fire the client.

either they will use the app without soc2 or they will find an alternative.