We are a small shop and being asked for SOC2 compliance.

Is anyone here self hosting a significant part of their infra and compliant?

What challenges did you face doing it?