Effi Founder & CEO Mandeep Sodhi on
SOC 2, Security and Enterprise Trust

Every SOC 2 journey looks a little different. In this case study, Effi Founder & CEO Mandeep Sodhi shares the experience in his own words.

Effi is an Australian technology company in the mortgage and finance industry. Brokers, aggregators and larger enterprises trust it with some of the most sensitive data a borrower can share. In this Q&A, Founder & CEO Mandeep Sodhi talks about why SOC 2 was an early priority, what surprised him about the audit, and what independent assurance has meant as Effi moves into larger enterprise relationships.

Mandeep: We operate in the mortgage and finance industry, so we’re dealing with some of the most sensitive information a customer can provide bank statements, income, assets, liabilities and everything else that goes into securing a loan. For us, security was never something we could bolt on later. If we wanted Effi to become infrastructure that brokers, aggregators and larger enterprises could genuinely trust, we had to take it seriously from the beginning. SOC 2 came up very early, from customers and from technology partners we wanted to integrate with. Having good technical security practices and having everything formally documented, governed and independently audited are two very different things. As a founder, I felt it was simply the right foundation to build.

“SOC 2 came up very early, from customers and from technology partners we wanted to integrate with.”

Mandeep: As a technology founder, one thing you learn pretty quickly is that you don’t know what you don’t know. We have a strong technical team, but security and compliance goes well beyond infrastructure or writing secure code. There are policies, processes, governance, access controls, risk management and a lot of things that need to work together. Rather than trying to hire multiple consultants to tell us what we were missing, we’ve been able to lean on Advantage Partners as an extension of the team. They help us understand where the gaps are and, importantly, what good actually looks like.

The accessibility of the team has probably stood out the most. You never feel like you’re sending a question into an audit black hole and waiting for someone to come back with a formal answer two weeks later. We can have practical conversations about something we’re considering changing, understand the security implications and work through the right approach together. That becomes really valuable when you’re a fast-moving technology company because the platform is constantly evolving.

Over the years, the relationship has become less about ‘we need to get through another SOC 2 audit’ and more about having people around us who understand Effi, understand how we operate and can challenge us to keep improving our security maturity as the company grows.

Mandeep: I think a lot of founders hear the word ‘audit’ and immediately assume someone is coming in to find everything you’ve done wrong. My experience with Advantage Partners was very different. It felt collaborative rather than adversarial. If something wasn’t quite where it needed to be, the conversation was more around: here’s the risk, here’s why it matters, and here’s how we can improve it. That was probably the biggest surprise for me. It wasn’t just about producing a report at the end. There was a lot of education throughout the process, which helped us build better security practices into the business rather than just ticking boxes for an audit.

“I think a lot of founders hear the word ‘audit’ and immediately assume someone is coming in to find everything you’ve done wrong.”

Mandeep: I wouldn’t say SOC 2 by itself has won us a deal or suddenly cut a sales cycle in half. But as we’ve moved further into Enterprise, it has definitely made the security conversation easier.

With larger customers and partners, security and compliance tends to come up very early. Having a SOC 2 Type 2 report means we can immediately show that our controls have been independently assessed rather than simply asking someone to take our word for it. We still receive security questionnaires and go through due diligence, that doesn’t disappear, but we’re starting those conversations from a much stronger position.

For me, the biggest benefit is that security is far less likely to become a blocker late in a deal. When a customer asks about our controls or an integration partner wants assurance around how we manage data, we already have a credible, independently audited framework we can point to. In Enterprise, that level of trust is becoming less of a nice-to-have and more of an expectation.

“Having a SOC 2 Type 2 report means we can immediately show that our controls have been independently assessed rather than simply asking someone to take our word for it”.

Mandeep: Yes, absolutely, particularly for a technology company that is moving into enterprise or operating in a regulated industry. As a startup, you’re constantly balancing where you put your time and money. Security is incredibly important, but most founders aren’t security or compliance experts and building an internal team around it very early can be expensive.

What I like about Advantage Partners is that they make the process practical. They understand that you’re running a growing business, not a bank with a huge compliance department. They work with you to get the right controls in place without making the whole exercise unnecessarily complicated. For us it has felt like a partnership rather than simply engaging an auditor once a year.

Mandeep: I’d tell them not to wait until a customer forces you to do it. That’s probably the worst time to start because suddenly you’re trying to build policies, introduce controls, gather evidence and go through an audit while there’s a commercial deal sitting on the other side waiting for you.

If you know that your business is eventually going to sell to Enterprise or operate in a regulated environment, start building those habits early. You don’t need to become a compliance company overnight, but designing security into the way you operate from the beginning is much easier than trying to retrofit it later. And I’d also say don’t look at SOC 2 purely as a certificate for your sales team. Going through the process genuinely forces you to look at your business differently and usually makes the company stronger.