That makes sense, we're going through our annual renewal now. It's a great experience to harden and test systems.

For the first SOC2, I don't hold this against a startup (I appreciate they are going through the efforts this early). Would want to see it become 6 month/1 year as the program matures. A vendor like this is low risk (aggregator of "public" information, limited data sharing, etc).

I have all sorts of issues with Vanta/Drata "compliance as a service" tools, but adequate for something like this, at this point in time.

Tbf, I’ve found it’s a good sign when an org goes through this pain early on - less chance for tech debt to pile up.

Most of my employment has been in the security auditing/testing space, and the difference between “bolting it on later” and “building it in from the start” is incredible from both a purely technical and a process standpoint.