Oneleet
Book Demo

SOC 2 Type 1 or Type 2?
Choose with an expert.

No need to guess which report your customer wants. Your Oneleet vCISO helps you choose the right report to close the deal.

4.9 / 5.030-minute walkthrough

Join 2,000+ startups building with Oneleet.

  • levels.fyi
  • Pydantic
  • Gumloop
  • Photoroom
  • Midjourney
  • Trigger.dev
  • Numeral
  • Porter
  • Campfire
  • Runware
SOC 2 Type 1 vs Type 2

What’s the difference?

Type 1 shows your controls are set up right on one date. Type 2 shows they actually work over a period of time.

Detail

SOC 2 Type 1

A point in time

SOC 2 Type 2

Over a period

WhenA specific date.An agreed observation period.
What it provesYour controls are set up correctly on one date.Your controls work over a period of time.
Time to reportFaster, no observation window.Includes an observation window to test controls.
When you need itWhen your customer accepts a point-in-time report.When your customer requires evidence over a period.

If your customer’s security team requires Type 2, go straight to Type 2. If a deal is waiting on any SOC 2 report, start with Type 1 and move to Type 2 later. If you don’t know what your customer will ask, your Oneleet vCISO can read your questionnaire or contract and tell you the best option.

Your program & cost

One SOC 2 program.Quoted for your scope.

One flat fee covers your platform, vCISO, human + AI pentest, and the independent auditor’s fee.

Human + AI pentestwith every fix retested

SOC 2 compliance platformfor your controls, policies, and evidence

Security toolsfor protection beyond compliance

A dedicated vCISOwho helps you choose and prepare

Audit managementthat takes the back-and-forth off your plate

Independent auditorwith the fee included

One flat feeset upfront

Your customer’s requirements

Start with the request.Plan the right report.

Your vCISO helps confirm which SOC 2 report your customer needs, then plans preparation around those requirements.

Without Oneleet

  • Choosing a report from a generic checklist
  • Assuming Type 1 satisfies a Type 2 request
  • Treating readiness as the report deadline
  • Comparing quotes with different scopes

With Oneleet

  • A plan based on your customer’s requirements
  • Confirm the report type with your customer
  • Plan readiness, observation, and audit separately
  • A defined report type, scope, and flat fee
The platform

Your SOC 2 controls.Evidence in one place.

Collect evidence and track controls for Type 1 or Type 2. Your vCISO reviews the work against your scope.

Book Demo How it works
  • Evidence collection
  • Continuous monitoring
  • Policy templates
  • Security questionnaires
  • Device agent
  • Trust Center
  • One control, many frameworks

Evidence collection

Collects evidence from your tools for the report scope you agree.

Oneleet platform

  • Pulling access logs from Google Workspace
  • Checking branch protection on 14 GitHub repos
  • Reading disk encryption on 42 laptops
  • Exporting CloudTrail settings from AWS

186 of 190 evidence items collected.

4 need a person: your vCISO has them this week.

Ran for 3 minutes · 6 tools connected

How it works

Choose your report.Plan the stages.

For Type 2, the observation period sets the pace. Your vCISO helps you agree on it with your auditor and start it early.

Your SOC 2 report plan

  1. Your vCISO joins your Slack

    Your vCISO joins your Slack

    Your vCISO joins your SlackDay 0

    Share your customer’s questionnaire and deadline. Your vCISO helps define the next steps.

    Customer requirements understood

  2. Report type & scope

    Report type & scope

    Report type & scope1–3 days

    Confirm Type 1 or Type 2, systems in scope, and the required date with your customer and auditor.

    Report type, scope, and timing agreed

  3. Human + AI pentest

    Human + AI pentest

    Human + AI pentest1 week

    Pentesters test your application alongside SOC 2 preparation, then retest your team’s fixes.

    Findings reviewed, fixes retested

  4. Controls & report evidence

    Controls & report evidence

    Controls & report evidenceReadiness: 1–4 weeks

    Type 1 covers a date. Type 2 also evaluates operation over a period, separate from readiness time.

    Evidence for the agreed date or period

  5. Mock audit

    Mock audit

    Mock audit

    Your vCISO and audit team check readiness against your report scope and flag gaps.

