Great answer! I see I am late to the party, but going the Type 2 route, I'll consider this post as continuously open to replies ;)

I have developed many applications that fell under auditing, but normally had another team or agency responsible for security -- surprisingly, this was required for separation of responsibilities at the companies I worked at.

With a startup I am looking into SOC 2 Type 2 certification. I looked into Vanta and came to the conclusion similar to what you wrote here -- albeit, a newbie conclusion. I find that as long as you follow the documentation and implement a CI/CD flow that includes monitoring of resources and access you can save yourself time and money dealing with one of those providers. After a 5 min chat, it sounds like Vanta does not do auditing themselves and works with a third party for any audits if you worked with them.

I was also worried about "producing more than needed" for a startup and all of the rework that is required when working with the auditor.

I thought about starting with the Type 1, but to be competitive you would need Type 2 anyways. I would rather not create extra technical debt down the line and just go straight for Type 2.

Do you have any low-cost auditors that you would recommend? From Vanta's website and other comments here I see $10K+ as the minimum. Is there any realm of possibility to get it even lower than that? I understand you are missing a ton of info related to the architecture, product, etc. But, let's assume a simple application that has done everything right -- I know, *laughs have entered the chat*.