SOC 2 Compliance: Everything Startup Founders Need to Know ✅

sock 2 compliance just might be the most sock 2 compliance just might be the most boring topic on the planet or I think boring topic on the planet or I think boring topic on the planet or I think it's probably at least tied for first it's probably at least tied for first it's probably at least tied for first but if you're going to go after but if you're going to go after but if you're going to go after Enterprise sales it's absolutely Enterprise sales it's absolutely Enterprise sales it's absolutely something you want to learn about and in something you want to learn about and in something you want to learn about and in this video I'm going to be talking about this video I'm going to be talking about this video I'm going to be talking about everything startup Founders need to know everything startup Founders need to know everything startup Founders need to know about sock2 compliance I'm Rob Walling about sock2 compliance I'm Rob Walling about sock2 compliance I'm Rob Walling I've started six companies five of them I've started six companies five of them I've started six companies five of them bootstrapped written four books on bootstrapped written four books on bootstrapped written four books on entrepreneurship and invested in more entrepreneurship and invested in more entrepreneurship and invested in more than 125 startups you might be wondering than 125 startups you might be wondering than 125 startups you might be wondering what is sock 2 compliance and it's what is sock 2 compliance and it's what is sock 2 compliance and it's something that you need if you want to something that you need if you want to something that you need if you want to move Upstream to higher and higher move Upstream to higher and higher move Upstream to higher and higher ticket Enterprise deals these deals can ticket Enterprise deals these deals can ticket Enterprise deals these deals can change your business right it's going to change your business right it's going to change your business right it's going to take your growth from growing twenty take your growth from growing twenty take your growth from growing twenty fifty dollars per account to 500 or 5 fifty dollars per account to 500 or 5 fifty dollars per account to 500 or 5 000 per account the thing is as you go 000 per account the thing is as you go 000 per account the thing is as you go after these larger customers they have after these larger customers they have after these larger customers they have stricter and stricter security policies stricter and stricter security policies stricter and stricter security policies that you need to adhere to and so today that you need to adhere to and so today that you need to adhere to and so today I'm going to dive in to Sock 2 I'm going to dive in to Sock 2 I'm going to dive in to Sock 2 compliance and in order to keep things compliance and in order to keep things compliance and in order to keep things interesting and on point I've invited a interesting and on point I've invited a interesting and on point I've invited a startup founder friend to join me his startup founder friend to join me his startup founder friend to join me his name is Ruben Gomez of signwell you've name is Ruben Gomez of signwell you've name is Ruben Gomez of signwell you've probably heard me mention sign about probably heard me mention sign about probably heard me mention sign about many times on this channel but he many times on this channel but he many times on this channel but he received sock 2 compliance last year and received sock 2 compliance last year and received sock 2 compliance last year and so while I have Theory and research and so while I have Theory and research and so while I have Theory and research and experience through my portfolio experience through my portfolio experience through my portfolio companies he has actually gone through companies he has actually gone through companies he has actually gone through the process himself so he's going to be the process himself so he's going to be the process himself so he's going to be an invaluable resource for us today an invaluable resource for us today an invaluable resource for us today there's quite a few steps to get sock to there's quite a few steps to get sock to there's quite a few steps to get sock to compliance there's two different types compliance there's two different types compliance there's two different types of sock 2 compliance you have to hire a of sock 2 compliance you have to hire a of sock 2 compliance you have to hire a CPA to do an audit there's a lot to it CPA to do an audit there's a lot to it CPA to do an audit there's a lot to it and that's why we want to give you an and that's why we want to give you an and that's why we want to give you an overview of the steps in this video but overview of the steps in this video but overview of the steps in this video but to get started I asked Reuben why he to get started I asked Reuben why he to get started I asked Reuben why he considered getting sock 2 compliant in considered getting sock 2 compliant in considered getting sock 2 compliant in the first place we being uh e-signature the first place we being uh e-signature the first place we being uh e-signature solution we deal with a lot of really

solution we deal with a lot of really solution we deal with a lot of really you know private and sensitive data for you know private and sensitive data for you know private and sensitive data for organizations then early on it was organizations then early on it was organizations then early on it was self-serve but we wanted to reach larger self-serve but we wanted to reach larger self-serve but we wanted to reach larger organizations where being sock to organizations where being sock to organizations where being sock to compliant is important if you want to compliant is important if you want to compliant is important if you want to close those larger mid-market and close those larger mid-market and close those larger mid-market and Enterprise deals do you think you could Enterprise deals do you think you could Enterprise deals do you think you could get those Enterprise deals without sock get those Enterprise deals without sock get those Enterprise deals without sock 2 like can you implement your own 2 like can you implement your own 2 like can you implement your own internal policies yeah you you can internal