Trust Services Criteria mapped to your Microsoft 365 environment. Continuous evidence collection, approval workflows and auditor-ready reports — so you are never caught without documentation.
14-day free trial
Start your observation period on day one. By the time your auditor arrives, you'll have months of clean, continuous evidence.
All SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) mapped to your M365 controls.
Certvik starts collecting timestamped evidence from your M365 environment immediately — so your observation period is covered from the first day, not when you remember to export something.
Your compliance posture is checked on every scan. Drift from your baseline triggers alerts before your next audit.
Evidence is reviewed and approved through a structured workflow before it reaches your auditor. Timestamped, organised, and presented in the format auditors expect.
Generate clean, structured evidence packs that your SOC 2 auditor can work from directly. No more folder dumps.
Evidence is gathered from your Microsoft 365 environment automatically. Your team is notified when manual evidence is needed.
Every SOC 2 control comes with a downloadable Word (.docx) template — basic and detailed variants — so you can hit the ground running on policy and procedure documentation without starting from a blank page.
Real frustrations from engineering and security teams, and how Certvik addresses them.
The problem
"SOC 2 feels like it's just collecting screenshots until someone says it's fine. It's security theatre."
How Certvik solves it
Certvik scans your live M365 configuration on a schedule and records what it finds with timestamps. The result is a continuous evidence trail of your actual security posture — not a folder of screenshots assembled the week before the auditor arrives.
The problem
"We passed SOC 2 Type II last year and still got breached. How does that even happen?"
How Certvik solves it
A SOC 2 report covers the audit observation period — not what happens the day after the report is issued. Configuration drift is a leading cause: settings change, controls weaken, and nobody notices until the next annual audit. Certvik monitors your M365 environment continuously and alerts you the moment a compliant control drifts out of configuration.
The problem
"Our observation period starts in six months. What do we do until then?"
How Certvik solves it
Start now. Certvik begins collecting timestamped evidence from day one. By the time your auditor arrives, you will have months of clean, continuous evidence already organised by Trust Services Criteria — rather than scrambling to reconstruct it retrospectively.
The problem
"We're a small team. The separation-of-duties requirements feel impossible to satisfy."
How Certvik solves it
Certvik surfaces exactly which SOC 2 controls your M365 environment satisfies today and which have genuine gaps — so you can have an honest conversation with your auditor about compensating controls rather than discovering the problem on audit day.
The problem
"We also need ISO 27001 for our European customers. That feels like doing all the work twice."
How Certvik solves it
ISO 27001 and SOC 2 share roughly 70–80% of their underlying control requirements. Certvik maps your single M365 scan to both frameworks simultaneously — one set of evidence, two compliance pictures. The ISO 27001 module can be added to any SOC 2 subscription.
Most SOC 2 tools treat evidence collection as a manual process — you import screenshots, fill in checklists, and hope your auditor accepts the result. Certvik connects directly to your Microsoft 365 tenant and pulls evidence automatically via the Graph API.
Because SOC 2 Type II requires evidence across an observation period, starting early matters. Certvik begins timestamping your M365 security configuration from the moment you connect — which means your observation period evidence is building before you've even engaged an auditor.
Certvik maps your M365 controls to Trust Services Criteria language so your evidence pack is immediately understandable to your CPA firm, not a raw data export they have to interpret themselves.
SOC 2 (System and Organisation Controls 2) is an auditing framework developed by the AICPA. It's widely required by US enterprise customers and investors, particularly in the SaaS and cloud services space. A SOC 2 Type II report demonstrates that your security controls have been operating effectively over a period of time (typically 6–12 months).
If your customers are primarily in the US, SOC 2 is usually the priority. If they're in Europe or you're targeting enterprise or government contracts globally, ISO 27001 is more universally recognised. Many companies pursue both — Certvik supports this with separate add-ons you can stack.
SOC 2 Type I (point-in-time snapshot) can take 2–4 months. SOC 2 Type II requires a 6–12 month observation period. Certvik's continuous monitoring starts your evidence collection from day one, so you're not starting from scratch when it's time to audit.
Certvik handles the operational compliance work — evidence collection, monitoring and reporting. Most companies still work with a consultant or auditor for the formal SOC 2 examination. Certvik reduces the time and cost your consultant needs to spend on your account.
Certvik supports your SOC 2 readiness and audit preparation. The formal SOC 2 Type I or Type II report is issued by a licensed CPA firm after completing the audit. Certvik helps you prepare the evidence and documentation they need.
Yes. For Type I (point-in-time), Certvik gives you your current posture against the Trust Services Criteria. For Type II (observation period), Certvik's continuous evidence collection means you have a dated, structured evidence trail across the full period.
Certvik maps to all five TSC categories. The Security category (Common Criteria) is the most thoroughly covered via M365 data — MFA, access controls, audit logs, device compliance, and more. Coverage of the remaining criteria depends on what is configurable in your M365 environment.
Yes. Certvik supports both frameworks simultaneously. Evidence collected for ISO 27001 controls is often reusable for SOC 2 criteria — Certvik helps you identify the overlaps so you're not collecting the same evidence twice.
The sooner you start collecting evidence, the sooner you can get your report. Free for 14 days.
SOC 2 add-on: +$299/month after trial