Yet another Hacker News

17 points sochix 1 hour ago 23 comments

Is it possible? Do you know success cases w/o spending 20+k $ on auditors? My customers bombards me with question about certification of my app Perfect Wiki, I need help with finding the best way to show them that my app could be trusted.

jaspanglia 1 hour ago | parent

Most early-stage founders don’t start with full SOC2 immediately. You can begin with strong security practices, transparent documentation, privacy policy, backups, access controls, and third-party audits before going for certification.

sochix 1 hour ago | parent

What kind of documents should I show customers to make them trust me that I follow best security practices? They trust Soc2 Type2, what else could work?

zrobotics 46 minutes ago | parent

If they don't have a strict requirement on SOC2, then either PCI compliance or NSA CISA are more easily done without needing tons of money.

Edit: PCI would only apply if you are processing customer funds Iirc, it's been a few years since I went through one but thereay be some caveats for that to apply.

donatj 1 hour ago | parent

I doubt it's possible. I'd avoid it as long as you can. It's been a continuous stream of audits for my the company I work for and resulted basically total loss of developer agency.

sochix 1 hour ago | parent

Have the same feeeling....

Kainat01 1 hour ago | parent

Definitely possible. Start with SOC2-aligned practices and a solid public security page — many early customers care more about transparency and good security hygiene than the certificate itself.

sochix 59 minutes ago | parent

Thank you! Could you please share some great example of public security page so I can get some inspiration?

yread 26 minutes ago | parent

I was also interested in that and chatgpt came up with these:

https://iozen.ai/security/

https://logpulse.io/security/ SOC2 "in progress" haha

https://get.brightidea.com/security/

sochix 16 minutes ago | parent

Thank you!

zrobotics 52 minutes ago | parent

Do they? Every time I've been asked about SOC compliance, it turned out the underlying reason was either insurance or a requirement the customer had from their downstream customer. Neither of those cases would be negotiable, the customer's insurance company only cares about a checkbox that "All vendors are SOC2 compliant and relevant documentation is on file".

That said, actually being SOC compliant isn't that hard aside from the paperwork aspect. Any competent firm should already be doing all the things required, it's the bare minimum for security. There really shouldn't be any code or process changes needed, if there are you are woefully inadequate from a security standpoint. SOC2 is below the bare minimum for actual security, but it's the standard firms have settled on.

That said, actually getting a valid SOC2 audit completed is expensive and for a solo dev you can expect at least a month of lost time. I wouldn't pay out-of-pocket for an audit, but if you're in a space where customers are asking it can be a selling point. One strategy would be to negotiate reduced terms with a potential client to use their auditing firm and have them split costs on the audit. This would need to be a very hot sales lead, since it's a big ask, but it might be worth exploring. They likely already have an established relationship with an auditor, and having a referral will cut the price down.

SOC is just a box ticking exercise and doesn't improve security at all. Or at least it shouldn't, if you don't already meet their requirements you need to either shut down your side hustle or completely revamp your processes. That said, the box-ticking is extremely tedious and involves reams of paperwork. It would be doable as a solo entrepreneur, I worked through the process in a company of 6 employees, but it's not fun or productive.

swiftcoder 33 minutes ago | parent

> many early customers care more about transparency and good security hygiene than the certificate

I work on audit compliance for a SOC2 compliant system, and as part of our own audit requirements it is non-negotiable that all of our vendors must themselves be SOC2 compliant.

I very much doubt anyone who has a SOC2 requirement is not in the same boat with respect to dependencies

FpUser 1 hour ago | parent

My monolith C++ backend passed SOC2 Type 2 without any real efforts from me as a programmer since I was very security cautious when writing code. Nevertheless this whole business is a racket and unless you commit to spending small fortune you will be just fighting windmills no matter whether you are actually compliant. In my case I've developed it for a client so it was their headache. I've just written couple of documents outlining compliance features. but before we got certified we would give clients same documents and that would give us free ride for a while.

zrobotics 39 minutes ago | parent

It's 100% a racket. Your code could have been 10x worse and still passed, I doubt the auditors even looked at the code. It's a legal box-checking exercise, there really isn't much of an actual review besides the documentation. But my god is there a lot of documentation and paperwork.

pugdogdev 1 hour ago | parent

As others suggested, as a solo entrepreneur, I recommend not entering this process without a real justification. I passed this SOC 2 type for my startup after securing a deal with a big client. SOC 2 is an ongoing process that involves many documents and workflows you will need to implement in your company. If your clients really insist on proof of security compliance, I will try to find a local PT authority to complete a one-time process with them to obtain this kind of report.

sochix 1 hour ago | parent

Thank you!

rozumbrada 57 minutes ago | parent

Not possible in case your clients are not stupid. Any company with SOC2 and <5 people is a red flag.

You might find auditors that would go along but any reasonable client will check your SOC2 report and quality of your auditors.

SOC2 requires tons of paperwork and management and separation of duties with also mandatory roles in your company - never feasible in a one man show.

sochix 39 minutes ago | parent

So that means that solo-entrepreneurs can't sell apps to big enterprises due to SOC2 limitation? I think that it is not fair

badgersnake 23 minutes ago | parent

It isn’t fair, but few rackets are.

jaccola 21 minutes ago | parent

It’s a disadvantage for sure but not usually a blocker.

They often have security questionnaires you can complete instead. Or, as part of signing with them, you can promise to get SOC2 by x date (which will hopefully be easier with the funds from an enterprise contract).

I’d recommend looking online at some example security questionnaires or the types of things soc2 covers and writing an internal security doc for yourself so you know your position on everything and don’t have to scramble when it comes to it.

sochix 16 minutes ago | parent

Thank you for your comment!

Keyframe 56 minutes ago | parent

I went through the process and while it seems it's daunting, it's just a bunch of work and some cash. Once established it's also transformative (or should be) on your ongoing processes and practices. You codify those into a bunch of documents (jesus, that's a lot of documents type of thing) and provide evidence for each; Auditors latch onto those randomly. It's then your job to upkeep documents and evidence which can be helped with tools that have frameworks for those. We use drata and it's really simple and helpful to use.

I don't think you would be able to be compliant as a solo dude though, not easily. A bunch of protocols and practices revolve around governance, handovers, failovers, risk mitigation etc and if you're the only guy there's a hard path ahead. Are you reviewing and approving your own code that goes to production? If things go down and you're the first to call (let's say by automated alerting) and you're not available, who is the next one to call as in what's the documented succession plan or automated remediation.. etc.

Compensatory controls do not strictly require a human, they require mitigation of risk associated with a single human. You'd have to automate a lot of these governances "gates" then. So it would be possible, since evidence you would have to provide is work not org-chart, but it'd be a ton of work.

I went into it thinking I need to answer these 167 documents and provide evidence on an ongoing basis, but it actually also transformed the way we do things. I think for the better. At the end of the day, I also think this can be gamed as probably most certificates, but it's not worth it and transformation you go through makes sense.

sochix 37 minutes ago | parent

Thank you for your feedback!

VishnuTech 32 minutes ago | parent

A lot of early stage founders ran into this. Strong internal processes can already build a lot of trust before full SOC2 Type 2.