Blog

What we learn, written down

Research from talking to founders who have been through it, and engineering notes about keeping a language model honest with someone's compliance evidence.

ResearchJuly 8, 2026

Where the three months go

We asked eleven startups to account for the time their first SOC 2 took. Almost none of it was spent fixing security.

Dana Whitfield

Co-founder and CEO

7 minute read

EngineeringJune 19, 2026

Why a checkbox cannot read your policy

The hard part of compliance preparation is a language problem, and it is worth being precise about why.

Marcus Oyelaran / 8 minute read

PracticalMay 30, 2026

Six controls to fix first when a deal is waiting

If an enterprise security review is the only thing between you and a signature, fix these in this order.

Priya Raghunathan / 6 minute read