When Do Enterprise Buyers Actually Start Demanding SOC 2 Compliance in SaaS Startups?

Unpopular opinion: SaaS startups may invest in compliance too early. I've been thinking about the timing of SOC 2 and compliance tools. At what stage do enterprise buyers ACTUALLY start demanding SOC 2? → Seed → Series A → First enterprise deal → Or only when a specific buyer requires it? Curious to hear from founders and GTM folks who've seen this firsthand 👇