    A readiness check before the independent audit

  6. Independent SOC 2 audit

    Independent SOC 2 audit

    Independent SOC 2 audit

    You engage the independent CPA firm directly. It audits and issues the report; Oneleet coordinates requests.

    An independently issued SOC 2 report

The people

Choose your report with an expert.

Your vCISO guides the report decision and preparation. Pentesters and an independent CPA firm complete the team.

Your pentest team

Test your defenses.Retest your fixes.

Your human + AI pentest finds issues. Pentesters turn findings into tasks and retest fixes.

Pentest fixes

2 of 3 verified

  • Admin page open to members

    GET /admin/users

    Verified

  • Any invoice readable by its ID

    GET /invoices/1043

    Verified
    Before fix
    200 OK
    Retest
    403 Blocked

  • No rate limit on login

    POST /auth/login

    Retest queued

Pentester

Oneleet

Retested after your fix. Still blocked.

Your dedicated vCISO

Read the request.Plan the report.

Your vCISO defines the report scope and guides controls, policies, and evidence.

Does the auditor need proof our backups restore?

Yes. Attach your latest restore test log and I’ll review it before the audit.

restore-test-log.pdf

Here it is. Anything else before the audit?

Backup restoreAWS root MFA

Reviewed, you’re covered. Just one: turn on MFA for the AWS root account. Takes 5 minutes.

Your audit, managed

Arrive audit-ready.Skip the back-and-forth.

We check your controls before the auditor does, handle their requests, and help your team respond with clear evidence.

Customer proof

What teams sayabout Oneleet.

Talk through the report your customer needs, with the scope, timeline, and cost.

Book Demo
“That call left me *excited* about security. Not just the platform. Huge kudos.”
Art KCharter Inc.
“@BryanOnel86 cares about their customers more than any provider ive ever seen”
Brandon VeisehMindFort AI (YC X25)
“Our most recent Fortune 500 prospect wouldn't move forward until we had ISO 27001.”
Daniel WighReactWise
“Talking to Bryan Onel about the Oneleet process felt a lot more personal and straightforward.”
Nalin SemwalCapy
“i’m such a happy @oneleet customer too (twice! gumloop and now understudy)”
Luis ManriqueOrchestra (YC S26)
“I love @oneleet and I love the team at Oneleet”
Jeremy HindleCustodian
“Oneleet made this easy. They didn't show up with a checklist and tell us to comply.”
Andrew McGlatheryVector 👻
“Big thanks to the team at Oneleet for supporting us, and spending over 20 hours inside our production app and API for the pentest.”
Johannes DanckerFormbricks
“Thank you to Oneleet for their availability and professionalism throughout”
Luigi PedaceConvergent
“On a Saturday, Samuel jumped on with us and spent hours making sure we got there. A deal was on the line and they treated it like it was theirs too.”
Michael FesterGloGlo (YC)
“SOC 2 Type II with Oneleet gave us the single pane of glass to prove at the organizational level what we'd already built into the product”
Ryan UnderwoodReplica Cyber
“Oneleet ran the program, Prescient Security did our controls examination, and we spent three months in the observation phase with an independent pentest along the way.”
Shikhar Bhushans2.dev
“We did it with Oneleet. I wanted someone who would find real problems, not generate a checklist.”
Soohyun BaePodonos
“we chose OneLeet over Delve and Vanta.”
Andrew ReaTaxwire
“- logs into our @oneleet control monitor dashboard - ensures timely review + merge of vulns - replies promptly to auditor requests”
claire voCXO.dev
“OneLeet is one of the best companies.”
JeetMetaphor
“consistently hearing the best things about @oneleet”
Neil Bhammarshortkit
“Glad we went with @oneleet when we got @skyvernai enterprise ready.”
Suchintan SinghSkyvern (YC S23)
“Consistently grateful we went with oneleet. You and the team have been awesome”
Adam RankinWarp
“if you actually want to be secure I'd recommend Oneleet”
Brian SierakowskiChangebot AI
“Ok so about 2 weeks into the SOC 2 process with @oneleet and we made the right choice.”
Scott Mottedotenvx
“@BryanOnel86 was the only vendor who expressed a genuine interest in security, not just speed”
Albert LamRyvn
“But we chose integrity, simple pricing model, expert guidance that kept me in check. AND They sure did.”
Amit BiswasMeow
“We just moved our SOC 2 program to Oneleet.”
Ram VenkataramanSei
“We recently completed a full penetration test with Oneleet alongside our ISO 27001 implementation, with focused testing of the Co-Pilot for Marking® pipeline.”
Dr. James LambertVision Marker
“We are SOC 2 Type II certified with Oneleet, which reflects how we've built from day one.”
Jonathan KopnickTie
“Samuel Beyeler from their team spent hours with us on a Saturday just to make sure we'd make it. We closed the deal :)”
MarieGloGlo (YC)
“That’s why we worked with Oneleet to get SOC 2 certified.”
Oskar KlingbergBardo Technology
“But Oneleet (and specifically Carter, our vCISO) made it easy and way more manageable than expected.”
Saif MahmudNiaHealth
“Their platform integrated directly with our cloud infrastructure and started automating evidence collection from day one.”
Yannick BoernerCarelane
“They really feel like they are going above SOC 2. Doesn't feel like checking boxes like others did.”
Scott Mottedotenvx
“We also went with Oneleet based mostly on the vibe of integrity.”
ashwinMelder
“it was clear after talking to oneleet there is no legitimate way to get soc 2 done in in 3 weeks due to the observation period.”
Cooper NewbyClasset
“Thank you @oneleet and @avimakesrobots for getting this through the line!”
KietSuperset
“After 3 months of observation, an independent pentest, and a controls audit by Prescient Security with @Oneleet.”
s2.devs2.dev
“I'm glad we're working with @oneleet 🙏”
Tim Suchanekexpand.ai (YC S24)
FAQ

