compliance

Review and assess a vendor's SOC 2 Type 1 or Type 2 report against the security and operational maturity that's reasonable for a company of their size, stage, industry, and customer base — not against Fortune 500 standards. Use whenever the user shares a SOC 2 report (PDF, attestation letter, bridge letter) along with any context about the vendor — even casually, like "can you look over this SOC 2 from a 40-person fintech startup we're evaluating" or "diligence this vendor's SOC 2 for me." Also trigger for related vendor security diligence requests where a SOC 2 is the primary artifact — gap analysis, peer-cohort comparison, drafting follow-up questions for the vendor's security team, or producing a write-up to share with stakeholders. Produces a structured markdown report with risk-rated findings, a recommendation, and follow-up questions to send to the vendor.