Series A investors typically request SOC 2 Type I or Type II, a recent penetration-test report, written security policies, and a subprocessor list. SOC 2 is the AICPA audit framework for service organizations, and reviewers at this stage often accept Type I plus a dated plan for Type II. Series A due diligence is the Document and control review before a first major institutional round. It focuses on whether customer data is protected, risks are tracked, and security claims hold up under audit.
Table of Contents
- What goes in the data room
- What do SOC 2 Type I and Type II show
- Why does the pen test get the closest read
- What do investors expect beyond audit reports
- What if security is not ready yet
What goes in the data room
Expect to upload about a dozen technology documents, including an IT-systems inventory, your most recent third-party security audit, and a data map showing personal data handled. According to DealRoom, those three items sit at the core of the technology checklist alongside related system records.
Agency reports that Series A reviewers typically request SOC 2 Type I or Type II, a recent penetration-test report, written security policies, and a subprocessor list, as described in Agency's guide to SOC 2 in due diligence. Prepare clean copies with dates, scope, and auditor names visible. Missing items slow review more than imperfect ones.
- Current SOC 2 report, or auditor letter if in progress
- Penetration-test report less than 12 months old, with retest notes
- Written security policies and incident-response plan
- Subprocessor list and vendor-risk records
- Systems inventory and personal-data map
What do SOC 2 Type I and Type II show
SOC 2 evaluates controls against five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy, with Security mandatory. The AICPA explains this structure in the AICPA overview of SOC 2, which distinguishes design from operating effectiveness. Type I covers control design at a point in time. It answers whether the right controls were in place on that date.
Type II covers operating effectiveness over a period, usually months. It answers whether controls worked consistently in practice. Investors often accept Type I plus a dated Type II plan at Series A. That compromise only works when the plan names scope, auditor, and start date. A vague promise to pursue certification later carries little weight.
Why does the pen test get the closest read
Lorikeet Security finds that investors treat the penetration-test report as the centerpiece of Series A security diligence, expecting an independent test under 12 months old with critical findings remediated and retested, as explained in Lorikeet Security's guide to pen tests for Series A. Scope, method, and tester independence matter. An internal scan is not a substitute. Readers look first at critical and high findings, then at fix dates and retest results.
Open critical issues raise questions about engineering priorities. Clear remediation notes show the team can find, fix, and verify problems. Keep the full report ready, not only a summary letter. Pair each major finding with ticket references, fix dates, and retest confirmation. Redact only true secrets, and note what was removed.
What do investors expect beyond audit reports
Minimum Series A expectations beyond seed include completed penetration testing, SOC 2 Type I completed or in progress, a documented incident-response plan, production logging and monitoring, environment separation, and vendor-risk management. Those controls show daily security practice, not only audit paperwork. Closing documents can extend the work. The NVCA Model Investors' Rights Agreement requires the company within 180 days of closing to inventory protected data, maintain cybersecurity controls, require vendor incident notice, review measures at least annually, and train employees.
Founders should budget time for that post-close program now. ISO/IEC 27001:2022 is often requested as an alternative or complement to SOC 2. It is the certifiable international standard for establishing, implementing, maintaining, and improving an Information Security Management System. Early-stage U.S. software companies usually start with SOC 2 and add ISO when customers ask.
What if security is not ready yet
Weak security usually reprices rather than kills a Series A through valuation adjustment, pre-closing remediation, or post-close conditions. Investors may hold back funds, require fixes before wiring, or add security milestones to the closing terms.
The hard limit is time. According to Agency and Lorikeet Security, SOC 2 Type II observation periods cannot be compressed, so preparation should start three to six months before fundraising, a timeline detailed in Lorikeet Security's Series A security checklist. Start auditor conversations early, freeze key controls, and keep evidence from day one.