Comment by hn_throwaway_99 | Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

Parent Full thread

hn_throwaway_99

As someone who's worked for tons of startups, it's not that binary. For loads of industries, there is simply no viable path without significant outside funding (whether from a VC or very rich founder), and even if you look at some of the most famous outliers (like Atlassian), I don't believe the path they took is even viable these days anymore.

For example, if you're selling any sort of business SaaS product these days, the regulatory regime has changed greatly from 20+ years ago. The cost of just something like SOC 2 or ISO 27001 certification, which most enterprises will require to even talk to you, often prohibitively prohibits bootstrap-like funding models. Couple that with the fact that software engineering salaries are comparatively way higher than they were 20 years ago.

The short of it is that a lot of people take VC funding not because they want the "misery of competing, stress, exposure, running all the time etc etc", but because, in many industries, there is simply no other option if you're not already rich.

(1) SOC2 is somewhere between $10,000 and $20,000 if you do it cheap.

(2) That's a dollar amount that most bootstrappers can swing.

(3) Critically, you don't do SOC2 until you have a critical mass of purchases requiring it.

(4) Many (most?) of your customers, especially your early customers, won't require it, and/or will have alternate paths for companies without a SOC2 attestation.

(5) When you finally do hit the big deal that absolutely demands an attestation, you can often cut a contingent PO: you sign the deal, deliver the stuff, but you don't get paid (or you don't get the last tranche) until you get the SOC2 attestation.

(6) You can get a SOC2 attestation real, real quick.

There may be other things keeping people from bootstrapping SAAS businesses, but this isn't one of them.

As a new self-funded founder, thank you for this.

SOC2 is also waaaay less expensive on the development side if you do just a little upfront development in dev tooling: logging, backups, encryption in transit and at rest, tagging data with sensitivity levels, IAM policies, and CI. I've seen a few founders who invested a few weekends pre-funding into this sort of tooling get to SOC2 and have almost no development costs (still have to document those processes though).

You don't even need to bother with the encryption and sensitivity levels (your data classification policy can be just that, a policy). The ace move is to roll a set of SOC2 policies that just captures what modern dev teams do anyways; that was the idea behind https://latacora.micro.blog/2020/03/12/the-soc-starting.html.

The right way to think about SOC2 is that it's a ~$15k outlay that will come up when a major customer proposes a P.O. that justifies it, and little else.

SOC2’s cost is primarily just the branding and audit.

Most of the controls are easy ti meet if you follow any sort of best practices.

Reply on news.ycombinator.com