We Are Compliant With Everything

We considered outsourcing our compliance to a professional vendor.

The market leader had raised $32 million from Y Combinator. They had a billboard that read: “Compliance before you tell your parents you dropped out of MIT.” They had produced 494 SOC 2 audit reports. Impressive, on paper.

Less impressive: 99.8% of those reports contained identical boilerplate. Test values across different clients included “sdf” and “dlkjf.” For context, these are the sounds a human makes when their forehead hits a keyboard.

Four controls were marked “untestable” in 259 separate reports due to “zero incidents.” Statistically, this is like flipping a coin 259 times and getting heads every time. Technically possible. Technically.

Their clients included a well-known AI company, a well-known fintech, and a well-known productivity tool. We are not naming them because we respect privacy, which is more than their compliance vendor did.

They also acquired an open-source product, rebranded it as proprietary, and tried to sell it back to the original creator. During the sales call, they offered him an Arcteryx jacket and a box of donuts.

When confronted with evidence, the CEO described it as “an AI-generated email.” The evidence was a 40-page forensic audit with annotated screenshots.

We decided to handle compliance in-house. Our method,doing nothing and being upfront about it,has a comparable accuracy rate and costs $32 million less.