{"head":{"title":"SOC 2 for Software Teams: Criteria and Controls | OceanLab","description":"What SOC 2 means for software teams: Type I vs Type II, the Trust Services Criteria and the engineering controls auditors test. Not legal advice.","canonical":"https://oceanlab.in/compliance/soc-2"},"slug":"soc-2","stats":{"builds":9,"industries":9,"countries":8},"featured":[{"meta":{"slug":"migdalor","industry":"regtech","projectType":"Audit readiness tracker","country":"il","tags":["saas"],"compliances":["SOC 2","ISO/IEC 27001:2022","Israeli Protection of Privacy Law (Amendment 13)","Israeli Data Security Regulations","GDPR"],"cover":{"src":"/case-studies/migdalor/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Migdalor - SOC 2 and ISO 27001 Audit Readiness Tracker for Startups","description":"Designed and built a clickable audit readiness tracker for startups preparing for SOC 2 and ISO/IEC 27001: one control library mapped to both frameworks, automated tests against cloud, identity, code, HR and device systems, and an inbox that chases the evidence nobody can automate.","category":"RegTech / Audit Readiness","client":"Yarkon Stack"}}},{"meta":{"slug":"kleidi","industry":"internal","projectType":"SaaS admin dashboard","country":"gr","tags":["saas","enterprise"],"compliances":["GDPR","SOC 2","ISO/IEC 27001"],"cover":{"src":"/case-studies/kleidi/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Kleidi - SaaS Admin Console with Consented Support Access and a Full Audit Trail","description":"Designed and built a clickable internal admin console for an Athens SaaS company that sells housekeeping software to EU hotels: find any tenant and see everything about it on one page, enter a customer's workspace only with their consent, work GDPR data requests on the clock, and give staff elevated rights only for a limited window with someone else's approval.","category":"Internal Tools / SaaS Admin Console","client":"Myrtaki Software"}}},{"meta":{"slug":"umurinzi","industry":"security","projectType":"Security posture dashboard","country":"rw","tags":["enterprise","healthcare"],"compliances":["Rwanda Law No. 058/2021 (personal data)","ISO/IEC 27001:2022","SOC 2","CIS Benchmarks (AWS, Google Cloud)"],"cover":{"src":"/case-studies/umurinzi/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Umurinzi - Cloud Security Posture and Control Mapping Dashboard","description":"Designed and built a clickable cloud security posture dashboard for a Kigali healthtech on AWS and Google Cloud: one findings queue checked against the CIS Benchmarks, identity risks and internet exposure in one view, every check mapped to ISO 27001 and SOC 2 controls, and a residency check for Rwandan patient data.","category":"Cybersecurity / Cloud Security Posture","client":"Isimbi Health Ltd"}}},{"meta":{"slug":"riegel","industry":"web3","projectType":"Institutional MPC custody","country":"de","tags":["web3","wallet","fintech","enterprise"],"compliances":["KWG","MiCA","Transfer of Funds Regulation (travel rule)","GwG","DORA","GDPR","ISAE 3402 / SOC 1","ISAE 3000 / SOC 2","FIPS 140-2 / 140-3 Level 3"],"cover":{"src":"/case-studies/riegel/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Riegel - Institutional MPC Custody Platform with Quorum Approvals and Client Policies","description":"Designed and built a clickable client console for a German crypto custodian's MPC custody platform: institutions see their vaults and holdings, follow every transaction from request to final confirmation, approve with a security key against a quorum per approver group, and test their own first-match withdrawal policy before it goes live.","category":"Web3 / Institutional Custody","client":"Hochwarth Verwahrung"}}},{"meta":{"slug":"cryptotax","industry":"accounting","projectType":"Crypto tax reporting","country":"us","tags":["fintech","tax","ai","saas"],"compliances":["SOC 2 Type II","IRS Form 8949","AICPA SOC","GDPR"],"cover":{"src":"/cryptotax-2.png","width":1440,"height":1383}},"text":{"en":{"title":"CryptoTax - FIFO Tax & PnL Reporting Engine for Retail Crypto Investors","description":"Built a tax and portfolio reporting platform that ingests transactions from 30+ exchanges and wallets, computes FIFO cost-basis, and generates IRS Form 8949 + Schedule C in one click - shipped from clickable AI prototype to production in 10 weeks.","category":"FinTech / Tax","client":"CryptoTax"}}},{"meta":{"slug":"shadoof","industry":"devtools","projectType":"Feature flags service","country":"eg","tags":["enterprise"],"compliances":["SOC 2","Egypt PDPL (Law No. 151 of 2020)"],"cover":{"src":"/case-studies/shadoof/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Shadoof - Feature Flag and Progressive Delivery Service for a Marketplace's Engineering Teams","description":"Designed and built a clickable feature flag console for the engineering teams of a Cairo online marketplace: targeting rules and sticky percentage rollouts per environment, change requests with a second approver for Production, kill switches for incidents and a full change history for every flag.","category":"Developer Tools / Feature Flags","client":"Khan Sukkar"}}}],"all":[{"slug":"pylon","title":"Building Pylon - Insurance operations console"},{"slug":"cryptotax","title":"CryptoTax - Crypto tax reporting"},{"slug":"kleidi","title":"Kleidi - SaaS admin dashboard"},{"slug":"migdalor","title":"Migdalor - Audit readiness tracker"},{"slug":"riegel","title":"Riegel - Institutional MPC custody"},{"slug":"shadoof","title":"Shadoof - Feature flags service"},{"slug":"tekm","title":"Tekmė - Workflow automation builder"},{"slug":"umurinzi","title":"Umurinzi - Security posture dashboard"},{"slug":"zarpe","title":"Zarpe - Employee onboarding"}],"byIndustry":[{"id":"accounting","label":"Accounting & tax","href":"/case-studies/industry/accounting","count":1},{"id":"ai","label":"AI agents & automation","href":"/case-studies/industry/ai","count":1},{"id":"devtools","label":"Developer tools & APIs","href":"/case-studies/industry/devtools","count":1},{"id":"hr","label":"HR & payroll","href":"/case-studies/industry/hr","count":1},{"id":"insurance","label":"Insurance","href":"/case-studies/industry/insurance","count":1},{"id":"internal","label":"Internal tools & ops","href":"/case-studies/industry/internal","count":1},{"id":"regtech","label":"RegTech & compliance","href":"/case-studies/industry/regtech","count":1},{"id":"security","label":"Cybersecurity","href":"/case-studies/industry/security","count":1},{"id":"web3","label":"Web3 wallets & infrastructure","href":"/case-studies/industry/web3","count":1}]}