Most early-stage founders don’t start with full SOC2 immediately. You can begin with strong security practices, transparent documentation, privacy policy, backups, access controls, and third-party audits before going for certification.
Edit: PCI would only apply if you are processing customer funds Iirc, it's been a few years since I went through one but thereay be some caveats for that to apply.