SOC 2 Type 1 and Type 2, straight answers.

“Consistently grateful we went with oneleet. You and the team have been awesome”
Adam RankinWarp
What is the difference between SOC 2 Type 1 and Type 2?

SOC 2 Type 1 evaluates the design of controls at a specific date. SOC 2 Type 2, also written Type II, additionally evaluates how controls operated over a period. Both result in an independent CPA firm’s report. Choose based on the report your customer requires, the systems in scope, and the timing.

Which SOC 2 report does our customer need?

Start with the customer’s questionnaire or security requirements. Confirm the requested report type, systems in scope, and required date. Your vCISO helps interpret the request and plan preparation, with the date or observation period agreed with your independent auditor. Ask your customer to clarify anything ambiguous before starting.

How long does SOC 2 Type 2 take?

A Type 2 report covers an observation period agreed upon with your auditor and informed by your customer’s requirements. Controls must operate over that period, and audit work and report delivery have their own schedule. The 1–4 week estimate covers audit readiness, depending on scope and your starting point. It does not include the observation period or guarantee a report delivery date.

Is SOC 2 Type 1 faster than Type 2?

Yes. Type 1 skips the observation window, so it’s faster. Many startups get Type 1 to unblock a deal before moving to Type 2 for enterprise customers.

How much does SOC 2 Type 1 or Type 2 cost?

Oneleet quotes a flat fee for your agreed upon report type and scope, covering the platform, dedicated vCISO, human + AI pentest with retests, and independent audit fee. We confirm which report or reports are included in the quote and review the scope and cost with you before you commit.

Who issues the Type 1 or Type 2 report?

An independent, licensed CPA firm performs the audit and issues your SOC 2 report under AICPA standards. You engage the auditor directly. Oneleet helps your team prepare controls and evidence and coordinates requests, while the CPA firm forms its own audit opinion.

What does SOC 2 Type 2 certification mean?

“SOC 2 Type 2 certification” is a common search phrase for completing a Type 2 audit. The deliverable is an independent CPA firm’s attestation report on the controls and period in scope. Your vCISO helps you prepare for that examination and plan the work around your customer’s requirements.

Is SOC 1 the same as SOC 2 Type 1?

No. SOC 1 covers controls that affect your customers’ financial reporting. SOC 2 covers security. Type 1 and Type 2 are two kinds of SOC 2 reports.

Type 1 or Type 2?
Start with your customer.

Bring your customer’s questionnaire. We’ll tell you which report will get the deal moving.

Book Demo

  1. Book a 30-min call

    Bring the questionnaire and required date.

  2. Confirm the report type

    Review Type 1, Type 2, and the scope.

  3. Plan the work & cost

    See the stages and agreed fixed-fee scope.