Stone Ledger — SOC 2 Compliance Readiness
Stop Preparing for Audits.
Start Staying Ready.
Security monitoring, financial controls, remediation workflows, and verifiable evidence—all
connected in one SOC 2 readiness solution.
Replace scattered spreadsheets, disconnected alerts, and last-minute evidence gathering with a
more organized approach to compliance preparation.
$500per month · one product, one price
Independent CPA examination and attestation services are not included. Stone Ledger supports readiness; it does not certify anyone.
The problem
Compliance Preparation Shouldn't Consume Your Team.
Preparing for SOC 2 often involves gathering information from multiple systems, reviewing access permissions, tracking security issues, and documenting whether controls operated as expected.
Stone Ledger brings these activities into a connected readiness workflow, helping your team maintain visibility throughout the year.
Monitoring
Know What Needs Attention Before an Auditor Asks.
Monitor supported security and financial-control conditions and turn findings into work your team can manage.
- 1Detect
The monitor reads Stone Ledger and the registers you keep, and raises a finding when a check fails.
- 2Assign
Each finding has an owner: a named person when you have chosen one, otherwise the role responsible.
- 3Respond
Your team does the work. The assistant can prepare some fixes for a named person to approve.
- 4Verify
A finding closes when the monitor next observes the condition gone, not when someone clicks a box.
- 5Document
Findings, owners, dates and closures stay on record and feed your evidence.
Every finding has a severity, an owner and a deadline. Reminders go out at half the allowed time, a finding becomes overdue at the deadline and is escalated to Owners and Admins at one and a half times it. A critical finding is to be acknowledged within 4 hours and resolved within a day; a high one within a business day and 3 days; a medium one within 3 and 14 days; a low one within 30. You can tune the days inside a range for each severity.
It looks again within about ten minutes of a change to something it watches, and once a day regardless. That is a short delay, not a live feed. About forty named checks cover access, people, registers, vendors, finance, policies and the domains you own.
Employee offboarding
When Someone Leaves, Their Access Should Leave Too.
When payroll records an employee termination, Stone Ledger creates a leaver case that identifies the access that person still holds within Stone Ledger and the registers you keep.
The case remains open until follow-up checks observe that the identified access is gone. Once verified, a signed closure file is generated.
- 1Termination recorded
Payroll shows the employee as terminated.
- 2Outstanding access identified
Membership, API keys, portal grants, devices enrolled in Stone Ledger, and equipment and logins on your registers.
- 3Removal tasks assigned
Each item becomes a finding with an owner and a deadline.
- 4Access removal verified
The case closes only when the monitor observes every item closed.
- 5Signed closure evidence generated
A signed leaver file records the steps, the time each took, and what the platform could not see.
Financial controls
Compliance Isn't Only About IT Security.
Stone Ledger monitors supported financial-control conditions involving payment approvals, bank changes, payroll, journal entries, closed accounting periods, and reconciliation.
Two different things are on this page and they are kept apart. The accounting core enforces some rules: it refuses the action. The SOC 2 product monitors the rest: it reads the books and reports a finding with an owner and a deadline. Monitoring does not block anything.
| Control | Enforced by the accounting core | Monitored by SOC 2 Compliance Readiness |
|---|---|---|
| Second approval for large payments | When you set an amount, a payment at or above it is refused without a second approver. | Reports a payment at or above the amount with no second approver on record. |
| Separation of initiation and approval | When you turn the rule on, the person who funds or pays must differ from the approver. Off until you switch it on. | Reports something approved by the person who prepared it. |
| Bank-account changes | Not claimed as a block. Changes to where a person is paid follow a request-and-confirm step. | Reports a change that took effect without the person's confirmation, and a new vendor paid with no approval on record. |
| Payroll-run approval | The rule above applies to funding a pay run. | Reports a pay run approved and funded by the same person. |
| Journal-entry approval | When you set an approval rule (Office plan and up), one person enters and another approves. | Reports a manual journal with no second approver. |
| Closed accounting periods | A closed period refuses new postings. | Reports an entry posted after its period closed, and a month not closed within ten days. |
| Monthly bank reconciliation | Not enforced. | Reports an account not reconciled for a month, or a bank line unmatched for more than 60 days. |
Security registers
Keep Your Important Security Records Organized.
Eight records, all available with an active SOC 2 Compliance Readiness subscription. Without one they are closed; rows already entered are kept and come back when you subscribe, and nothing is deleted.
Vendor Register
Vendors, what data they hold, assurance reports and review dates.
Risk Register
Open risks with owners and review dates.
Equipment Register
Equipment and logins, who holds them, returns and revocations.
Training Register
Training completions, screening, handbook and confidentiality records.
Incident Register
Incidents with timeline, post-mortem and corrective actions.
Penetration Test Register
Penetration tests and scans, and their findings through to resolution.
Withdrawn-Document Register
Documents withdrawn from use, with the reason.
Auditor Evidence Requests
The requests your outside auditor makes, and your answers.
Accounts-payable vendor management and the 1099 vendor tab are part of the accounting product and do not need this subscription.
Alerts
The Right Alert. To the Right People. At the Right Time.
Send supported security alerts through the collaboration and incident-response channels your team already uses.
Slack
Findings as plain lines, through a Slack-compatible incoming webhook.
Microsoft Teams
An Adaptive Card to a Teams Workflows webhook.
PagerDuty
Incidents opened with your routing key, escalated, and resolved when the fix is observed.
Webhooks
A signed webhook with a stable event format for your own tools.
