Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 164 posts

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#81

Post by ozim »

tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

*Plenty of successful firms don't have SOC2s. If you're losing sales where SOC2 is a factor, you didn't have those sales to begin with.*

We do have ISO27k1 and we had "customer/prospect for more" and they have a person that requires us to be "DORA compliant" it is just an excuse I know because we don't fall under DORA (they might be clueless about how it works that's other explanation). They do fall under DORA so they need to make sure they check their suppliers basically have ISO27k1 and are following what we wrote in ISO27k1 documentation.

We got away with not having ISO27k1 for years (filling in forms and proving we are doing good to people that care, I did have to go and talk with CISOs so they trust me I care about stuff) but not since 2025 in Europe, I firmly believe if we wouldn't do ISO27k1 last year, people would just stop talking to us based on feedback I got from business people (excluding pure "let's make an excuse" I wrote about above).

This said - I am not arguing against what tptacek wrote as he is way more experienced than I am, just stating my experience which also is a decade in SaaS. I am working for company that has between 20 and 30 employees so it also makes sense to be ISO27k certified. We deliver b2b to big companies.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#82

Post by Lalabadie »

frenkel wrote: post #55
crote wrote: post #36

I'm currently at a small startup trying to do ISO 27001. A big issue we run into is that there simply aren't enough people . For example, the processes are built around having one person who writes code, and another person who reviews the written code. That's obviously impossible as a solo dev. You also need an internal auditor, who obviously needs to be separate from the operations team. If I recall correctly the mi…

We are a team of 1 developer and 1 sales/marketing and are fully certified. You can hire an external auditor for the internal audit. We have AI code reviews, so we don’t need an extra developer.

Let me guess: certified by Sprinto?

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#83

Post by [deleted] »

tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

[deleted]

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#84

Post by browningstreet »

tptacek wrote: post #80
lukaszkorecki wrote: post #77

Earlier quoted context omitted.

My company had 6 employees, I was the CTO and I can't imagine getting SOC2 certified without using Vanta - that was back in their early access/beta days. I had no choice - we had so many security assessments spreadsheets sent by potential customers, that getting SOC2 saved us time in the long run.

I like the people at Vanta just fine but it really squicks me out to see people doing Vanta because it's the simplest way for them to clear this dumb hurdle --- that implies that they don't understand SOC2 and are just taking Vanta's word for it. The problem is, Vanta will ask (suggest? come perilously close to demand?) you do a lot of engineering work that is absolutely not necessary for a SOC2 attestation. Worse st…

It's all negotiable. I did audits and attestations at a bank, .. everything's negotiable.

> that implies that they don't understand SOC2

Good engineering and SOC2 compliance can be on similar but not identical paths. If you want SOC2, you're bending your engineering towards that particular standard. Getting SOC2 compliant because it's time, and you have the customers, is just a step, and not a reflection of whatever good engineering you've done. If you can defend it, you can probably keep some of your variances.

If you're a solopreneur and you've never been in/near an audit, and you're committed to a vendor like Vanta, I'd recommend hiring a consultant for even a few hours to give you independent coverage of industry norms and a little coaching on sticking points.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#85

Post by codegeek »

tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

I will add a few more things to this:

- Document your data and security and share that with customers instead. You can say "We don't have SOC2 at the moment but here is all our security and data policy". It works 99% of the time for me.

- Very few companies truly have policy to reject a vendor if they don't have SOC2. Those are usually large enterprise or companies in sensitive areas such as Finance/Healthcare etc. Even then, SOC2 can be waived if you can demonstrate everything else.

Disclaimer: I run a bootstrapped SAAS with low 7 figures in ARR and even though we have ISO27001, we don't have SOC2 yet. However, we take our security/data etc very seriously and have tons of documentation and best practices that we always shafre with a customer who asks. Honestly, we will get SOC2 at some point just for the checklist as I don't really care too much about them otherwise.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#86

Post by TrueDuality »

varispeed wrote: post #73
tptacek wrote: post #57

Don't. You are exactly the wrong kind of firm to be pursuing SOC2. SOC2 is like the corporate GPL of security. It's an infectious secret handshake company security teams swap in lieu of filling out security questionnaires. Nobody savvy takes it seriously. There will come a time where your business will grow to the point where it makes sense to pay for the secret handshake. The overwhelming most likely scenario in whi…

> in lieu of filling out security questionnaires. Isn't that no longer an issue in AI era?

Do you want to trust your company's legal commitment on the output of modern LLMs?

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#87

Post by tptacek »

browningstreet wrote: post #84
tptacek wrote: post #80

Earlier quoted context omitted.

I like the people at Vanta just fine but it really squicks me out to see people doing Vanta because it's the simplest way for them to clear this dumb hurdle --- that implies that they don't understand SOC2 and are just taking Vanta's word for it. The problem is, Vanta will ask (suggest? come perilously close to demand?) you do a lot of engineering work that is absolutely not necessary for a SOC2 attestation. Worse st…

It's all negotiable. I did audits and attestations at a bank, .. everything's negotiable. > that implies that they don't understand SOC2 Good engineering and SOC2 compliance can be on similar but not identical paths. If you want SOC2, you're bending your engineering towards that particular standard. Getting SOC2 compliant because it's time, and you have the customers, is just a step, and not a reflection of whatever…

I wrote at length downthread about how much engineering absolutely should not be bending towards SOC2; it's the opposite.

https://news.ycombinator.com/item?id=48150405

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#89

Post by browningstreet »

tptacek wrote: post #87
browningstreet wrote: post #84

Earlier quoted context omitted.

It's all negotiable. I did audits and attestations at a bank, .. everything's negotiable. > that implies that they don't understand SOC2 Good engineering and SOC2 compliance can be on similar but not identical paths. If you want SOC2, you're bending your engineering towards that particular standard. Getting SOC2 compliant because it's time, and you have the customers, is just a step, and not a reflection of whatever…

I wrote at length downthread about how much engineering absolutely should not be bending towards SOC2; it's the opposite. https://news.ycombinator.com/item?id=48150405

I think we're in quite a bit of agreement.. sometimes the SOC2 review exposes gaps and you need to find a way to close them -- where do you look for critical path on that?

Also, SOC2 audits are sometimes coupled with more strenuous ones, so in the umbrella of audit season, you may have to demonstrate things, or records of things.

Re: Ask HN: How to be SOC2 Type 2 compliant as a solo-entreprenuer?

#90

Post by tempaccount5050 »

artur_makly wrote: post #71

Has no one yet found a way to vibe-code this into a viable self-service solution? and yes I do understand there is a IRL-auditing authority piece to all of this too. Perhaps there this is a play here in the market to create a new auditing firm that 99% automates all this for startups? sans fraud certs of course.

You can't automate it as it will require you to make big changes to your infra. It can take a year or more to actually do when you have a full team dedicated to it. Absolute outside the realm of a self service process.
Post reply on HN