u/East-Performance-531

One thing I see confuse founders: “We run everything on AWS, and AWS has a SOC 2, so we're covered.” AWS's SOC 2 report covers AWS's controls and infrastructure. It doesn't cover your application, your access controls, your employees, or how your company handles customer data. You can inherit certain controls through the shared responsibility model, but you still need to demonstrate how your controls work. I'm curious for people who've actually been through SOC 2 Was the AWS/shared-responsibility distinction obvious to you, or was it something you had to figure out during the process?