4 ms·

> 1) legal/compliance/IT team gets involved and kills it for a handful of common reasons What are the common reasons and why can't they be dealt with? There ar

by vosper 2y ago

> 1) legal/compliance/IT team gets involved and kills it for a handful of common reasons What are the common reasons and why can't they be dealt with? There are platforms like WorkOS that (supposedly) make it easy to do compliance stuff.

CharlieDigital 2y ago
Depending on the industry, once legal and compliance get involved, you can face a number of obstacles. Regulatory compliance like HIPAA, SOC2 is a common one (most small startups I've seen can bullshit their way around this for a bit); many early stage startups won't have this in place since it requires a not-insignificant investment in time and money. Some industries like life sciences will request external/3rd party audits of your system and system validation documentation (documented formal testing, check out "GAMP5 V-Model" if you're curious). Life sciences also wants to see your validated QA system, your employee training records, your internal SOPs, etc. IT teams may want 3rd party security audits, attestations of data residency (EU companies especially), your policies around privacy and process level security (again, dependent on industry and teams). Some will stonewall you by demanding specific integrations (e.g. SAML-based SSO, SCIM, etc.) that are just too early in many cases. Sometimes the purchasing team will ask about your funding because they want to know how much runway you have and whether you'll be around 6 months from now.
- 8note 2y ago
  This sounds like a business opportunity, for selling to VCs to recommend to their startups
  - mlinhares 2y ago
    That is one of the reasons Y Combinator startups are so successful, they get recommended inside the circle of startups funded by them.
magicalhippo 2y ago
Besides WorkOS being stupid expensive as far as I can see, the compliance requests we get goes far beyond that. It includes our development practices, internal security, who has physical access to stuff and so on. And it's never the same, and they usually won't do any work themselves so we have to figure out how our situation maps to their 2000 custom questions.
- hkgjjgjfjfjfjf 2y ago
  Or you quit excusing your half assed practices, put on your big boy pants and do the work to get ISO270001 certification
  - magicalhippo 2y ago
    We're on our way but it's a lot to do, especially as a more mature company. If you're a startup, it might be beneficial to study ISO27001 early on, so you avoid relying on things which are difficult under ISO27001. Anyway, my point was that just relying on WorkOS won't help that much in answering the security questionaires.

by vosper 2y ago

CharlieDigital 2y ago

Depending on the industry, once legal and compliance get involved, you can face a number of obstacles. Regulatory compliance like HIPAA, SOC2 is a common one (most small startups I've seen can bullshit their way around this for a bit); many early stage startups won't have this in place since it requires a not-insignificant investment in time and money. Some industries like life sciences will request external/3rd party audits of your system and system validation documentation (documented formal testing, check out "GAMP5 V-Model" if you're curious). Life sciences also wants to see your validated QA system, your employee training records, your internal SOPs, etc. IT teams may want 3rd party security audits, attestations of data residency (EU companies especially), your policies around privacy and process level security (again, dependent on industry and teams). Some will stonewall you by demanding specific integrations (e.g. SAML-based SSO, SCIM, etc.) that are just too early in many cases. Sometimes the purchasing team will ask about your funding because they want to know how much runway you have and whether you'll be around 6 months from now.

8note 2y ago
This sounds like a business opportunity, for selling to VCs to recommend to their startups
- mlinhares 2y ago
  That is one of the reasons Y Combinator startups are so successful, they get recommended inside the circle of startups funded by them.

magicalhippo 2y ago

Besides WorkOS being stupid expensive as far as I can see, the compliance requests we get goes far beyond that. It includes our development practices, internal security, who has physical access to stuff and so on. And it's never the same, and they usually won't do any work themselves so we have to figure out how our situation maps to their 2000 custom questions.

hkgjjgjfjfjfjf 2y ago
Or you quit excusing your half assed practices, put on your big boy pants and do the work to get ISO270001 certification
- magicalhippo 2y ago
  We're on our way but it's a lot to do, especially as a more mature company. If you're a startup, it might be beneficial to study ISO27001 early on, so you avoid relying on things which are difficult under ISO27001. Anyway, my point was that just relying on WorkOS won't help that much in answering the security questionaires.