifty people running cloud products that handle customer data. They are designed for teams closing enterprise deals that require SOC 2, rather than those with established 200-person compliance teams.

The platform allows users to start the Type 2 term whenever they are ready after onboarding, with no sales call required to see prices. Every payment is attached to the right company inside the account, and the checkout happens after the free readiness results are visible.