Should your application involves your customers to enter their info on their own individual units, You then qualify for SAQ A. SOC two is a security framework that specifies how companies really should guard customer info from unauthorized accessibility, security incidents, along with other vulnerabilities. PCI DSS fines can differ https://www.nathanlabsadvisory.com/blog/nathan/navigating-cybersecurity-and-risk-management-a-deep-dive-into-nathan-labs-expertise/