Yes. SOC 2 does not set a minimum headcount. A solo founder or two person company can get a report, but several controls assume more people, so you substitute: outside reviewers, automation and documented compensating controls. Be open with the auditor about the size early.
What is hard at this size
- Segregation of duties. The person who writes code also deploys and administers systems.
- Review and approval. There may be nobody to review your pull request.
- Oversight. There may be no board and no independent director.
- Background checks and onboarding. Few hires, so little to sample.
- Coverage. If you are ill, nobody can act.
None of these makes it impossible. They change what evidence you produce.
Substitutes that auditors accept in principle
Check each with your auditor, since they decide.
- Outside reviewer. A contractor, an advisor or a trusted peer reviews changes on a schedule, or approves production releases.
- Automation as the second pair of eyes. Required tests, scanners and checks that block merge.
- Logs reviewed by someone else. You act, an advisor reviews the log monthly and signs off.
- Advisory board. A small group, even two outside advisors, that meets and records minutes about risk and security. This addresses oversight in a modest but real way.
- Access split. Separate accounts for daily work and for administration, with MFA on both.
Policies and risk assessment
Keep policies short and true. Do your risk assessment properly even if it fits on one page. For a method, see the risk assessment worked method. For policy scope see policies for small teams.
Scope small on purpose
Choose Security only. Limit the system to the product customers actually use. Use managed services for hosting, identity and email, and rely on the vendors' own reports for their parts. Fewer moving parts means fewer controls to evidence.
Plan for growth
Your first hire changes the picture. Build habits that will survive a team: pull requests, tickets, access via single sign on, and a recurring evidence calendar. Doing it early is cheaper than retrofitting.
Is it worth it now
Ask whether a buyer has asked, or whether a deal is blocked. If not, a security overview page, a completed questionnaire and a clear set of practices may be enough for now. See answering questionnaires before SOC 2.
Safeguard's free scan at gold.safeguard.sh/scan gives a tiny team quick dependency evidence, and its compliance and evidence automation can keep recurring records tidy.
A realistic first year
Quarter one: scope Security only, write short policies, set up single sign on and MFA, and enable branch protection. Quarter two: engage an auditor, finish the risk assessment, choose an outside reviewer and start collecting evidence. Quarter three: Type 1 audit date, then begin the observation period. Quarter four onward: run the evidence calendar and prepare for the first Type 2. Adjust to your deal pressure, but resist adding categories you do not need.
Quick check
Will the auditor treat us differently?
The criteria are the same. The auditor will look for compensating controls where a control assumes more people.
Should we do Type 1 or Type 2?
Either can work. Many small companies start with Type 1 to unblock a deal, then move to Type 2.
Last reviewed: 19 October 2026.
