How Sfere earned a clean SOC 2 Type 1 after seven weeks of preparation, for about USD 6,000, with no consultants

About Sfere

Sfere (legal entity: Fanfinity) is a Saudi-founded, Riyadh-headquartered fan data platform for sports and live entertainment. It collects fan signals from websites, apps, ticketing, point-of-sale and streaming into one consented, first-party fan profile that clubs, leagues and broadcasters use for sponsorship and advertising.

The company is a remote team of 15 people spread across several countries, running on Google Cloud (GCP), Google Workspace and GitHub. Its customers are enterprise buyers: broadcasters, clubs, federations and large media groups. Sfere publishes its security posture, including its SOC 2 report status, on its public Trust Center.

The challenge

Sfere's buyers were asking for SOC 2 as a baseline in security questionnaires and RFPs (requests for proposal), and the company was heading into a broadcaster's technical due diligence and several tenders at once. The team wanted the report in hand before those processes started, not halfway through one.

The security fundamentals were already in place: multi-factor authentication (MFA), least privilege access, encryption and cloud security tooling. What was missing was everything an auditor needed to see. Nothing was written down as policy, and no evidence had been collected. Structured SOC 2 work began when Sfere signed up with SimpleAudit in early August 2026.

What a SOC 2 Type 1 covers

A SOC 2 (System and Organization Controls 2) Type 1 report is an independent CPA firm's opinion that a company's controls are suitably designed as of a single date. Sfere's report covers the Security criteria, the one Trust Services Criteria category every SOC 2 report must include. A Type 2 report goes further and tests whether those same controls operated effectively over an observation window, typically three to twelve months.

When a buyer deadline is less than about three months away, as it was for Sfere, a Type 1 is the fastest honest answer, and it leads directly into the Type 2. For more detail, see SOC 2 Type 1 vs Type 2, What is in a SOC 2 report and How long does SOC 2 take. Unfamiliar terms are defined in the SOC 2 glossary.

Why SimpleAudit

Sfere heard about SimpleAudit through beIN Sports and compared it against Delve. The deciding factor was a clear path to a Type 1 report with an auditor, at a price that made sense for a company of Sfere's stage.

The main doubt was that it seemed too good to be true. Sfere had been quoted USD 15,000 to 35,000 for platform plus audit elsewhere, and the SimpleAudit price and timeline were so far below that the team was not sure the resulting report would hold up with enterprise buyers. In practice, the report now goes into every RFP and due-diligence questionnaire Sfere answers.

The work

The whole effort took about 40 hours of team time across seven weeks. Asmir Ibrovic led the hands-on work; Mohammad Abu Musa handled policy reviews and sign-offs. Sfere signed up on 3 August 2026 and reached its audit date on 13 October. The audit itself was performed by MJD Advisors, a US-based, peer-reviewed CPA firm that specializes in SOC reports.

Two things went faster than expected:

• Policies. SimpleAudit's templates took Sfere to a full information security program (access control, change management, vendor management, incident response, AI governance and more) far faster than writing from scratch. See the 19 core SOC 2 policies for what that program covers.
• Evidence collection. Instead of dragging files in one at a time, Asmir used Claude with the SimpleAudit MCP (Model Context Protocol) server, which lets an AI assistant work directly inside the platform, along with the Google Cloud command-line tools and Chrome to pull evidence from Sfere's infrastructure and Google Drive and push it straight into the evidence vault. About 95 percent of the evidence went in that way; the network topology diagram was the only item done by hand. The SOC 2 checklist for small teams lists the evidence auditors ask for first.

The features the team relied on most:

The hardest part came after the audit, not before it. Sfere expected a public Trust Center page out of the box, and obtaining the SOC 2 logo meant a separate form from the AICPA (American Institute of Certified Public Accountants, which licenses the SOC logo) that does not link back to the platform. SimpleAudit has since shipped the Trust Center, which closes most of that gap; Sfere's is live here.

One opportunity surfaced during the audit itself: streamlining how evidence moves between the platform and the auditor. MJD Advisors works in its own request portal, a common setup with audit platforms, so some evidence was shared in both places. Because Sfere had already organized everything in SimpleAudit, the team saw a chance to let the auditor review it there directly. SimpleAudit has since added two things in response: a read-only auditor role, so an auditor can review policies, controls and evidence directly in the customer's workspace, and an audit package export that pulls policies, evidence, controls, vendors, risks and more into a structured zip file any audit firm can load into its own system. Auditors on new engagements are now pointed to the export first.

What it cost

Sfere's all-in cost to reach a clean Type 1 came in under USD 6,000, covering the platform, audit, penetration test and AI tokens, against quotes of USD 15,000 to 35,000 for platform plus audit from other providers. The largest line was the audit fee from MJD Advisors, which is USD 5,000. Audit fees vary by engagement, and Sfere's pricing is not necessarily representative of other SOC 2 audits. SimpleAudit was USD 299 per month at the time, on a month-to-month Prove subscription with no annual commitment; annual billing and other plans are listed on the SimpleAudit pricing page. Other costs totaled about USD 130, and no consultants were involved. The savings came from the approach rather than any single vendor's rate: policy templates, AI-assisted evidence collection and about 40 hours of team time. For how this compares to the typical route, see How much does SOC 2 cost?

Results

The final report from MJD Advisors arrived on 20 October 2026: a clean SOC 2 Type 1 opinion on the Security criteria, as of 13 October 2026. Sfere followed up with a five-star review of SimpleAudit on G2.

The report has already been requested three times by prospective customers. Sfere now uses it in RFP responses and in enterprise security and due-diligence questionnaires. Instead of answering every control question from scratch, the team points to an audited report. It has also proven useful in investor conversations.

What's next

Sfere is kicking off its SOC 2 Type 2 with SimpleAudit in early November 2026.

The team's feedback has already shaped the product. The Trust Center they asked for is now live, and the auditor read-only role and audit package export came directly out of their audit experience. Sfere also asked for a smoother hand-off from "report issued" to "badge and public page live" (the SOC 2 logo itself is issued by the AICPA, so the gap is in guiding customers through that step), and, for Type 2, a clear view of which recurring controls are due during the observation window. That second one is waiting for them: it lives in the audit-engagement journey, which starts with the Type 2. Each recurring control (access reviews, policy reviews and the rest) becomes a periodic task with an owner, a comment thread and a calendar invite.

In their words

About 40 hours and seven weeks of preparation to a clean SOC 2 Type 1 opinion, with no consultants.

About the auditor

MJD Advisors, LLC was founded in 2021 with a simple idea: information security doesn't need to be complex or unpredictable. The firm specializes in SOC and related reports and aims to help clients reimagine the entire compliance process. MJD Advisors is a US-based, peer-reviewed CPA firm serving clients around the world, including across North America, South America, Europe, Africa, Asia and Australia.

MJD Advisors is SimpleAudit's audit partner.

About the penetration tester

TurboPentest offers self-service agentic AI penetration tests: buy online and get a validated report, signed attestation letter and attack surface map in hours. Tests start at USD 99 and scale up through deeper agentic tiers to expert, human-driven penetration tests. Simple enough for business owners, powerful enough for security professionals.

About the author

Author

Joe

Founder, SimpleAudit