policies yeah you you can internal policies yeah you you can definitely get some of those there might definitely get some of those there might definitely get some of those there might be some deals that would be really hard be some deals that would be really hard be some deals that would be really hard hard to get or impossible to get without hard to get or impossible to get without hard to get or impossible to get without it but in some cases you can I've talked it but in some cases you can I've talked it but in some cases you can I've talked to some Founders that have not had it to some Founders that have not had it to some Founders that have not had it and have been working through getting and have been working through getting and have been working through getting some deals and usually what you have to some deals and usually what you have to some deals and usually what you have to do is just get a custom contract uh with do is just get a custom contract uh with do is just get a custom contract uh with an attorney drop that up get them to be an attorney drop that up get them to be an attorney drop that up get them to be okay with it so there's extra work even okay with it so there's extra work even okay with it so there's extra work even if you can get some deals without it if you can get some deals without it if you can get some deals without it with it for us it just makes certain with it for us it just makes certain with it for us it just makes certain deals really easy you know they'll come deals really easy you know they'll come deals really easy you know they'll come to you with like these questionnaires to you with like these questionnaires to you with like these questionnaires and all these all these requirements on and all these all these requirements on and all these all these requirements on the security side sometimes we could the security side sometimes we could the security side sometimes we could just give them our stock to report and just give them our stock to report and just give them our stock to report and it just cuts down on a ton on the work it just cuts down on a ton on the work it just cuts down on a ton on the work next I asked Reuben about the difference next I asked Reuben about the difference next I asked Reuben about the difference between sock 2 type 1 and type 2. so between sock 2 type 1 and type 2. so between sock 2 type 1 and type 2. so type 1 is basically just a lot less in type 1 is basically just a lot less in type 1 is basically just a lot less in depth a lot less controls and depth a lot less controls and depth a lot less controls and requirements and compared to type 2 type requirements and compared to type 2 type requirements and compared to type 2 type 2 is will take a lot longer to get it'll 2 is will take a lot longer to get it'll 2 is will take a lot longer to get it'll be a lot more expensive and there are a be a lot more expensive and there are a be a lot more expensive and there are a lot more controls involved in type two lot more controls involved in type two lot more controls involved in type two so it's just more in depth and larger so it's just more in depth and larger so it's just more in depth and larger organizations sometimes will will want organizations sometimes will will want organizations sometimes will will want type 2 which one did you choose and why type 2 which one did you choose and why type 2 which one did you choose and why we went with type 2 because we knew that

we went with type 2 because we knew that we went with type 2 because we knew that we were going to go mid-market in we were going to go mid-market in we were going to go mid-market in Enterprise so we wanted to jump to that Enterprise so we wanted to jump to that Enterprise so we wanted to jump to that I do know some people that do type 1 I do know some people that do type 1 I do know some people that do type 1 after talking with some Auditors and after talking with some Auditors and after talking with some Auditors and some people that done it it just seemed some people that done it it just seemed some people that done it it just seemed like it was easier and better for us to like it was easier and better for us to like it was easier and better for us to go straight to type 2 and not you know go straight to type 2 and not you know go straight to type 2 and not you know spend all that time on it obviously cost spend all that time on it obviously cost spend all that time on it obviously cost is a big concern for any startup founder is a big concern for any startup founder is a big concern for any startup founder and so I asked Reuben how much he spent and so I asked Reuben how much he spent and so I asked Reuben how much he spent getting soft 2 compliant how much did it getting soft 2 compliant how much did it getting soft 2 compliant how much did it wind up costing you I would say around wind up costing you I would say around wind up costing you I would say around 40 000 total I wouldn't say that 40 000 40 000 total I wouldn't say that 40 000 40 000 total I wouldn't say that 40 000 is what it it'll cost everybody that's is what it it'll cost everybody that's is what it it'll cost everybody that's just including stuff that was maybe just including stuff that was maybe just including stuff that was maybe unique to us on the technical side right unique to us on the technical side right unique to us on the technical side right so I'm bundling all that in so it was so I'm bundling all that in so it was so I'm bundling all that in so it was somewhere around 12 000 for the somewhere around 12 000 for the somewhere around 12 000 for the compliance software that we use that compliance software that we use that compliance software that we use that helped cut down on a lot of time called helped cut down on a lot of time called helped cut down on a lot of time called vanta let's say 15 000 for Auditors they vanta let's say 15 000 for Auditors they vanta let's say 15 000 for Auditors they try to hack into to your system tell you try to hack into to your system tell you try to hack into to your system tell you all the vulnerabilities for penetration all the vulnerabilities for penetration all the vulnerabilities for penetration testing included and then you know our testing included and then you know our testing included and then you know our time of course and probably the rest was time of course and probably the rest was