One of the things I've encountered as a startup doing the danish equivalent of a SOC2 is issues with VendorSec. (We don't have much revenue yet, but our customer segment really cares about this sort of documentation) is that many cloud providers (..TypeForm) requires you to spend thousands of dollars with them annually before they're willing to give you any security details or audit reports at all. This means that we have a hard time making revenue because we don't have the certifications, which we can't get because we can't spend enough money to get access to them.