• Two weeks of manual evidence collection before every annual audit consuming your engineering and compliance team's time for work that should be automated?

  • Control failures discovered during audit preparation -- a stale access review, a missed backup, an IAM misconfiguration -- that have been open for months?

SOC 2 Compliance Automation

SOC 2 Type II covers a 12-month observation period. Every control must operate continuously with documented evidence for the full period. The evidence exists in your systems -- AWS CloudTrail, GitHub pull request history, Okta access logs, ticketing system records. The problem is someone has to collect it, organise it, and deliver it to auditors on demand.
We build custom SOC 2 compliance automation: automated evidence collection from your cloud infrastructure and SaaS tools, continuous control monitoring with real-time alerting, policy management with employee acknowledgment tracking, and an audit-ready evidence library that reduces preparation time from weeks to hours.

  • Automated evidence collection from AWS, GCP, Azure, GitHub, Okta, and your SaaS tools -- every control documented on schedule without manual collection

  • Continuous control monitoring that alerts when a control fails the moment it happens, not when auditors discover it weeks later

  • Policy management portal with version control and employee acknowledgment tracking -- so your policy library is always current and always documented

  • Audit-ready evidence library that auditors access directly rather than you spending weeks assembling packages before each audit

RaftLabs builds custom SOC 2 Type II compliance automation -- automated evidence collection from AWS, GCP, Azure, and SaaS tools; continuous control monitoring with real-time alerting; policy management with employee acknowledgment tracking; vendor assessment workflow automation; and an audit-ready evidence library. Custom SOC 2 automation typically costs $25,000 to $70,000 depending on the number of controls, connected systems, and the scope of the policy management and vendor workflow requirements.

Vodafone
Aldi
Nike
Microsoft
Heineken
Cisco
Calorgas
Energia Rewards
GE
Bank of America
T-Mobile
Valero
Techstars
East Ventures

SOC 2 Type II is not a compliance exercise you complete and put on a shelf. The observation period is continuous. Evidence collection is continuous. Control monitoring is continuous. The audit is the annual moment when a third party examines whether you maintained that continuous posture -- and finds the gaps you did not.

The companies that pass SOC 2 Type II with minimal audit preparation time are the ones who automated evidence collection from the start. Their evidence library is already populated when the auditor asks. Their control failures were caught and remediated months before the audit. Their policy acknowledgments are current because the system enforced them. The audit is a review of an existing record, not an emergency assembly project.

What we build

Automated evidence collection from cloud infrastructure

Automated pipelines that pull SOC 2 control evidence from your cloud infrastructure and SaaS tools on a defined schedule. AWS CloudTrail and Config for configuration and access evidence. GitHub and GitLab for change management and code review evidence. Okta and Azure AD for identity and access management evidence. Jira or Linear for change ticket approval evidence. Datadog or CloudWatch for availability monitoring evidence. Third-party SaaS tool APIs for vendor management evidence. Each evidence item stored with control mapping, collection timestamp, and source -- so the evidence library is searchable, auditable, and arrives pre-populated for auditors rather than assembled under deadline pressure.

Continuous control monitoring and alerting

Real-time monitoring of your SOC 2 control environment with automated alerting when controls fail. MFA enforcement monitoring: alerting when an IAM policy or identity provider configuration disables MFA for any user. Public exposure checks: alerting when a database security group or storage bucket is misconfigured to allow public access. Backup monitoring: alerting when a scheduled backup job fails to complete. Access review deadline monitoring: alerting when quarterly access reviews are overdue. Stale access monitoring: alerting when offboarded users retain active access to any monitored system. Control failures caught when they happen -- not during audit preparation when the observation period is already over.

Policy management and employee acknowledgment

A centralised policy library with version control, approval workflows, and employee acknowledgment tracking. Policies stored with their current version, effective date, and change history. When a policy is updated, acknowledgment requests are sent automatically to all affected employees. Acknowledgment completion tracked per employee and per policy with timestamps. Overdue acknowledgment alerts for managers. New employee onboarding workflow that gates system access on required policy acknowledgments. Policy acknowledgment reports exportable for auditors showing current completion status across the full policy library and the history of every acknowledgment for the observation period.

Vendor assessment workflow automation

Structured vendor risk assessment workflows for new vendors and periodic reassessment of existing ones. Vendor questionnaire distribution and completion tracking -- questionnaires sent automatically when a new vendor relationship is created in the system. Risk scoring model that calculates inherent and residual risk from structured questionnaire responses. Risk register maintained automatically from completed assessments. High-risk vendor monitoring with periodic reassessment triggers. Vendor access review records linked to access management controls. The vendor management evidence library that demonstrates third-party risk is assessed systematically, on schedule, with documented outcomes.