time of course and probably the rest was development technical like internal development technical like internal development technical like internal costs paying your team members and such costs paying your team members and such costs paying your team members and such uh we actually outsourced a ton of that uh we actually outsourced a ton of that uh we actually outsourced a ton of that work so somebody who was helping us we work so somebody who was helping us we work so somebody who was helping us we had a super simple setup on just AWS ec2 had a super simple setup on just AWS ec2 had a super simple setup on just AWS ec2 like one you know everything bundled like one you know everything bundled like one you know everything bundled into one server it's not part of the into one server it's not part of the into one server it's not part of the requirements but there's some very high requirements but there's some very high requirements but there's some very high level things they don't dictate like level things they don't dictate like level things they don't dictate like technically you need to do these things technically you need to do these things technically you need to do these things what they say is like you need to have

what they say is like you need to have what they say is like you need to have some sort of redundancy you know worry some sort of redundancy you know worry some sort of redundancy you know worry about availability and all that stuff so about availability and all that stuff so about availability and all that stuff so we went about it a certain way not just we went about it a certain way not just we went about it a certain way not just for sock 2 but also for you know for for sock 2 but also for you know for for sock 2 but also for you know for running our business and scaling yeah I running our business and scaling yeah I running our business and scaling yeah I had heard some estimates General like 20 had heard some estimates General like 20 had heard some estimates General like 20 to 30 000 all in and so it makes sense to 30 000 all in and so it makes sense to 30 000 all in and so it makes sense that if you may have had more that if you may have had more that if you may have had more engineering work to do yeah I could see engineering work to do yeah I could see engineering work to do yeah I could see that pushing it to 40 pretty easily in that pushing it to 40 pretty easily in that pushing it to 40 pretty easily in addition to money time is a huge Factor addition to money time is a huge Factor addition to money time is a huge Factor the amount of effort so I wanted to ask the amount of effort so I wanted to ask the amount of effort so I wanted to ask Reuben how long it took sign well to Reuben how long it took sign well to Reuben how long it took sign well to become sock 2 compliant that also I become sock 2 compliant that also I become sock 2 compliant that also I think varies a bit depending on what you think varies a bit depending on what you think varies a bit depending on what you have to do for us we have to do more have to do for us we have to do more have to do for us we have to do more technical stuff so I would say the technical stuff so I would say the technical stuff so I would say the non-technical stuff probably about two non-technical stuff probably about two non-technical stuff probably about two weeks two and a half weeks or so and weeks two and a half weeks or so and weeks two and a half weeks or so and that that's pretty fast I think using that that's pretty fast I think using that that's pretty fast I think using um it helps to use something like the um it helps to use something like the um it helps to use something like the software that we use that custom there software that we use that custom there software that we use that custom there are a lot of different solutions out are a lot of different solutions out are a lot of different solutions out there nowadays and then on the technical there nowadays and then on the technical there nowadays and then on the technical side we probably had about two-ish side we probably had about two-ish side we probably had about two-ish months of work on top of that so I don't months of work on top of that so I don't months of work on top of that so I don't know all together maybe around three know all together maybe around three know all together maybe around three months we were all set and the way that months we were all set and the way that months we were all set and the way that it works is that you get to a point of it works is that you get to a point of it works is that you get to a point of where you can start a monitoring period where you can start a monitoring period where you can start a monitoring period Then start monitoring you in the first Then start monitoring you in the first Then start monitoring you in the first year instead of going an entire year to year instead of going an entire year to year instead of going an entire year to where they monitor you you can choose to where they monitor you you can choose to where they monitor you you can choose to do just like a short monitoring period do just like a short monitoring period do just like a short monitoring period like a three month monitoring period and like a three month monitoring period and like a three month monitoring period and then get your stock to report so it's then get your stock to report so it's then get your stock to report so it's not like you'll be ready in a month or not like you'll be ready in a month or not like you'll be ready in a month or two months and then you know they they two months and then you know they they two months and then you know they they audit you or anything like that you

