You'd probably want to get SOC 2 certified at some point, to not turn away a decent amount of potential users.