So the fact, that I recently bought used iPod, replaced the battery and storage and use it now with pair of IEMs make me some sort of a... trendsetter?
296 karma · joined April 28, 2011
The good news: there are plenty of EU-based ISO 27001 audit firms. We can recommend one or two if you need a pointer — we just don't have a formal catalogue or marketplace for that yet (though it's on my list).
So you'd use Humadroid for the preparation - policies, controls, evidence, risks, continuity plans, ISMS workbook - and then bring in an independent auditor for certification.
Oh, and you'll need vendor assessments - because your auditor will ask about that AWS subprocessor you forgot you were using.
And business continuity plans. And an incident management process.
And then, right at the end, you discover the System Description — this dense narrative document that ties everything together and somehow needs to exist before your Type I audit.
I went through ISO 27001 in 2019 and thought "never again." Then I built a tool to make it survivable and got SOC 2 Type I using it (humadroid.io). Took way longer than I expected, and I already knew the domain.
Not trying to discourage — just a heads up that the iceberg goes deep. Happy to answer questions if you're heading down this path.
What I'm trying to do differently is depth of context. Humadroid learns about your company first - how you operate, your stack, your processes. From there it generates control descriptions that are actually actionable for your setup, and policies that need minimal review rather than a full rewrite.
Whether that's enough differentiation? Ask me in a year.
Right now I recommend auditors but don't have formal partnerships. Vanta/Drata's auditor relationships are... let's say on the edge of conflicted? I don't want to go that route. And at $250/month I can't play the referral game anyway (Vanta pays hundreds per referral - that math doesn't work for me).
What I can do is democratize access. I've watched too many small teams get excited about SOC 2, then ghost once they see the total cost - $15k+ for the platform, $20k+ for consultants, $15k+ for auditors. I want the barrier low enough that smaller businesses can actually get certified and compete with bigger players.
On the checkbox vs. real security thing - you're right, it's tricky. I don't want to be another "generate docs, tick boxes, forget until next audit" platform. But targeting smaller businesses actually helps here - when you're a 10-person company, management is in the compliance process, not just signing off on someone else's work. It tends to stick better.
That said, sometimes I wonder if I help too much. My System Description assistant is almost unfair - what used to take weeks now takes minutes. Is that checkbox-enabling or democratizing? Genuinely not sure.
And yes - "vs Vanta/Drata" pages are going on the list. You're not the first to ask.
AWS and GitHub integrations first. It auto-fetches and verifies the data (where applicable), creating read-only evidence snapshots. No manual screenshots or "I swear this config was set correctly" moments during audits.
Part of the standard price - no integration tier upsell.
From there, the AI generates policies that are yours, not generic docs with [COMPANY NAME] placeholders. Same with control descriptions - they're specific and actionable for your setup, not "implement access control" with no context. It also identifies risks based on what you actually do and helps build business continuity plans around your real critical processes.
You still review everything (it's compliance, not magic), but you're editing 80% done work instead of staring at a blank template wondering where to start.
The price difference is real too, but honestly that's a side effect of being early and solo - not the core value prop.
Recently crossed the $500/month mark after a painful pivot from HR tech earlier this year. The whole thing started because I did ISO 27001 back in 2019 and was completely lost - overpaid for consultants, got lost with policies and controls, figured it out the hard way.
Passed SOC 2 Type I earlier this year using only Humadroid (yes, dogfooding a compliance tool through an actual audit was... an experience).
Currently finishing automated evidence collection (AWS and GitHub integrations first). Pretty proud of that one - compliance shouldn't mean "panic-screenshot everything before audit."
Still in beta and learning a lot from each customer we onboard. We're actually going through our own SOC2 assessment in August, which has been... educational. Recently added business continuity and incident tracking features. Trying to build something that's actually helpful rather than just another compliance checkbox tool.
If anyone's interested: humadroid.io or feel free to join our beta waitlist at https://humadroid.io/join-the-humadroid-beta-waitlist/
If anyone's been through the compliance journey, would love to hear what worked (or didn't work) for you!
Vanta/Drata are big players and they're charging big time for their platform. That's why I've started working on own startups, that's meant to disrupt this for SMBs - by making it waaay more affordable (for managing compliance, not attestation/certification itself, which we don't do).
I wanted to start with "this week in review" series, but it ended quite quickly.
Now I want to publish lesson learned while building my side-project (https://humadroid.dev), which is a missing tool I wish I had when running software house year-and-a-half ago, before I sold it.
Topics considered for near future:
* lessons learned while coding it in Rails with hotwire & stimulus
* lessons learned actually sellign it to people (Open-Startup idea/movement is close to my beliefs).
Regarding processes - yes and no - if you can viably proof, that process is not (yet) needed and you're doing things in reasonably manner, then you're good. It's up to you what processes you'll introduce to the company. What we think we did well is that whole certification did not change how we work and it was (almost) painless for our employees (or at least I like to think so).
Certification is not easy and it's not cheap (don't anyone tell you it's otherwise), it's time consuming, but can be done in few weeks (we managed to get certified in 3 months). It's worth mentioning, that instead of covering whole company, you can cover only small department fitted in one room. Maybe not best practice, but certainly possible. And being slightly paranoid beforehand helps a lot. Also - given how time consuming it is once you have it, it's worth to have someone (somehow) dedicated to it in the company - fortunately my great COO does most of the paperwork and checks processes between audits.
Most of our (potential) clients do not ask often about it, but I think it helps to mention ISO at some point. Bigger clients dealing with personal (or health) data do require it and it's a deal breaker.
[1] https://tiomsu.com [2] https://www.youtube.com/watch?v=mx7Ai-PhvAM