Manera Knowledge Base · Security & compliance

Our SOC 2 Type II roadmap (in progress)

This article is for the procurement officer, CISO, or compliance lead asking the question that comes up in 90% of our enterprise sales conversations: "You don't have SOC 2. What's your roadmap?" This is the honest answer. No marketing-speak, no "SOC 2-aligned controls" euphemism, no fake-TBD timeline.

TL;DR

Why we are public about a "no-yet" status

Most early-stage SaaS companies fudge SOC 2. They say things like "SOC 2-aligned controls" or "SOC 2 in progress" without specifying what is and isn't done. We chose the harder path: be specific, even when the specificity is awkward.

Three reasons:

  1. The Trust Doctrine. Manera's pricing argument depends on the buyer trusting us. We cannot demand trust on our pricing claims while obfuscating on our security claims.
  2. Procurement reality. Every CISO who pulls a SOC 2 report off a vendor knows whether the report is real. Pretending we have one would be detected in 30 seconds and lose us the deal.
  3. The Middle Way. Pretending SOC 2 status would be the indulgence trap. Skipping SOC 2 entirely would be the asceticism trap. The Middle Way is to commit to a real timeline and execute.

What is implemented today

These controls are operating in production. We have evidence (logs, configs, screenshots) for each. The pre-audit evidence pack mentioned below is essentially this list, with timestamps and artifact paths.

Trust Services Criterion — Common Criteria (Security)

Common Criteria (Availability)

Common Criteria (Confidentiality)

Common Criteria (Processing Integrity)

Common Criteria (Privacy)

Gaps we are closing

These are the items not yet at full SOC 2 Type II evidence-quality. Each has an owner, target date, and verification approach.

ItemStatusTargetVerification
Formal Information Security PolicyDrafted, in reviewQ2 2026Founder + external counsel sign-off
Vendor risk management programSpreadsheet-trackedQ2 2026Migrate to SecureFrame / Vanta tooling
Background-check policy for new hiresN/A (solo founder)When first hire (post Q4 2026)Standard background check vendor
Access review cadenceQuarterly informalQ3 2026 (formalized)Logged review with timestamp
Penetration test (external)Internal red-team onlyQ3 2026Engage external firm (Cure53 / Trail of Bits)
Vulnerability management cadenceManualQ2 2026Snyk / Dependabot automation
Change management processGit-only todayQ3 2026Formal change-approval workflow
Disaster recovery testQuarterly informalQ3 2026Documented quarterly drill
Business continuity planDrafted, not formalizedQ3 2026Written BCP doc + tabletop exercise
Risk assessmentDrafted, not formalizedQ2 2026Written risk register + quarterly update

The realistic timeline

We have learned (the hard way, by talking to 30+ CISOs) that "SOC 2 Type II in 6 months" is almost always a marketing fiction. Type II requires a minimum 90-day observation period, and the auditor needs evidence of operating controls during that window — not just implemented controls.

Q1-Q2 2026 (now-July). Close the gap items above. Engage a SOC 2 readiness firm (likely Vanta or SecureFrame) to manage evidence collection.

Q3 2026 (July-September). Formal observation period begins. We commit to NOT changing critical controls during the window. Auditor (TBD) engaged.

Q4 2026 (October-December). Audit fieldwork. Report drafted. Final report typically issued 4-6 weeks after fieldwork ends.

Q1 2027 (January-March). SOC 2 Type II report distributed to enterprise customers + posted (gated) on /trust.

This is not the fastest possible timeline. It is the realistic timeline. The fastest possible is "Type I in 90 days then Type II 6 months later" — which is acceptable for some buyers but is widely understood by procurement to be a half-step.

Procurement diligence today

If your procurement requires SOC 2 evidence to onboard a new vendor, we can help bridge the gap:

The honest tradeoff

Some buyers will simply not transact with a vendor pre-SOC 2. We respect that. Manera is not the right vendor for that buyer until 2027.

For everyone else, the trade-off is:

The buyer who values the badge above all else will buy Bloomberg + CrowdStrike + Westlaw + adjacent tools at $544K-$2M/yr today. The buyer who values the trust signal — and is willing to evaluate it on substance, not on a logo — will buy Manera Mesh Tier at $11,988/yr today and wait six months for the badge.

How we will announce SOC 2 completion

When the SOC 2 Type II report is issued (target Q4 2026), we will:

  1. Update /trust and this article (last_updated: field) with the new state
  2. Email every existing customer with the report-access procedure
  3. Post a public security blog announcing it
  4. Update sub-processor and DPA links

We will not retroactively claim SOC 2 status before the audit completes. We will not call our pre-audit controls "SOC 2-equivalent" or "SOC 2-aligned" or any other euphemism.

Related articles

← Back to knowledge base · Trust · Privacy · Request evidence pack

Start 30-day Mesh Tier trialAll KB articles
Manera Technologies Inc. · Knowledge base · Blog · Pricing · Trust Doctrine · Contact