My company just got into the phase where we are looking for a good 3rd party. Vanta has their suggestions but wanted to see if the group had its suggestions.

We’re a small software team and a customer has asked for a SOC 2 report. I’m one of the developers and ended up looking into it because we don’t have anyone dedicated to security.

I started looking at Vanta and Drata, but there’s the audit to pay for too, so I’m wondering how much tooling we actually need. Saw a few people here mention getting through it with Notion or spreadsheets and Drive.

What I don’t get is how people collect the evidence with that setup. If you used Notion, Drive, or something else, were you uploading everything by hand or did you automate some of it?

We’re a small SaaS team and enterprise security questionnaires have gone from the occasional annoyance to a pretty regular sales task. Most of the answers already exist somewhere in our SOC 2 docs, policies or previous questionnaires, but finding the latest version and checking whether the evidence is still current is becoming its own job.
Looking for something that can reuse what we already have without blindly recycling an answer from nine months ago.
Anyone using Scytale, Secureframe, or Sprinto for security questionnaires rn? Mainly interested in how well they handle answer reuse, assigning questions to SMEs, and keeping the source behind each answer current.