compliance

8 articles · newest first

Photograph of two blank grey-green cloth binders side by side on a dark wooden desk in warm late light, one with a small teal ribbon bookmark

ISO 27001 vs SOC 2 (2026): Which Your Customers Will Ask For, What Each Costs, and Whether You Need Both

A US buyer sends a SOC 2 request. A German buyer sends an ISO 27001 one. Here is what each proof is, who asks for which on the auditors' own pages, what sellers publish for the cost, and when one control program can feed both.

Cipher · Oct 3 · 12 min

Hand-drawn editorial illustration of a hand holding a magnifying glass over a house of cards, one card carrying a small teal padlock, on a near-black background in indigo-violet and off-white

Security

Penetration Testing Cost (2026): Web App, API, Cloud, AI Features and SOC 2

Sellers publish $5,000 to $30,000 for a web or SaaS app test and $9,500 and up for an AI chatbot. Many firms print nothing at all. Here is what each firm's own page says, what moves the quote, and what a SOC 2 auditor looks for.

Cipher · Oct 3 · 13 min

Flat vector illustration of a founder resting their chin on one hand while studying three identical shield badges lined up on a table, a teal scarf as the accent, against a saturated indigo-violet background

Security

Vanta vs Drata vs Secureframe vs Sprinto vs Thoropass (2026): Price, Is the Audit Included, Who Fits

Four of the five hide their price behind a demo, and none of them sells you the SOC 2 opinion. What each platform publishes about cost, the audit, frameworks and the tools a vibe-coded stack uses, read on each vendor's own site on 3 October 2026.

Cipher · Oct 3 · 12 min

Hand-drawn editorial illustration of a small chat-bubble robot with a very long questionnaire scroll unrolling from it across a dark page

Security

The AI Questions Enterprise Buyers Ask About Your LLM, With Answer Templates

The vendor review now has an AI tab. The eight things it asks about an app that calls OpenAI or Claude, where each question comes from (SIG, CSA's AI-CAIQ, NIST, ISO 42001, OWASP, the EU AI Act), a fill-in-the-blanks answer for each, and the evidence to attach.

Cipher · Oct 2 · 14 min

Flat vector illustration of a founder holding open a huge envelope sealed with a teal padlock against a saturated indigo-violet background

Security

Your First Enterprise Customer Asked for SOC 2: A 90-Day Plan, a Budget, and What to Send Them This Week

The email just landed and you have no report. What to send the buyer this week, the questions that buy you time, a week-by-week plan to a Type 1 audit start in about 90 days, and what it costs. Including the one document founders reach for that doesn't exist yet.

Cipher · Oct 2 · 13 min

Hand-drawn editorial illustration of a solid stone foundation stamped with a teal seal, carrying a small violet wooden house whose front door stands open with the key still in the lock

Security

A Buyer Asked if Your Lovable App Is SOC 2. What Your Platforms' Reports Don't Cover

You built it vibe coding on Lovable, Bolt, Replit or v0, with Supabase and Vercel underneath, and a security questionnaire just asked for SOC 2. Each platform's own report, how to get it, which plan it sits behind, whether it trains on your data, and the half of the audit that is still yours.

Cipher · Sep 27 · 12 min

Flat vector illustration of an auditor holding up a large balance scale with a stack of invoices on one pan and a teal padlock on the other

Security

SOC 2 Audit Cost 2026: Real Ranges by Company Size and Auditor Tier (Calculator)

An auditor just sent you a quote, or you're about to ask for one. What a SOC 2 audit fee really runs for a company your size, Type 1 against Type 2, boutique against Big Four, what moves the number and what the quote quietly leaves out.

Cipher · Sep 27 · 12 min

Hand-drawn editorial illustration of a small chat-bubble AI robot on an auditor's desk while an auditor unrolls a long checklist

Security

SOC 2 for AI Startups (2026): Cost, Timeline, and What Auditors Ask About Your LLM Features

Your first enterprise customer wants a SOC 2 report and you mostly call the OpenAI or Claude API from a Supabase or Lovable app. What it really costs, how long it takes, what your vendors already cover, and what an auditor will ask about the AI part.

Cipher · Sep 27 · 14 min