Selling to US companies · compliance

Selling to US companies? Be ready for the security review.

US buyers check your security before they sign. Most ask for SOC 2, a recent pentest and a completed questionnaire. Healthcare adds HIPAA, card payments add PCI DSS, and privacy comes up in every review. AEGIS builds the program once and keeps it current.

Book a call What buyers ask for

Every framework on every plan, priced by team size. You choose your auditor.

Most-asked reportSOC 2 Type II

Healthcare buyersHIPAA and a BAA

Card paymentsPCI DSS

State privacy laws in effectAbout 20 states

What buyers ask for

It depends on who you sell to.

Every US enterprise buyer starts with the baseline. Your industry decides what comes on top.

The baseline security review

Any US enterprise buyer

SOC 2 Type II
Recent pentest
Security questionnaire
DPA and subprocessors

Anything that touches patient data

Healthcare: providers, payers, health tech

Anything that touches card data

Payments, commerce and fintech

Security plus data protection

Global and EU-heavy buyers

How you govern models and data

Buyers of AI products

NIST AI RMF
ISO 42001
AI data flows

The order to do it in

From first US deal to enterprise-ready.

Start with SOC 2 Type 1

A Type 1 report checks your controls at one point in time and unblocks early deals while you build history. AEGIS builds the program in an afternoon.

Have the pentest and answers ready

Most reviews ask for a recent penetration test and a questionnaire. Keep the VAPT report, drafted answers and a trust center ready before the first deal asks.

Move to SOC 2 Type 2

Type 2 covers how your controls worked over an observation window, usually three to twelve months. Evidence keeps collecting in AEGIS, so the window runs on its own.

Add frameworks as buyers ask

Healthcare customers bring HIPAA, payments bring PCI DSS, EU customers bring GDPR. They map onto the same controls, and every framework is on every plan.

US privacy, briefly

No single law, so buyers ask instead.

The US has no single federal privacy law. Instead, about 20 states have broad consumer privacy laws in effect, California's being the best known, alongside sector laws such as HIPAA for health data. The FTC also acts against companies whose security practices are unfair or deceptive.

For a vendor, that patchwork usually reaches you through contracts: a data processing agreement, security terms and a questionnaire. The security controls those terms expect are the same ones you build for SOC 2 and GDPR. AEGIS does not have a separate state-privacy framework, and the notice and opt-out rules sit with your counsel.

How we help

What changes when you work with us.

Through security reviews faster

Questionnaires get AI-drafted answers from your own policies, a trust center shares what buyers need, and the pentest report is ready when they ask.

SOC 2 without starting over each year

Your program stays current on one control set, evidence keeps collecting, and next year's audit is a walkthrough instead of a rebuild.

The auditor that fits your buyer

Choose a tier 1, 2 or 3 firm, US-based or India-based, depending on who you sell to and what you want to spend.

A pentest your buyer can read

VAPT reports scored with CVSS v3.1 and mapped to OWASP and CWE, with fix steps and a retest, delivered in 5 to 36 hours.

Know what you ship

Every API mapped to the customer data it touches, leaked keys flagged as live or not, and every third-party and AI service your code calls listed for your subprocessor list.

One program for every market

SOC 2 and HIPAA for the US, GDPR for Europe and the DPDP Act for India, on the same controls and evidence.

Selling from India

What changes when you sell from India.

Very little in the requirements, more in the questions. US buyers apply the same review to an Indian vendor, and add questions about where data is stored, who can access it from where, and how incidents are handled across time zones.

AEGIS keeps the DPDP Act for your Indian users and SOC 2, HIPAA or PCI DSS for your US buyers on one control set, so you answer both from the same evidence. You choose a SOC 2 auditor based in the US or in India.

FAQ

Frequently asked questions

Answers to the questions we hear most. Cannot find what you are looking for? Reach out.

Still have questions? Contact us

Do we need SOC 2 to sell to US companies?

Not by law, but most US enterprise buyers expect a SOC 2 report, and without one the deal usually waits on a long security questionnaire. Many teams start with a Type 1 report to unblock early deals, then move to Type 2.

SOC 2 Type 1 or Type 2 first?

Type 1 is faster because it checks your controls at a single point in time. Type 2 covers how they worked over three to twelve months, and it is what most enterprise buyers ultimately want. Starting with Type 1 while the Type 2 window runs is common. Read our SOC 2 guide.

Can an Indian company get a SOC 2 report?

Yes. SOC 2 is an attestation issued by a licensed CPA firm, and many Indian SaaS companies hold one to sell to US customers. With AEGIS you choose the auditor, US-based or India-based, and give them read-only access to your evidence.

Do US privacy laws apply to us?

Possibly. There is no single federal privacy law, but about 20 states have broad consumer privacy laws in effect, most applying above set thresholds of residents' data or revenue. Sector laws such as HIPAA for health data also apply, and the FTC acts against unfair or deceptive security practices. AEGIS does not have a separate state-privacy framework; the security controls overlap with SOC 2 and GDPR, and your counsel handles notice and opt-out rules.

Does HIPAA apply if we are based outside the US?

It applies through your customers. If you handle protected health information for a US healthcare company, you will sign a business associate agreement that holds you to the HIPAA Security Rule. Read our HIPAA guide.

What about FedRAMP or CMMC?

Those apply when you sell to the US government or defense supply chain. They are not frameworks AEGIS covers today, so if federal buyers are your market, plan for a specialist path. For commercial US buyers, SOC 2, HIPAA, PCI DSS and the NIST frameworks AEGIS supports cover what is usually asked.

How much does it cost to get ready?

With AEGIS, every framework is included on every plan, priced by team size. The SOC 2 audit fee is set by the CPA firm you choose, and our VAPT starts at ₹15,000 for up to 100 APIs.