Frameworks
Earn customer confidence with SOC 2
SOC 2 is an independent audit report on how a company handles customer data, assessed against five Trust Service Criteria: security, availability, processing integrity, confidentiality and privacy. A Type 1 report describes your controls at a single point in time; a Type 2 report tests that they actually worked over a period, usually three to twelve months.
Tidal Control gets you there: implement the required controls, automate evidence collection, and keep the report current once you have it.
SOC 2 in depth
SOC 2 compliance revolves around demonstrable trust. Organisations must show that they have structural control over security, availability, confidentiality, and processes as defined in the Trust Service Criteria. In practice, friction arises when controls and evidence are managed separately and only collected towards the audit.
When SOC 2 is approached as a one-time audit, a reactive process emerges. Teams provide ad hoc evidence, responsibilities are unclear, and consistency is lacking. This makes it difficult to maintain compliance once the organisation grows or processes change.
By structurally setting up SOC 2 around controls, ownership, and follow-up, a continuous view of compliance emerges. Not as an audit obligation, but as part of daily processes and decision-making.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Scale beyond SOC 2
Explore complementary frameworks that enhance your SOC 2 compliance strategy.
ISO 27001
Expanding to Europe? ISO 27001 is the mandatory global standard for information security that European customers require.
NIST CSF
Working with US government or regulated sectors? NIST CSF is often required alongside SOC 2 for federal compliance.
CIS Controls
Need operational security depth? CIS Controls provides the actionable best practices that underpin your SOC 2 controls.
NIS2
Serving European entities? NIS2 compliance is mandatory for critical infrastructure and important entities in the EU.
Integrate with your existing tools
Learn more about SOC 2
Learn more about implementing and managing SOC 2
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
With Tidal's pre-built controls and automation, most companies achieve Type I certification in 2-3 months. Type II certification typically takes 6-8 months as it requires demonstrating sustained compliance. Our platform helps you maintain evidence collection and controls testing throughout the observation period.
Security is mandatory for all SOC 2 reports. Beyond that, choose criteria based on your business needs and customer requirements. Common additions are Availability (for SaaS products) and Confidentiality (for handling sensitive data). Tidal helps you assess which criteria are relevant and implements appropriate controls.
Yes, we can recommend auditors experienced with our platform. However, you're free to work with any licensed CPA firm. Tidal's evidence collection and reporting features work with any auditor you choose.
Yes, Tidal supports both SOC 2 Type I and Type II audits. Our platform helps you establish controls for Type I and then transition to maintaining evidence for Type II's observation period. Our automated evidence collection is particularly valuable for Type II compliance.
Tidal integrates with major cloud providers (AWS, Azure, Google Cloud, Scaleway, Vercel), collaboration and development tools (GitHub, GitLab, Bitbucket, Jira, Atlassian Admin, Linear), identity and device management (Microsoft Entra ID, Google Workspace, Iru), observability and security (Datadog, Microsoft Sentinel), and CRM (HubSpot). We're continuously adding new integrations based on customer needs.
Our platform continuously monitors your controls and collects evidence automatically. You'll receive alerts for any gaps or issues, helping you maintain compliance year-round. This ongoing monitoring makes annual renewals much simpler.