Question 1

How long does SOC 2 take?

Accepted Answer

6–12 weeks with automation, 6–12 months without it. Most of the difference is evidence collection: integrations gather it daily instead of an engineer reconstructing three months of screenshots the week before the audit.

Question 2

Do I need a consultant?

Accepted Answer

No. PostureGuard replaces most consultant work — control mapping, evidence tracking, gap remediation, and auditor packaging. If your scope is unusually complex, a consultant can still review your final package.

Question 3

What integrations do you support?

Accepted Answer

40+ including AWS, GCP, Azure, GitHub, GitLab, Okta, Google Workspace, Microsoft 365, Slack, Jira, Linear, Datadog, Cloudflare, and Vercel — with new connectors added monthly. Every connector is read-only.

Question 4

Is my data secure?

Accepted Answer

PostureGuard is SOC 2 Type II certified, penetration tested annually, and encrypts data with AES-256 at rest and TLS 1.3 in transit. We require MFA for all team members and publish our sub-processor list.

Question 5

Can I export my evidence?

Accepted Answer

Yes — full export anytime, as CSV or a packaged PDF. Your evidence includes timestamps and source for every item, so the package holds up outside the product.

Question 6

Who handles billing?

Accepted Answer

Paddle, our merchant of record. Paddle handles VAT, GST, sales tax, invoicing, and refunds globally, so you always get clean invoices — and we never see your card data.