If you are hosted on cloud, you can probably ask your cloud provider for it. for instance digital ocean provides it (i was recently asked for the same for one of my services, and you can say no to banks)

https://www.digitalocean.com/community/questions/is-digitalo...

> Our NYC2 facility is SSAE16 SOC-2 Type II certified. > Our NYC3 facility is SSAE16 SOC-2 and SOC-3 compliant.