selinkocalar

6 ms·

1. 61.▲
   by selinkocalar 1y ago

   This is exactly why I believe in building companies that actually create value, not just extract it. We could easily charge enterprise prices and hire armies of consultants to inflate our costs. Instead, we focus on making compliance genuin
2. 62.▲
   by selinkocalar 1y ago

   This hits on something we think about constantly at Delve. The key is building systems that are transparent about their confidence levels and gracefully handle edge cases. The companies that will win in AI aren't the ones with perfect
3. 63.▲
   by selinkocalar 1y ago

   This is such an important conversation. At Delve, we use AI extensively to automate compliance workflows, but we're always transparent about it with our customers. The real question isn't whether AI was used, but whether it adds g
4. 64.▲
   by selinkocalar 3y ago

   Ah, we're the other Delve - the one that doesn't come with an Office subscription but makes your office HIPAA compliant.
5. 65.▲
   by selinkocalar 3y ago

   Of course! Tugboat by OneTrust provides compliance checklist and preparation tools (i.e. InfoSec policies, audit management, controls mappings). We provide a similar compliance checklist/preparation tool to Tugboat, as well as HIPAA-co
6. 66.▲
   by selinkocalar 3y ago

   If we're being honest ITAR is quite far from HIPAA - can't promise that we'll get to it anytime soon :)
7. 67.▲
   by selinkocalar 3y ago

   Nice question. If you're using another platform to manage the infrastructure/hosting, you'd be able to integrate with us to complete the remaining parts necessary to get HIPAA compliant (i.e. the legal policies, compliance ta
8. 68.▲
   by selinkocalar 3y ago

   Thanks for that! And good question. Vanta offers a compliance checklist and integrates with your service providers (such as AWS, Github, etc.) to continuously monitor your system settings and flag potential vulnerabilities. We provide a sim
9. 69.▲
   by selinkocalar 3y ago

   Thanks for sharing that insight. It's a stepping stone and it's critical to move quick.
10. 70.▲
    by selinkocalar 3y ago

    That's true. Curious what your experience has been with HITRUST
11. 71.▲
    by selinkocalar 3y ago

    Good question. Vanta offers a compliance checklist and integrates with your service providers (such as AWS, Github, etc.) to continuously monitor your system settings and highlight potential issues. Similarly, we provide a compliance checkl
12. 72.▲
    by selinkocalar 3y ago

    Thank you - we really appreciate it! Drata and Secureframe provide a compliance checklist and integrate with some of your vendors (i.e. AWS, Github, etc.) to passively monitor your configurations and flag concerns. We provide the same compl
13. 73.▲
    by selinkocalar 3y ago

    Yup! Not every provider is classified as a Covered Entity and not every healthcare business is classified as a Business Associate. It's where the nuances of HIPAA law come into play. For example, you could be a medical app that process
14. 74.▲
    by selinkocalar 3y ago

    That's valid, and it varies on a case-by-case basis. You might want to track user behavior on your landing page but not on your provider-facing internal application. Flexibility, configurability, and proper risk assessment is key here.
15. 75.▲
    by selinkocalar 3y ago

    You bet. We get an interesting mix offering Heroku-like deployment with Vanta-style compliance preparation. We're not just an annual subscription-based GRC checklist that passively monitors, we're an active tool that enforces secu
16. 76.▲
    by selinkocalar 3y ago

    I've heard that that page is outdated and instead if you sign into G Suite as an admin, go to the admin console (admin.google.com/ac/companyprofile/legal) and then go to "Security and Privacy Additional Terms"
17. 77.▲
    by selinkocalar 3y ago

    Sorry to hear that your experience with Azure has been sub-par. I know there was a sizable wave of people that migrated over to Azure for the AI models but haven't heard too much from them since. Interesting to hear about your experien
18. 78.▲
    by selinkocalar 3y ago

    Completely agreed. Trust and credibility are harder to prove for startups trying to contract to large health organizations, which is why a HIPAA compliance report or active monitoring from a 3rd party can be really helpful. Some large hospi
19. 79.▲
    by selinkocalar 3y ago

    > Basic technical compliance is not the hard part! It's everything else. We totally agree. And to clarify, we don't just provide the technical compliance checklist (AWS Audit Manager already has all that), we provide the compre
20. 80.▲
    by selinkocalar 3y ago

    Thank you for these insights! We're in the midst of revamping our website so your feedback was very well timed. We will let you know when we release the updated version of our website. In the meantime, summarizing some of your points:
21. 81.▲
    by selinkocalar 3y ago

    We totally understand! We value complete transparency at Delve. If a startup doesn't need compliance (i.e. they fall under the Safe Harbor Provision or are a consuming-facing without connection to a Covered Entity), we'll tell the
22. 82.▲
    by selinkocalar 3y ago

    Glad you pointed these out! Regarding your first point, we've partnered with auditors at Insight Assurance. We've worked with them to map our compliance workflow, infra setup, and controls list with their auditing controls list. T
23. 83.▲
    by selinkocalar 3y ago

    We absolutely agree. HIPAA compliance for startups is only the beginning for us. We're rolling out SOC2 soon and then will use these as a foundation to moving upmarket. Our end goal isn't to work with startups to automate complian
24. 84.▲
    by selinkocalar 3y ago

    Thanks! No plans for NIST at the moment but potentially down the line.
25. 85.▲
    by selinkocalar 3y ago

    Good question, these trackers typically come in the form of developer installed pixels / trackers, making this situation a function of human choice. During onboarding, we conduct a supply chain vendor risk assessment, identify which ve
26. 86.▲
    by selinkocalar 3y ago

    At the end of the day, whether its AWS S3, GCP Buckets, Azure Blob Storage, or EKS, AKS, GKE — there are services to serve as drop in replacements for their competitors. The principles of deployment will remain the same as it pertains to ac
27. 87.▲
    by selinkocalar 3y ago

    Happy to chat further and learn more about what you were thinking, our Calendly is always open: https://calendly.com/getdelve/demo
28. 88.▲
    by selinkocalar 3y ago

    Sure thing! Under the hood, we define infrastructure using Terraform to explicitly define logical relationships between resources, easily enforce deny by default behavior, and spin up resources with granular access logging by default. We th
29. 89.▲
    by selinkocalar 3y ago

    It's an interesting point you raise. You're correct in that our current target audience primarily covers the companies that provide services to healthcare providers instead of actual healthcare providers. For more context, HIPAA b
30. 90.▲
    by selinkocalar 3y ago

    Yes, exactly. This is a similar battle IT folks face with implementing best practices with it comes to cyber hygiene, and the sooner it’s solidified, the better (shift left approach). That's been our current approach with helping early