How we sit relative to SOC 2 and auditors

What SOC 2 is (briefly)

SOC 2 is an attestation report issued by a licensed CPA firm against the AICPA Trust Services Criteria (security, and optionally availability, processing integrity, confidentiality, privacy). The report reflects the auditor’s opinion based on your system description, controls, and evidence for a point in time (Type I) or over a period (Type II).

Evidynx helps you prepare and operate toward that process. Evidynx does not issue SOC 2 reports.

Who owns the auditor relationship

You do. You choose your CPA / audit firm, contract with them, and receive their report. Evidynx may help with document ops and evidence organization so that handoff is cleaner—but the professional relationship and attestation remain between you and your auditor.

What Evidynx does

• Gap workbook / readiness map against common SOC 2 control themes
• Policy and control mapping with an evidence index
• Ongoing evidence collection cadence during observation (confirmed after intake)
• Buyer-pack / security-packet support for diligence
• Document operations that make your auditor’s work more efficient

What Evidynx does not do

• Act as a CPA firm or auditor
• Attest, opine, or “certify” your company
• Issue SOC 2 Type I or Type II reports
• Guarantee a pass or any particular audit outcome
• Invent controls or fabricate evidence
• Replace compliance platforms such as Vanta, Drata, or Secureframe (we may coexist)

Independence and honesty

We do not sell guaranteed outcomes. Readiness quality depends on your people, systems, period of performance, and auditor judgment. We prefer accurate maps over optimistic ones.