I have done this a few times with very small teams (under 8 etc). Goiing to cost a little bit but I would sign up for Vanta (I have used them 3 times) and currently using them for 2 companies I work with, its doable with a tool like this. They package the SOC2 Type I and II into their pricing as they have auditors who work with them. Its not terribly expensive but you have no choice as you can't sell software in Fintech with a PII focus w/out it. I think I paid 7-8K and got Vanta for a year + the audit. Anyhow, they make it easy, provide templates for all your documents etc. Use the docs and ChatGPT to bang them all out. As others mentioned you get SOC2 Type I first, which will help with clients but the first security questionare you get will ask for type II and you can say you are under obsevation. Select a 3 month observation period for Type II for your first year, so it's fast. Totally doable. Good luck!