Rancho Santa Fe Vendor Due Diligence · When SOC 2 Is the Bar, When It Isn't Enough

The 7 questions SOC 2 doesn't answer

When you're managing operational infrastructure for a multi-generational family enterprise, SOC 2 attestation is necessary but not sufficient. The questions vendors don't volunteer:

• Does the vendor have SOC 1 (financial controls) in addition to SOC 2 (security)? If you're trusting them with reconciliation, custody confirmation, or financial movement: SOC 1 matters more than SOC 2. Many tech vendors have SOC 2 only — that doesn't cover the financial-controls dimension family offices actually need.
• What's their cyber insurance limit and what's the deductible? A vendor with SOC 2 and $1M cyber insurance limit is materially different from one with $25M. For family-office-scale operations, $5M minimum is realistic, $25M for vendors handling primary banking integrations.
• Have they had a real incident in the last 36 months, and what was the disclosure pattern? Not whether the SOC 2 report contains an incident — whether they actually had one. Public filings, breach notification databases, SEC disclosures. SOC 2 attestation often persists across recovered incidents.
• Who actually owns the vendor — and is that ownership stable? Private equity portfolio companies sometimes get rolled up + decommissioned. Founder-led tech companies sometimes get acquired by larger firms with different security cultures. Family-office vendor relationships span 10-25 years; ownership stability matters.
• Do they have geographic redundancy AND legal-jurisdiction redundancy? AWS us-west-2 to us-east-1 is geographic redundancy. AWS to Azure is platform redundancy. US-domiciled to EU-domiciled is jurisdiction redundancy. Family offices managing international holdings need at least the second; sometimes the third.
• What's their NDA + non-disclosure posture under subpoena? Standard SaaS terms generally allow legal compliance disclosure. Family offices often need stronger commitments — fight-clauses, advance notification, narrow-scope production. Negotiable but vendors don't volunteer it.
• Will they sign a custom MSA with audit rights, exit assistance, and source-code escrow? Standard click-through TOS doesn't cut it at family-office scale. Negotiate: annual audit rights, defined exit assistance period (60-180 days), source-code escrow for mission-critical custom integrations. Vendors that say 'we don't do custom' aren't appropriate at this scale.

The Rancho Santa Fe reality · operator scene

Rancho Santa Fe's tech operator scene is family-office IT directors, fractional CAIO/CIO services, and high-net-worth advisory tech operations — different than the venture-funded SaaS founders elsewhere in NCSD. The actual operator in The Village or near Bridges Country Club is more like: managing 5-50 vendor relationships across portfolio companies + family operations + advisory practice + custodial relationships, with stewardship horizons measured in 10-30 years not 18-month VC cycles. For that operator, vendor DD is the daily craft — not a one-time procurement exercise.

And the geography matters: PJ's office is in Solana Beach (S Cedros, around the corner from Belly Up Tavern). For Rancho Santa Fe operators, coffee in 90 minutes is a real option — not marketing copy. Founder to founder, not vendor to prospect.