3 ms·

My experience at a few startups does not align but I support the overall thesis. More than one startup talked a big game in hiring about the product, the custo

My experience at a few startups does not align but I support the overall thesis. More than one startup talked a big game in hiring about the product, the customers and the culture only to be more of a cult of personality where decisions were made in private between cofounders despite being an "open" company, unequal pay despite "transparent" salaries with bands, a lack of managerial skills or care for personnel management (once told not to bring my feelings to work) and in almost every single instance a technical founder or early engineer that cannot or will not share work by delegating. The most important things I have learned have absolutely came from being involved with startups and 90% are what NOT to do. The good thing is I identified what I love: "Devops" and adding automation and structure to processes very early. Everyone thinks is has to get in the way or will slow them down. Slow is smooth and smooth is fast. Building people is was more fun than building tech but you have to be on top of your hiring game early on. And you have to be willing to share and trust. You have to ship. But that doesnt mean you dont invest in yourself. If you have money for 100 days then build for 100 days. If you have money for 2 years then build for 2 years. This means making that investment in your tools and your process. Lastly, if you are B2B, buy a SOC2-in-a-box and get it over with and use something like auth0 or workos and just be ready with SSO integrations. Dont put off the foundational tablestakes of doing business with other tech companies.

ghiculescu 4y ago
Last suggestion deserves a caveat. Unless more than 5% of your revenue will unconditionally require SOC2, you should avoid doing it and accept the small revenue hit. But you are correct, if you do need it, you should do it as early as you can and buy it out of the box as much as you can. I recommend Tugboat Logic for this.
- leetrout 4y ago
  That's true! For those that do not know, an audit is going to cost AT LEAST $20k but the total cost could be more than $50k (certainly more if you are paying market rate and you account for the team's time to pull everything together). And the requirements can cause side effect costs (penetration tests, etc).
  - lawrjone 4y ago
    As an incident management tool, getting certified was a thing we knew we needed early. Gotta hand it to Chris (one of our founders) who came from being Director of Platform at Monzo (a UK neobank) and had spent years battling auditors, and knew exactly how to play it. Kinda hammers home the point of my article... but about three months into our company life, we were SOC 2 certified, and it didn't feel like much effort at all. In case anyone is looking for actionable advice, we used Vanta to help us through the process. If you're funded, I think it's well worth the money.

ghiculescu 4y ago

Last suggestion deserves a caveat. Unless more than 5% of your revenue will unconditionally require SOC2, you should avoid doing it and accept the small revenue hit. But you are correct, if you do need it, you should do it as early as you can and buy it out of the box as much as you can. I recommend Tugboat Logic for this.

leetrout 4y ago
That's true! For those that do not know, an audit is going to cost AT LEAST $20k but the total cost could be more than $50k (certainly more if you are paying market rate and you account for the team's time to pull everything together). And the requirements can cause side effect costs (penetration tests, etc).
- lawrjone 4y ago
  As an incident management tool, getting certified was a thing we knew we needed early. Gotta hand it to Chris (one of our founders) who came from being Director of Platform at Monzo (a UK neobank) and had spent years battling auditors, and knew exactly how to play it. Kinda hammers home the point of my article... but about three months into our company life, we were SOC 2 certified, and it didn't feel like much effort at all. In case anyone is looking for actionable advice, we used Vanta to help us through the process. If you're funded, I think it's well worth the money.