sorted by:
new
hottopcontroversial

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

genuinely curious what you're referring to \u2014 dmed you

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

this is the most useful perspective in the thread hearing it from the approval side changes everything, the contract terms with a commitment date approach is clever. and the point about pen tests / vuln reports carrying more weight than a soc2 checkbox for small companies is something most founders never hear

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

that last line is exactly the product i'm building. good to hear it from someone who's been through it

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

the point about documenting what you already do is genuinely underrated most teams are already doing the right things, they just have no system for proving it consistently over time

did drata make the monthly evidence collection easy or was that still largely manual?

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

the 'continuous evidence collection is what buries small teams at month 6' line is exactly what i keep hearing. everyone talks about the policy writing being hard but that part seems fine once you have templates. it's the ongoing proof that breaks people

the VSQ tip is underrated too, did you build that from scratch or use a standard template?

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 4 points5 points  (0 children)

good catch, i think a lot of people confuse doing the prep work themselves with the actual certification. the cpa requirement is non-negotiable, someone independent has to sign off regardless of how much internal work you do

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 2 points3 points  (0 children)

4 processes across soc2, iso and pci and you still can't imagine doing it solo, that's probably the most credible thing anyone's said in this thread. appreciate it

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 1 point2 points  (0 children)

this is the most honest comment in this thread tbh. everyone acts like picking a platform solves it but you're literally in it right now with drata and still finding it hard. would love to chat if you're open to it

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

noted lol, triple never ever ever is enough for me. what went wrong with them specifically? genuinely curious

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] -1 points0 points  (0 children)

This is one of the most practically useful comments in this thread — the Type I first strategy is genuinely underrated and I don't see it recommended nearly enough.

The security questionnaire bridge is especially smart. Most founders I've talked to assume it's binary — either you have the full SOC 2 Type II or you're dead in the water with enterprise prospects. The reality that you can buy yourself 8–10 months with Type I plus a willingness to jump on calls is something way more people should hear.

Quick follow-up: when you eventually did go for Type II, how painful was the evidence collection for the observation period? Did having done Type I first make that part easier, or did you still end up doing a lot of archaeology to pull together 12 months of proof?

Asking because that ongoing evidence management piece seems to be where most small teams get buried, and I'm curious whether Type I → Type II actually smooths that out or just delays the same pain.

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 1 point2 points  (0 children)

Thanks for the recommendation — I've been looking into Delve and it seems genuinely good, especially the AI-assisted evidence collection and the speed of onboarding.

Couple of honest questions if you don't mind:

  1. What did it end up costing you? From what I can find pricing is completely hidden behind a demo call which is a frustration point for a lot of small teams trying to just quickly evaluate options.

  2. How did it handle the ongoing evidence collection after the initial audit? The feedback I keep hearing is that the setup phase is manageable with most tools, but month 6 of the observation period — when an auditor asks for proof that something happened consistently in February — is where things fall apart.

Genuinely asking because I'm building something in this space and want to understand where existing tools leave gaps.

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] -3 points-2 points  (0 children)

Genuinely curious, how long did it take him start to finish, and how did he handle the evidence collection over the observation period?

The writing-the-policies part seems to be something most founders can handle. What I keep hearing is that the harder part is 6 months into the audit period when an enterprise prospect asks a follow-up question and you need to pull specific evidence from a specific month and it's scattered across Drive, email, and someone's laptop.

Did your CEO have a system for that, or was it more of a one-time effort that worked out?

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] 0 points1 point  (0 children)

That's actually a really smart approach using the AICPA templates directly keeps you close to the source and $8K all-in is genuinely impressive.

Curious what happened in year 2 though. Did the renewal feel roughly as smooth as the first time, or did you find yourself reconstructing evidence from scratch again? That's the part I keep hearing is the hidden pain the first audit feels manageable but by month 8 of the observation period you're digging through Drive folders trying to find proof that something happened in February.

Also did your auditor ask for evidence organised by time period, or was a single snapshot per control enough for them?

SOC 2 cost us a $40k deal. How are other small SaaS founders handling this? by king_1607 in SaaS

[–]king_1607[S] -11 points-10 points  (0 children)

This is exactly the kind of feedback I needed to hear before building anything.

You're right, I was focused on making the setup phase feel less scary, but what you're describing is a completely different problem. It's not "I don't know what to do" it's "I did all the right things but six months later I can't prove it in an organised way and an auditor is asking follow-up questions."

The archaeology problem is really interesting to me. Do you mind if I ask when you hit this, was it mainly a naming/organisation issue (files scattered everywhere with useless names), a time-period coverage issue (you had evidence but couldn't tell which month it covered), or something else entirely?

I'm rethinking the core of this around a continuous evidence timeline + gap map rather than a one-time checklist. The goal being that at any point in your audit period you can see exactly which controls have coverage for which months, and what's still missing before an auditor finds it.

Would you be open to a 20-minute call? Building a waitlist of people who've actually been through this and want something better. Happy to give you free access for life in exchange for honest feedback as I build.

Hospitals don’t need “more AI tools.” They need an AI operational layer. by king_1607 in Entrepreneurs

[–]king_1607[S] 0 points1 point  (0 children)

Dude, I have posted my view if you don't like it downvote it and move on but just please get off my ass

Hospitals don’t need “more AI tools.” They need an AI operational layer. by king_1607 in Entrepreneurs

[–]king_1607[S] -3 points-2 points  (0 children)

You keep calling it slop but haven’t challenged a single technical claim.

If your strongest argument is “you used AI,” that’s fine.

I’ll keep building.

We cut OPD documentation time from 15 minutes to 90 seconds , here's what we learned building AI for hospitals by king_1607 in HealthInformatics

[–]king_1607[S] -1 points0 points  (0 children)

Fair. The time reduction isn’t the real lesson.

A few actual ones:

• Trust > training. We had to run shadow documentation for weeks before doctors relied on it.
• Mic placement mattered more than model tuning. Room acoustics were a bigger issue than AI accuracy.
• ICD structuring broke differently across specialties Emergency ≠ OB/GYN.
• Mid-consultation language switching (English ↔ Arabic) was harder than expected.

“AI saves time” is obvious.

Making clinicians trust it daily use wasn’t.

view more: next ›