SOC 2 readiness consultant directory

This directory lists the people and products that get you ready for a SOC 2 audit. It does not list audit firms, and the difference is the reason the page exists.

Last reviewed 2026-08-16Written by Jacob Masse, TrazTech Inc.

There is nothing in this directory yet. No firms, no platforms, no counts. It launched empty and we are not going to fill it with scraped company records, because a list of names nobody has spoken to tells you nothing you can act on. What this page does instead is explain what will be listed, how a listing works, and how to tell the three kinds of supplier apart, which is the decision most companies get wrong in their first month of SOC 2 work.

If you want quotes now rather than a list to read, the quote form puts your scope in front of Canadian firms that do readiness work. If you want to understand what you are buying first, start with the guide to hiring readiness help in Canada, which also links to a page for each of twenty cities.

What this directory will list

Two categories, kept apart because they are bought differently and priced differently.

Readiness consultants. Firms and independent practitioners who do the preparation work: scoping, gap assessment, policy writing, control design, remediation project management, evidence collection and support during fieldwork. A listing will record the engagement models the firm offers, the size of company it usually works with, whether it works alongside a compliance platform or against a spreadsheet, and which provinces and industries it knows. That last item matters more than location, because a consultant who has taken a health technology company through PHIPA and SOC 2 together is a different hire from one who has only done cloud SaaS.

Compliance platforms. Software that connects to your cloud accounts, identity provider and code repository and collects part of the evidence automatically, on top of a control framework already mapped to the Trust Services Criteria. A listing will record what it integrates with, whether it includes policy templates, whether the pricing is public, and what the contract term usually is. Canadian pricing runs roughly $8,000 to $30,000 CAD a year, typically prepaid annually and often on a multi-year term, so the contract shape is worth listing beside the feature list.

Consultant, platform, auditor

These get conflated constantly, usually by a sales conversation that has an interest in conflating them. They are three different purchases and you may need all three, in that order.

The independence rule is the part worth understanding rather than memorising. An auditor is giving an opinion on whether your controls were designed properly and operated over a period. A firm that designed those controls, wrote the policy set behind them and built the evidence pipeline cannot then give an opinion on its own work, so it is barred from auditing what it built. That is why the readiness supplier and the audit firm are separate purchases, and why nobody in this directory can also sign your report.

Some large firms sell both through separated teams. That arrangement can be legitimate under professional standards, but a reader of your report does not know your supplier's internal governance and will ask about it when they see one name on both sides. For a company under fifty people the uncomplicated answer is two suppliers. When you get to picking the audit firm, GetSOC2 covers auditors, including fees, report types and independence. This site stops at the point where an auditor becomes useful to you.

What a listing will look like

The two rows below are format examples, not real firms. The names are invented. Nothing here is a recommendation and no such company is listed.

How listings work

A basic listing is free. Name, category, provinces served, what the firm or product does, and a link. There is no charge to appear and position on the page is not for sale.

Claiming a listing means somebody at the firm confirms the detail is correct and takes responsibility for keeping it current. An unclaimed listing is one assembled from public information, and it carries the unclaimed badge so you know the difference. Claiming costs nothing and is done by writing to [email protected] from a company address.

Verified is the only badge that means we did work. For a consultant it means we confirmed the business exists, spoke to a person there, and checked the firm performs the work rather than subcontracting it under its own name. For a platform it means we confirmed the integrations and the contract terms with the vendor. Verified is not a quality rating and it is not an endorsement. It says the supplier is what it claims to be, nothing more.

What to ask while the directory is empty

You can run a good selection process without a directory, and the questions matter more than the list anyway. Give three candidates the same written scope: headcount, the systems in scope, which Trust Services Criteria, your intended observation window, and the date a report has to exist by. Quotes priced against different scopes cannot be compared, and that accounts for most of the wild variation companies report.

Ask a consultant what you are handed at the end, and whether the policies are templates or written against how you actually operate. Ask who does the evidence collection during the window, because a consultant who leaves at the point the window opens has left before the hard part. Ask how they work with your engineers, since remediation is engineering change rather than paperwork. Ask what happens if the auditor raises an exception later.

Ask a platform vendor for the contract term, the renewal price, and what happens to your evidence if you leave. Ask which of your systems it genuinely integrates with rather than which logos are on the page. Our readiness assessment page covers how to tell whether you are actually ready, and the preparation guide is the work itself if you decide to do it without anybody.

Common questions