audit you or anything like that you audit you or anything like that you actually have to be ready start your actually have to be ready start your actually have to be ready start your monitoring period and then monitoring period and then monitoring period and then um you know they'll take like a month um you know they'll take like a month um you know they'll take like a month and a half to to review everything and and a half to to review everything and and a half to to review everything and give you your report give you your report give you your report and that's type two right I've heard and that's type two right I've heard and that's type two right I've heard estimates like type one you could get in estimates like type one you could get in estimates like type one you could get in a month or two and then type two was a month or two and then type two was a month or two and then type two was more like three to twelve months or more like three to twelve months or more like three to twelve months or something that was kind of a range I got something that was kind of a range I got something that was kind of a range I got that off the internet so take it for that off the internet so take it for that off the internet so take it for what it's worth yeah no that sounds that what it's worth yeah no that sounds that what it's worth yeah no that sounds that sounds about right type one would be sounds about right type one would be sounds about right type one would be much faster and then you know that's much faster and then you know that's much faster and then you know that's partly due to what's uh required the partly due to what's uh required the partly due to what's uh required the differences between part type one type differences between part type one type differences between part type one type two there are also five categories in in two there are also five categories in in two there are also five categories in in type two so uh depending most people type two so uh depending most people type two so uh depending most people just do one category or a lot of people just do one category or a lot of people just do one category or a lot of people do one category which is security we we do one category which is security we we do one category which is security we we did a security availability and did a security availability and did a security availability and confidentiality so all three so a little confidentiality so all three so a little confidentiality so all three so a little bit more work there even on the policy bit more work there even on the policy bit more work there even on the policy side training for everybody we also side training for everybody we also side training for everybody we also bundled in HIPAA HIPAA compliance at the bundled in HIPAA HIPAA compliance at the bundled in HIPAA HIPAA compliance at the same time because there was so much same time because there was so much same time because there was so much overlap with those three categories it overlap with those three categories it overlap with those three categories it added a little bit of time but not that added a little bit of time but not that added a little bit of time but not that much time and of course a question on much time and of course a question on much time and of course a question on all of our minds I wanted to find out all of our minds I wanted to find out all of our minds I wanted to find out from Reuben if all of it was worth it from Reuben if all of it was worth it from Reuben if all of it was worth it now that you're through it and you've now that you're through it and you've now that you're through it and you've spent the money you spent the time time spent the money you spent the time time spent the money you spent the time time would you say it was worth it yeah for would you say it was worth it yeah for would you say it was worth it yeah for us it has been like I said it's us it has been like I said it's us it has been like I said it's definitely helped us close uh some definitely helped us close uh some definitely helped us close uh some bigger deals it's also just made it easy bigger deals it's also just made it easy bigger deals it's also just made it easy for you know for for other deals that we for you know for for other deals that we for you know for for other deals that we probably would have gotten but we would probably would have gotten but we would probably would have gotten but we would have spent a lot more time doing it as have spent a lot more time doing it as have spent a lot more time doing it as we wrapped up the conversation I was we wrapped up the conversation I was we wrapped up the conversation I was curious if Reuben thought that he would

curious if Reuben thought that he would curious if Reuben thought that he would have been able to become compliant have been able to become compliant have been able to become compliant without a service like vanta so I know without a service like vanta so I know without a service like vanta so I know that you need to pay a CPA and that you need to pay a CPA and that you need to pay a CPA and accountant to do the audit right there's accountant to do the audit right there's accountant to do the audit right there's no way around that and you need to no way around that and you need to no way around that and you need to create the documentation or pay someone create the documentation or pay someone create the documentation or pay someone to do it you need to have all the to do it you need to have all the to do it you need to have all the technical work done or pay someone to do technical work done or pay someone to do technical work done or pay someone to do it aside from that and I know you used it aside from that and I know you used it aside from that and I know you used vanta the software this kind of like vanta the software this kind of like vanta the software this kind of like checklist software that monitors and checklist software that monitors and checklist software that monitors and does all the stuff that you've said does all the stuff that you've said does all the stuff that you've said could you have accomplished it without a could you have accomplished it without a could you have accomplished it without a vanta you know product like Fanta or is vanta you know product like Fanta or is vanta you know product like Fanta or is it kind of a a necessity or maybe a it kind of a a necessity or maybe a it kind of a a necessity or maybe a no-brainer at this point to use a no-brainer at this point to use a no-brainer at this point to use a service like that even though you said service like that even though you said service like that even though you said it was ten or twelve thousand dollars it was ten or twelve thousand dollars it was ten or twelve thousand dollars yeah so you definitely could have done yeah so you definitely could have done yeah so you definitely could have done it people were doing it before these you it people were doing it before these you it people were doing it before these you know these uh systems existed it's know these uh systems existed it's know these uh systems