Compliance (SOC 2 / ISO / GDPR / HIPAA)

The first time an enterprise asks "are you SOC 2?" you'll wish you'd started six months earlier. These tools collapse what used to be a $50k+ multi-month consulting engagement into a self-serve dashboard.

All-in-one compliance platforms

• ★ Vanta — incumbent; SOC 2 / ISO 27001 / HIPAA / GDPR / PCI / FedRAMP-light. Connects to your cloud / IDP / HR system; auto-collects evidence. Paid; the default.
• ★ Drata — direct competitor; cleaner UI; comparable pricing.
• ★ Secureframe — third in the trio; competitive.
• Sprinto — budget-friendlier; especially for smaller teams.
• Tugboat Logic (OneTrust) — enterprise.
• Hyperproof — for bigger compliance programs.
• Strike Graph — alternative.
• Thoropass (formerly Laika) — combines platform + auditor relationship.
• Oneleet — penetration-testing + compliance combo.

Frameworks worth knowing

• SOC 2 (Type I / Type II) — the default ask from US enterprise customers. Type I is point-in-time; Type II covers a 3–12 month observation window.
• ISO 27001 — international counterpart; preferred outside the US.
• HIPAA — US healthcare; PHI handling; required if you touch medical data.
• GDPR — EU; required if you have any EU users / customers.
• CCPA / CPRA — California; required at modest scale.
• PCI DSS — payment card handling; mostly avoided by using Stripe / processor's hosted fields.
• FedRAMP — selling to US federal government; long, expensive.
• HITRUST — healthcare; on top of HIPAA.
• DPF (EU-US Data Privacy Framework) — replacement for Privacy Shield.

Penetration testing (required for SOC 2 Type II)

• Cobalt — pentest-as-a-service; modern; works with Vanta / Drata.
• HackerOne — bug bounty + pentest.
• Bugcrowd — competitor.
• Synack — same niche.
• Local boutique firms — sometimes cheaper for first-time pentests.

Background checks (required for some frameworks)

• Checkr — modern API; integrates with Vanta / Drata.
• HireRight — incumbent.

Privacy / GDPR specifically

• OneTrust — enterprise privacy ops platform.
• Osano — privacy + cookie consent + DSAR (Cookie Consent).
• Mine PrivacyOps / Datafold / Transcend — DSAR automation.
• Iubenda — privacy policies + cookie consent + DPAs.
• Termly — same niche; small free tier.

Data Subject Access Requests (DSARs)

• Transcend — data discovery + DSAR automation; enterprise.
• DataGrail, Truyo, Securiti — competitors.
• Roll your own — a simple "export my data" + "delete my account" flow covers GDPR / CCPA basics.

Trust pages / public posture

• ★ SafeBase — vendor security review automation; trust portal; free tier.
• Conveyor — alternative; trust portal automation.
• Whistic — questionnaire automation.
• Vanta Trust Reports — bundled with Vanta.
• Drata Trust Center — bundled.

What to do, in what order

• Year 0–1, 0–10 employees:
  • Strong Auth + Authorization + Secrets Management.
  • Encrypted backups (Backup & DR).
  • Logging + Observability configured properly.
  • Privacy policy + Terms of Service + DPA template (Iubenda / Termly).
  • Cookie consent (Cookie Consent).
• Year 1, first enterprise asks: sign up for Vanta / Drata, run readiness assessment.
• Year 1.5: SOC 2 Type I.
• Year 2: SOC 2 Type II + (if needed) HIPAA / ISO 27001.

Adjacent operational concerns

• Background checks for new hires (Checkr).
• Endpoint management — Kandji, Jamf, Fleet (Mac); Intune (Windows).
• MDM-lite for small teams — Kolide, 1Password device trust.
• Identity provider (SSO across SaaS) — Okta, JumpCloud, Rippling.
• Vendor management — track third-party risk; Vanta / Drata include this.

Patterns to adopt

• Don't postpone Type II just because Type I "is enough." Many enterprise customers explicitly require Type II.
• Auditor matters — Vanta / Drata partner with a curated set; pick one with reasonable rates.
• Evidence drift — once you're certified, evidence collection is continuous. Don't let it lapse.
• Don't customize the frameworks until you have to — adopt the platform's defaults.
• DPAs everywhere — every SaaS you sign should be DPA-able for GDPR; track them centrally.

Pick this if…

• Default new platform, US-first: Vanta or Drata.
• Budget-conscious: Sprinto.
• HIPAA-heavy: Thoropass or Drata HIPAA.
• Privacy / DSAR automation: Transcend or Mine.
• Public trust portal: SafeBase.
• Pentest: Cobalt; pair with whichever compliance platform you chose.