While not legally mandatory, SOC 2 is increasingly becoming a standard expectation for SaaS providers, especially when dealing with sensitive data.