A lot of early stage founders ran into this. Strong internal processes can already build a lot of trust before full SOC2 Type 2.