Comment by Kainat01

Definitely possible. Start with SOC2-aligned practices and a solid public security page — many early customers care more about transparency and good security hygiene than the certificate itself.