SOC 2 evidence library and audit portal

A structured evidence library that organises collected evidence by TSC category and control, with auditor access portal. Evidence items linked to the specific controls they demonstrate. Completeness tracking showing which controls have sufficient evidence for the observation period and which have gaps. Auditor access portal where the external auditor can browse the evidence library directly, reducing the back-and-forth of email evidence requests during fieldwork. Evidence export in auditor-ready format for firms that prefer offline review. The audit preparation that takes hours rather than weeks because the evidence was collected continuously throughout the year.

Control failure remediation tracking

Remediation workflow for control failures identified by continuous monitoring or auditor findings. Each control failure creates a remediation task with owner assignment, due date, and severity classification. Remediation progress tracked from identification through resolution with evidence of the fix documented in the task record. Recurring failure pattern analysis -- a control that fails repeatedly signals a systemic issue rather than a one-time error. Auditor finding management for issues identified during the Type II review: finding record, management response, remediation commitment, and evidence of completion. The remediation tracking that demonstrates control failures are addressed promptly and systematically.

How many weeks does your team spend on SOC 2 audit preparation that automation could eliminate?

Tell us your current control framework, connected systems, and where the manual overhead is highest. We will scope the automation that removes it.

Talk about your SOC 2 project

  • Cloud Migration -- cloud infrastructure for SOC 2 in-scope systems

  • DevOps -- CI/CD pipelines and change management evidence for SOC 2 controls

Frequently asked questions

SOC 2 Type I is a point-in-time assessment: an auditor examines your controls at a single date and concludes whether they are suitably designed. Type I answers the question: do these controls exist and are they designed correctly? SOC 2 Type II is an assessment over an observation period -- typically 6 to 12 months. An auditor examines evidence that your controls operated continuously throughout the period and concludes whether they are suitably designed and operating effectively. Type II answers the question: did these controls work, consistently, every day, for the full period? Most enterprise customers and procurement teams require Type II because it demonstrates the controls actually operate rather than just existing on paper. Type II is significantly harder to prepare for because the evidence requirement is continuous, not a one-time snapshot. Automation is what makes continuous evidence collection practical at scale.

Evidence collection automation connects to the systems your controls depend on and pulls proof of control operation on a defined schedule. For access control evidence: user access logs from Okta or Azure AD, privilege escalation logs, and quarterly access review records. For change management evidence: pull request approvals and code review records from GitHub or GitLab, deployment logs with approver information, and change ticket records. For configuration management evidence: AWS Config snapshots, infrastructure-as-code state, and security baseline compliance checks. For availability evidence: uptime monitoring records, backup job completion logs, and incident response records. For vendor management evidence: vendor assessment completion records and contract metadata. Each evidence item is stored with its control mapping, collection timestamp, and source metadata. Gaps -- missing evidence, failed collection jobs, or controls that have not been checked -- surface automatically rather than being discovered by the auditor.

Vanta, Drata, and Tugboat Logic are excellent products for standard control frameworks with typical SaaS infrastructure. If your infrastructure is primarily AWS or GCP, your team uses common SaaS tools the platform integrates with, and your control set follows the standard TSC framework, these platforms will likely serve you well at a lower total cost than custom development. Custom automation makes sense in three situations: your infrastructure includes systems the standard platforms do not integrate with -- on-premises servers, custom internal tools, proprietary databases -- and the gap requires significant manual evidence collection regardless. Your compliance workflows need to be embedded in your existing internal tools rather than managed through a separate platform. Or your organisation has compliance requirements that go beyond the standard SOC 2 TSC framework -- industry-specific controls, custom control families, or multi-framework requirements that the platforms do not handle cleanly. We will tell you honestly during discovery whether a standard platform or custom automation is the better fit for your situation.

Custom SOC 2 compliance automation typically runs $25,000 to $70,000. At the lower end: an automated evidence collection pipeline covering the most time-consuming controls (access management, change management, availability monitoring), a basic policy management portal, and an evidence library UI for auditor access. At the upper end: comprehensive evidence collection across all TSC categories, continuous control monitoring with alerting, full policy management with acknowledgment workflows, vendor assessment automation, and a compliance dashboard for ongoing visibility. Cost is driven primarily by the number of system integrations required (each connected tool -- AWS, Okta, GitHub, Jira, third-party SaaS -- adds integration development effort) and the scope of the policy and vendor workflow requirements. We scope the engagement during a discovery phase that assesses your control framework, connected systems, and current manual process.