SOC 2 for Georgian SaaS startups selling to the US

US enterprise buyers usually ask a SaaS vendor for a SOC 2 report before signing. For a startup with its engineering team in Georgia, the work is manageable if the scope and evidence are planned from the start.

What SOC 2 is, and what it is not

SOC 2 is an attestation engagement performed under AICPA standards. A licensed US CPA firm examines your controls against the Trust Services Criteria and issues a report with its opinion. It is not a certificate, there is no SOC 2 "pass", and no organisation other than a licensed CPA firm can issue the report. BALTUM prepares companies for the examination and works with partner CPA firms that perform it.

The Trust Services Criteria cover five categories:

• Security. Always included; also called the common criteria.
• Availability. Often added for platforms with uptime commitments.
• Confidentiality. For products that handle client confidential data.
• Processing integrity. For systems where accuracy and completeness of processing matter, such as payments or billing.
• Privacy. For personal information handled under your privacy notice.

Type 1 or Type 2

A Type 1 report gives an opinion on the design of controls at a single date. A Type 2 report covers both design and operating effectiveness over a period agreed with the CPA firm, often several months. Many buyers accept a Type 1 as a first step, with a commitment to a Type 2. The right sequence depends on your sales pipeline and how mature your controls are.

Questions a Georgian startup must answer early

1. Which entity is examined. Many startups have a US company that signs contracts and a Georgian company, sometimes with International Company status, that employs the engineers. The system description must explain which entities, people and processes deliver the service.
2. Where people work. Offices in Tbilisi or Batumi, remote staff, contractors in other countries. Onboarding, offboarding, device security and background checks must work for all of them.
3. Subservice organisations. Your cloud provider, identity provider and payment processor are usually treated as carved-out subservice organisations. You must show how you monitor them, typically by reviewing their own SOC reports.
4. Complementary user entity controls. What your customers must do on their side, such as managing their own user access.
5. Local legal requirements. The Law of Georgia on Personal Data Protection applies to processing in Georgia. If you add the privacy category, your controls must also reflect what your privacy notice promises US users.

Controls the CPA firm will test most closely

• Access provisioning and removal, MFA and periodic access reviews.
• Change management: code review, testing and approval before deployment, with traceable records.
• Logging, monitoring and alert handling.
• Backups and restore tests.
• Incident response, including at least one documented exercise or real incident.
• Risk assessment and vendor management performed and recorded at least annually.
• Security awareness training and signed policies for every employee and contractor.

In a Type 2, the auditor samples evidence across the whole period. A control that worked in month one and stopped in month four is an exception in the report.

Mistakes we see in early-stage teams

• Choosing too many Trust Services Criteria categories at once. Security alone is often enough for a first report; add others when buyers ask.
• Writing policies that describe a large company rather than a team of fifteen engineers. The auditor tests what the policy says you do.
• Starting the Type 2 period before controls are stable, which produces exceptions that buyers will read.
• Forgetting contractors. A freelance developer with production access is in scope for access, device and training controls.

SOC 2 and ISO 27001

Many Georgian SaaS companies sell to both the US and Europe. ISO/IEC 27001 is the usual European expectation and SOC 2 the American one. The control sets overlap heavily, so one set of policies, one risk assessment and one evidence process can serve both. See ISO 27001 for IT companies in Georgia and our ISO 27001 page.

How BALTUM prepares you

We run a readiness assessment against the Trust Services Criteria you choose, help write the system description, close gaps in controls and evidence, and prepare the team for auditor interviews. When you are ready, we introduce a partner CPA firm that performs the examination and issues the report. The timing depends on your starting point and the report type, and is set after the readiness assessment. More on our SOC 2 page.

To discuss a SOC 2 readiness project, use the form on this site or write to info@baltum.org.

Frequently asked questions

Can BALTUM issue a SOC 2 report?

No. Only a licensed US CPA firm can issue a SOC 2 report. BALTUM performs readiness work and works with partner CPA firms that carry out the examination.

Can a company based in Georgia get a SOC 2 report?

Yes. SOC 2 has no requirement for the service organisation to be in the US. The CPA firm examines the system wherever the people and infrastructure are located, often with remote testing.

More articles from BALTUM Georgia