existed it's similar to like when gdpr came out we similar to like when gdpr came out we similar to like when gdpr came out we hired somebody that was an expert in hired somebody that was an expert in hired somebody that was an expert in that and it was just some very manual that and it was just some very manual that and it was just some very manual thing they had a bunch of spreadsheets thing they had a bunch of spreadsheets thing they had a bunch of spreadsheets they wanted access to systems so I would they wanted access to systems so I would they wanted access to systems so I would imagine it would be the same sort of imagine it would be the same sort of imagine it would be the same sort of thing it would just take longer to do it thing it would just take longer to do it thing it would just take longer to do it I feel like it's kind of a no-brainer if I feel like it's kind of a no-brainer if I feel like it's kind of a no-brainer if you have the money to do it that way I'd you have the money to do it that way I'd you have the money to do it that way I'd have a difficult time going without a have a difficult time going without a have a difficult time going without a system like that not just because the system like that not just because the system like that not just because the the software they put into all your the software they put into all your the software they put into all your systems they do all the monitoring they systems they do all the monitoring they systems they do all the monitoring they spit out reports make it faster and spit out reports make it faster and spit out reports make it faster and easier on that side of things but they easier on that side of things but they easier on that side of things but they also handle onboarding for employees also handle onboarding for employees also handle onboarding for employees off-boarding they give you templates for off-boarding they give you templates for off-boarding they give you templates for policies they for us they recommended policies they for us they recommended policies they for us they recommended Auditors and Auditors that knew the Auditors and Auditors that knew the Auditors and Auditors that knew the system they recommended people for system they recommended people for system they recommended people for penetration testing all that stuff and penetration testing all that stuff and penetration testing all that stuff and you can actually ask them questions when you can actually ask them questions when you can actually ask them questions when you're when you're in the middle of it you're when you're in the middle of it you're when you're in the middle of it like oh I don't have an otter yet but

like oh I don't have an otter yet but like oh I don't have an otter yet but this is what we're doing how do you this is what we're doing how do you this is what we're doing how do you think we should handle it they'll you think we should handle it they'll you think we should handle it they'll you know they'll not try to say well you know they'll not try to say well you know they'll not try to say well you need to talk to an accountant or you need to talk to an accountant or you need to talk to an accountant or you know somebody else they'll they'll just know somebody else they'll they'll just know somebody else they'll they'll just answer your questions they're actually answer your questions they're actually answer your questions they're actually helpful yeah and for folks watching you helpful yeah and for folks watching you helpful yeah and for folks watching you know vanta is the one used but there are know vanta is the one used but there are know vanta is the one used but there are a lot of them they're secure frame drata a lot of them they're secure frame drata a lot of them they're secure frame drata or drata I'm not sure how to pronounce or drata I'm not sure how to pronounce or drata I'm not sure how to pronounce that sprinto audit board and many others that sprinto audit board and many others that sprinto audit board and many others awesome awesome awesome thanks Reuben thanks for joining me yeah thanks Reuben thanks for joining me yeah thanks Reuben thanks for joining me yeah of course thanks talk to compliance is of course thanks talk to compliance is of course thanks talk to compliance is obviously a very big topic and it would obviously a very big topic and it would obviously a very big topic and it would be very difficult to cover all the be very difficult to cover all the be very difficult to cover all the nuances in a YouTube video like this nuances in a YouTube video like this nuances in a YouTube video like this that's why at microcomp we've created an that's why at microcomp we've created an that's why at microcomp we've created an article all about sock 2 as well as a article all about sock 2 as well as a article all about sock 2 as well as a checklist that you can reference if you checklist that you can reference if you checklist that you can reference if you head to microconf.com and click latest head to microconf.com and click latest head to microconf.com and click latest in the top navigation you will find that in the top navigation you will find that in the top navigation you will find that article if sock 2 is something you're article if sock 2 is something you're article if sock 2 is something you're thinking about you're probably looking thinking about you're probably looking thinking about you're probably looking to sell to Enterprise customers which to sell to Enterprise customers which to sell to Enterprise customers which can be hard especially when you're can be hard especially when you're can be hard especially when you're bootstrapped or mostly bootstrapped bootstrapped or mostly bootstrapped bootstrapped or mostly bootstrapped Enterprise customers will have a lot of Enterprise customers will have a lot of Enterprise customers will have a lot of questions that you want to be ready for questions that you want to be ready for questions that you want to be ready for and in order to do that and be prepared and in order to do that and be prepared and in order to do that and be prepared check out this next video to make sure check out this next video to make sure check out this next video to make sure you are ready thanks so much for joining you are ready thanks so much for joining you are ready thanks so much for joining me today I'll see you in the next video