Migdalor - SOC 2 and ISO 27001 Audit Readiness Tracker for Startups
Audit Readiness Platform for a Tel Aviv SaaS Company
Designed and built a clickable audit readiness tracker for startups preparing for SOC 2 and ISO/IEC 27001: one control library mapped to both frameworks, automated tests against cloud, identity, code, HR and device systems, and an inbox that chases the evidence nobody can automate.
Most of our work is under NDA. Per agreement, we can share the work but not the company details - all names and identifying information shown here have been changed.
Impact
Dashboard, control library, control detail with 5 tabs, automated tests and the evidence requests inbox. Every one of the 28 controls opens its own detail page.
Covering 27 SOC 2 criteria and 42 ISO 27001 clauses and Annex A controls. 26 of the 28 controls satisfy both frameworks, so evidence is collected once.
Run against Okta, AWS, GitHub, Jamf, HiBob, Snyk, Jira and Slack, each with per-resource results and a 14-run history. Muting a resource needs a reason and an expiry and is shown to the auditor.
18 evidence requests, 10 people and a SOC 2 Type II audit at day 89 of its 184-day observation period, with an ISO 27001 Stage 2 audit booked next.
The Problem
Yarkon Stack ran its first SOC 2 from a 140-row spreadsheet, a shared drive of screenshots and a Slack channel. Engineers retook the same AWS console screenshots every quarter, offboarded employees kept GitHub access for weeks because nobody checked, and when the audit firm asked for 25 samples of new hires the team spent two weeks reconstructing them.
Our Solution
Migdalor replaces the spreadsheet with a control library that knows what evidence each control needs, collects most of it automatically every day and shows one readiness score and one gap list. Yarkon Stack built it for its own audits and now sells it to other startups selling abroad, each in its own workspace.
The Challenge: Two Frameworks, One Part-Time Owner
A startup's first enterprise customer asks for a SOC 2 report, the next one for ISO 27001. Compliance is usually run by the CTO or a first security hire, alongside a day job, with systems that are almost all cloud and SaaS.
The Same Work for Two Frameworks
SOC 2 is assessed against the AICPA Trust Services Criteria; ISO/IEC 27001:2022 needs an ISMS and a Statement of Applicability covering 93 Annex A controls. One quarterly access review supports both, but kept in separate spreadsheets it gets evidenced twice.
Evidence Dated Inside the Period
A SOC 2 Type II report tests whether controls operated over an observation period, generally 3 to 12 months. Evidence collected late or covering the wrong dates does not count, and nobody sees the gap until the auditor asks.
Config Drift Between Screenshots
MFA, disk encryption, branch protection and leaver deprovisioning can break any day, not just the day someone takes a screenshot. A laptop left unencrypted or a GitHub account left active needs to surface within days, not at audit time.
Evidence Only People Can Provide
Tabletop exercises, restore tests, background check records and policy acknowledgements cannot be pulled from an API. Owners go on leave or reserve duty, reminders get ignored, and submissions need a reviewer who can reject them with a reason.
Our Approach: From Audit Rules to a Clickable Tracker
Spec and Rules Research
Mapped 9 roles from workspace owner to auditor, trust centre visitor and vendor contact, 39 screens across the workspace and the auditor, employee, trust centre and vendor portals, and the data model for controls, mappings, tests, evidence, requests, policies, risks, vendors, audits and questionnaires. Wrote down the rules the design follows: SOC 2 Type I and Type II, ISO/IEC 27001:2022 and its Statement of Applicability, the Israeli Protection of Privacy Law with Amendment 13 and the Data Security Regulations, and GDPR for EU customers.
Clickable Demo on a Production UI Kit
Built 5 key screens on a production dashboard kit: the dashboard with readiness score, readiness by framework with a SOC 2 and ISO 27001 switch, control status and needs-attention items; the control library with filters and a quick view; control detail with overview, tests, evidence, mappings and activity tabs; tests with a result panel and resource mutes; and the evidence requests inbox with accept, reject, reassign and snooze. All actions run on local state.
What a Production Build Adds
Read-only integrations with cloud, identity, code, HR, device, ticketing and scanning systems behind a test engine, secrets kept in a vault, and tenant isolation between customer workspaces. An append-only audit log, evidence frozen once attached to an audit, and the remaining screens: readiness and gaps, onboarding, frameworks and SoA, policies, access reviews, risks, vendors, audits, the trust centre, questionnaires and the auditor and employee portals.
Why It Works: Readiness You Can Prove
One Control, Many Mappings
Each control carries its SOC 2 and ISO 27001 references as chips, and the Mappings tab lists the other controls that support the same requirement. Search works by control id, name, criterion or Annex A reference.
Problems Surface Before the Auditor
The dashboard lists tests failing for more than 7 days, leavers whose access is still active 24 hours after their end date, integration errors and auditor requests due within 3 working days. Each item links straight to the control, test or request.
Exceptions Stay Visible
A service account that cannot use MFA is muted with a required reason and an expiry of up to 12 months, and the mute is always shown to the auditor. Marking a control not applicable needs a reason that is carried into the Statement of Applicability.
Evidence Requests That Get Answered
Each request shows its control, due date, recurrence and reminders sent. A delegate takes over while the owner is away, reminders can be snoozed once for 7 days, and a rejected submission goes back to the owner with the reason.
Related case studies
View all: RegTech & compliance
Plumbline - AML Transaction Monitoring with Alerts, Cases and SAR Deadlines in One System
Designed and built a clickable AML transaction monitoring system for a US neobank and its sponsor bank: scenario alerts ranked by a transparent priority score, an investigation workspace that shows why each alert fired, real-time payment holds, and cases that count down to the SAR filing deadline.
Gija - KYC and KYB Case Management with Ownership Tracing and Four-Eyes Approval
Designed and built a clickable KYC and KYB case-management platform for a Vilnius electronic money institution: a case queue with SLAs, individual and business cases with registry comparison and beneficial ownership traced through every layer, an explainable risk score, four-eyes approval and requests for information sent to customers.
Enterprise Software Engineering - Human + AI
Contact Us
© 2026 - Copyright. All Rights reserved Oceanlab
Location
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
Enterprise Software Engineering - Human + AI
Contact Us
Locations
Global Headquarters
21 Merchant Road, 3rd Floor, Singapore 058267
Main corporate office and leadership operations
North America Office
548 Market Street, PMB 12345, San Francisco, CA 94104
Client operations and business development
India Office
402 Shivalik Shilp II, SG Highway, Ahmedabad 380015
Engineering and delivery center
© 2026 - Copyright. All Rights reserved Oceanlab