Urgent tenant security alerts, such as repeated wrong codes or a high-risk session stopped, can be sent to the channels you choose. Reminders, overdue notices and escalation follow the deadlines above. Each channel needs its own address or key, set up by an Owner or Admin.
Assisted remediation
Respond Faster Without Giving Up Control.
Stone Ledger's assistant, Devra, can prepare supported security actions for authorized people to review.
Suspend a member
Revoke an access key
Revoke a portal grant
Devra prepares; a named person with permission approves, and the receipt names that person.
Evidence
Evidence You Can Export. Authenticity Anyone Can Verify.
Subscribers can generate and download signed evidence bundles at no additional charge.
A free stand-alone checker lets auditors and reviewers verify a bundle's authenticity without an account: it confirms the signature and the hash of every file. A signature shows who produced a document and that it has not changed since. It is not an opinion that your controls work.
Signed evidence bundles
Records for a period you choose, signed, with a manifest. Built and downloaded by the subscriber at once. Needs a fresh authenticator check.
Public verification
One dependency-free file that needs only Node.js, plus the published list of signing keys. No login.
Evidence API
Bring evidence from your own tools in. It is always labelled supplied and never changes a control's status.
CSV feed
The same, from a spreadsheet. You can also export and stream your security records.
Not a subscriber? You can ask an operator to build a signed bundle for a one-time fee of $750 (the default; one-time, so annual-prepay discounts never apply to it).
Email & website checks
Monitor the Domains You Actually Control.
Stone Ledger provides supported email and website security checks for domains whose ownership has been verified.
You prove each domain (up to ten) by publishing one DNS record. The product then reads SPF, DMARC and the DKIM keys you name, and the website's certificate, protocol and HSTS header, once a day or on request. It makes one connection and one request per name. It is not a port scan, a crawl, or penetration testing, and it does not touch a domain you have not proved.
Audit timeline
Know Where You Stand on the Path to Your Audit.
Track readiness milestones and evidence periods for SOC 2 Type 1 and Type 2 examinations.
Type 1
Focuses on the design of controls at a specified point in time.
Type 2
Evaluates design and operating effectiveness over a defined period.
You define the date or period (up to 366 days). The timeline shows what the monitor observed on which days; a day it did not look is listed as not observed and never filled in. It does not predict an auditor's opinion, and your auditor decides what period they need.
Retention
Keep Your Evidence Available for the Years Ahead.
Three years of security-record retention are included.
Additional retention is available for $60 per extra year, billed once a year, with six months' warning before scheduled deletion. It covers security and compliance records only, not your accounting records. Records already deleted cannot be brought back.
If a subscription ends, the screens close and nothing is deleted because of it; records and register rows return when you subscribe again. Retention is not indefinite: it ends at the period you hold.
Pricing
One Product. One Price. A More Complete Readiness Process.
$500per month · SOC 2 Compliance Readiness
- Includes
- Monitoring, remediation, security registers, signed evidence, public verification, integrations, and three-year security-record retention.
- Accounting needed?
- No. It is also sold on its own, with 5 users included and $25 a month for each extra user, or as an add-on to any Stone Ledger plan.
- Billing
- $500 per organization per month. Annual billing charges 10 months for twelve.
- Not included
- Independent CPA examination and attestation services are not included.
Questions
SOC 2 Compliance Readiness, Answered.
Does Stone Ledger issue SOC 2 reports?
No. A SOC 2 report is issued by an independent CPA firm after its examination. Stone Ledger helps you gather and organize evidence and see what needs attention; it does not issue reports or certifications.
Do I need separate Evidence and Monitoring subscriptions?
No. SOC 2 Compliance Readiness is one product at $500 per month. It includes evidence management and monitoring and alerts management.
What happens when an employee leaves?
When payroll records a termination, Stone Ledger opens a leaver case listing the access that person still holds in Stone Ledger and on your registers. It closes when the monitor observes all of it gone, and a signed closure file is created.
Can Devra automatically revoke access?
No. Devra can prepare three actions: suspend a member, revoke an access key, revoke a portal grant. Each needs individual approval by an authorized person before it runs.
Are evidence bundles included?
Yes for subscribers: build and download your own signed bundle at no extra charge. If you do not subscribe, an operator can build one for a one-time $750.
Can auditors verify evidence without logging in?
They can verify a bundle's signature and file hashes with the free stand-alone checker and the published key list, with no account. That checks authenticity, not whether your controls were effective.
What happens if I cancel?
Access to the registers, alerts and bundle download closes. Nothing is deleted because you canceled; your records and register rows return if you subscribe again, within the retention period.
How long are security records retained?
Three years as standard, plus one year for each extra year you buy at $60 a year, up to four extra years. You are warned six months before deletion. This applies to security records, not accounting records.
Does the product guarantee SOC 2 compliance?
No. Nothing can. Only an independent auditor can say a company meets SOC 2, and doing the tasks does not make anyone compliant. Independent CPA examination and attestation services are not included.
Do I need a Stone Ledger accounting subscription to purchase SOC 2 Compliance Readiness?
No. It is available on its own at the same $500 per month, with 5 users included. Some checks (finance, payroll) read accounting data, so they have something to read only if you also use those modules.
Next step
Make Compliance Readiness Part of Everyday Business.
Bring monitoring, remediation, accountability, and evidence preparation into one connected workflow.
Independent CPA examination and attestation services are not included. Stone Ledger supports SOC 2 readiness, control monitoring, remediation, and evidence preparation. It does not state or imply that any customer, or Stone Ledger itself, is certified or compliant.
Pricing
Every plan and every add-on with its price and billing unit. Pay for ten months, get twelve. No setup fee.