%20--%3e%3cstyle%20type='text/css'%3e.cls-0%20{fill:%23FF9900;}%3c/style%3e%3cpath%20class='cls-0'%20d='m117.3%2084h-14.1l39.2-79h-24.8l-20.3%2041.7-20.5-41.7h-3.8l-20.3%2041.7-20.8-41.7h-24.3l41%2083.3h8.2l18.2-37.7%2018.3%2037.8h23.7v2.8h10.7v-10.5h-10.6v3.3h0.2zm3.3-74.7h15.2l-28.9%2057.1-7.2-14.9%2020.6-42.2h0.3zm-69.3%2074.9-37-75h15.1l20.8%2042.4-5.8%2011%204.1%201.6%2016.9-33.9%207.2%2015.7-18.4%2038.1-2.9%200.1zm44.5-0.1-28.2-58.9%207.4-14.8%2029.6%2060.8-6.1%2012.9c0%200.1-2.7%200-2.7%200zm27.9%200.6v2.8h-3.1v-2.8h3.1z'/%3e%3c/svg%3e)
HIPAA-compliant migration to Google Cloud, SOC 2 Type II achieved in six months
Regulated migrations carry a second project inside the first. The systems have to move, and the move itself has to be evidenced — access, encryption, logging and change control all demonstrable rather than asserted.
- HIPAA-compliant migration to Google Cloud
- SOC 2 Type II achieved
- Delivered in six months
What made it hard
Regulated migrations carry a second project inside the first. The systems have to move, and the move itself has to be evidenced — access, encryption, logging and change control all demonstrable rather than asserted.
SOC 2 Type II raises the bar again, because it examines controls operating over a period rather than existing on a date. That makes it a question about how the platform is built and run, not a document produced at the end.
How it was done
Controls designed in, not audited on
Encryption, access boundaries and logging were part of the platform design. Controls added after a migration have to be retrofitted across everything that already moved.
Evidence from the systems themselves
Where evidence could be produced by the platform rather than assembled by hand, it was. Audit preparation that depends on screenshots does not survive its second year.
Change control that engineers can live with
Review and approval built into the delivery path, so compliance and shipping are the same motion rather than competing ones.
Where it landed
Migration completed to Google Cloud on a HIPAA-compliant footing, with SOC 2 Type II achieved inside six months.
Six months covering both the migration and a Type II period is a tight window; it holds only when the controls are part of the build rather than a phase after it.
Bring us the version of this you are facing
A 45-minute call with the engineer who would run it. We will tell you what we would look at first, and whether it is a project at all.
Talk to an Engineer