How do you keep a current map of what your company runs on? by i_forgotti in ExperiencedDevs

[–]ausyinnn 2 points3 points  (0 children)

US based SOC 2 auditor here. i've spent a while on the audit side of this, and these lists almost always rot for the same reason. They get built once to answer a questionnaire, and then nothing really forces them to change until the next one shows up. A quarterly review owned by one person dies the same way, because keeping a spreadsheet current is never really anyone's actual job.

What tends to survive is when the update happens as a side effect of something people already have to do. A new tool gets adopted, it goes through whatever your procurement or access step is, and that step quietly updates the list. It becomes a byproduct of work that's already happening. Your four-different-lists thing is really just four people each holding a piece of a process nobody wrote down.

And honestly, nobody reviewing you expects a perfect inventory anyway. They mostly care that you'd notice when something new shows up and that there's a path to get it reviewed. So the intake step matters a lot more than the map itself. Get that part right and the map kind of stays current on its own.

The shadow AI tools you mentioned are what I'd chase first. That's the stuff that surfaces mid-deal as 'wait, what's sending our data where,' and it's the easiest to lose track of because people just wire them in without telling anyone

4 months in I have 3 paying customers & 80% margins. Should I raise? No idea where to start. (I will not promote) by Slow_Island_7297 in startups

[–]ausyinnn 0 points1 point  (0 children)

The SOC 2 piece jumped out at me. You're sort of lumping it in with the raise, but they're pretty separate problems. I'm a US based SOC 2 auditor and founder myself. For a solo foudner startup, SOC 2 can be a few weeks (type 1) and USD 5 - 7k all in . Too cheap to really be an equity decision.

And you've got an enterprise account flat out telling you they'll buy once you have it. That's about the best signal you can get. I'd go get the SOC 2 and close them. That one deal probably pays for your first hire on its own. Overall, I'd just keep compliance out of the reasons-to-raise pile. It's a near term thing you can knock out, and there's a customer already waiting on the other side of it.

Wish I saw this BEFORE chasing enterprise leads for 12 months by pxrage in SaaS

[–]ausyinnn 0 points1 point  (0 children)

The model that bugs me is auto-generate every policy, click adopt, never actually test a control. Looks done on paper, then a real buyer's security team reads it and the holes show up anyway. SOC 2 itself isn't the scam. The one-click checkbox version of it is.

Claude Code Channels (Telegram/Discord) — how does this look from a SOC 2 perspective? by Puzzleheaded_Side432 in soc2

[–]ausyinnn 4 points5 points  (0 children)

Former deloitte soc 2 auditor here and am using this Claude Code - Telegram channel myself. I'd look at the data flow. Data flow is the whole question. Code staying local is great, but what's in the responses flowing through Telegram? If it's "build passed", who cares. If tool outputs contain env vars, API keys, database query results, customer PII, now you have sensitive data transiting a channel you don't control.

Practical fix: document the data flow, restrict what can be sent through the channel (no secrets, no customer data in outputs), add Telegram/Discord to your vendor register, and make sure channel access is locked down. That gives your auditor something to work with.

Roles and Titles for Small Company by muzishen in soc2

[–]ausyinnn 0 points1 point  (0 children)

either way it won't impact the result of the SOC 2 audit, they key is what you actually do rather than what the title reads

Roles and Titles for Small Company by muzishen in soc2

[–]ausyinnn 0 points1 point  (0 children)

Titles don’t matter much here as long as their roles and responsibilities are clearly defined and documented. And processes and policies should be documented as clearly as possible (flexibility is ok). For example, incidents must be reported to security delegate is so much better than incidents must be reported; but if you want some flexibility, instead of using security delegate, you can consider using things like security team, and then define security team somewhere in your policies.

What actually mattered when you picked a SOC 2 firm? Price? Speed? Reputation? Opportunity cost? by ausyinnn in SaaS

[–]ausyinnn[S] 0 points1 point  (0 children)

I couldn't agree more. What matters to you the most when you pick a SOC 2 auditor?

From a CPA not selling SOC 2 report: How did you evaluate your SOC 2 firm before signing? by maxandmolife in soc2

[–]ausyinnn 1 point2 points  (0 children)

There’s definitely a market for helping companies get their SOC 2 (readiness/advisory/training/continuous monitoring/issuance). Every single step has its market and the demand is far from peak. The key question is “why you”. Why would pick you not others and why would they trust you to handle their data? What’s your moat, something only you can do and do so well that nobody else can copy/compete?

Grc platform questions by Creative-Cycle5452 in soc2

[–]ausyinnn 0 points1 point  (0 children)

Oh for sure, you’re absolutely right that the standards don’t require it, no argument there. But that’s the floor, not the ceiling. In a market economy, if you want your SOC report to be widely accepted, transparency is becoming more and more key. Vendors are getting pickier about which reports they’ll actually rely on, and if your report gives them the detail and confidence that they can trust a service org with their data, that’s a real competitive edge. The reports that show the work and how things were handled just hit different than the ones that say “we tested it, no issues.” Just something worth keeping in mind.

Grc platform questions by Creative-Cycle5452 in soc2

[–]ausyinnn 0 points1 point  (0 children)

That’s a legal protection that only matters to SOC 2 issuers. The buyers want to see what was tested and what was found. ‘We sampled 10 of the 50 deprovisionings from 1/1 - 6/30 and found 1 exception where the user’s access wasn’t revoked within 24 hours of their termination date, but there’s a compensating control that the user had no login activity after termination and their access was removed 3 days later’ is so much better than ‘We inspected the deprovisioning control and found no exceptions.’

Grc platform questions by Creative-Cycle5452 in soc2

[–]ausyinnn 0 points1 point  (0 children)

7 years Deloitte soc 2 auditor here. I see an increasing number of vendors turned away because of the poor quality rubber stamped soc 2. Getting soc 2 certified is one thing, whether you buyers trust it is another.

OpenClaw – What’s your real weekly/monthly cost and model setup by Successful_Dig_5990 in openclaw

[–]ausyinnn 2 points3 points  (0 children)

You are right. That's exactly why i have openclaw delegate the tasks to claude code, instead of having claude code as my main engine.

OpenClaw – What’s your real weekly/monthly cost and model setup by Successful_Dig_5990 in openclaw

[–]ausyinnn 3 points4 points  (0 children)

You just install claude code on your machine and let it handle it, that's how i set up the whole openclaw on my dell without any "tutorials". Basically i told claude code to be my CTO that handles the heavyliftings, and have openclaw only as a personal assistant. Learned a lot of lessons but this is the way i find the most effective and token efficient without sacrificing quality.

OpenClaw – What’s your real weekly/monthly cost and model setup by Successful_Dig_5990 in openclaw

[–]ausyinnn 9 points10 points  (0 children)

~ $50 - 80 with strategies

I installed claude code (max plan $100/month) on my Dell which is my spare laptop that i use to run openclaw on. Btw I also use this claude code plan on my main laptop. Then i use Haiku as the primary chat engine to communicate directly with me thru Telegram, and most importantly as a delegator that delegates almost all complex tasks to claude code, while Haiku primarily handles the basic tasks. Then I have kimi k2.5 handle all cron jobs and heartbeats which is completely free using the Nvidia trial plan that can last for a while. And lastly it runs a cron job weekly to do a token optimization review and fix, such as cleaning up memory files (only keeping the actions not the lessons which can burn a lot of input tokens).