Trust
Every Startup is compliant by construction, inheriting tested Controls, proving them from its own records, and signing only a short floor of its own.
Every Startup built with StartupBuilder is covered by a SOC 2 report from its first day. The platform runs every Control, tests it over every record, and leaves each Startup a short list of acts only it can perform.
Compliance by construction
Most companies earn a SOC 2 report the slow way. They write policies, configure tools to match, collect screenshots, and hope the auditor's sample finds nothing.
The work is slow because the controls and the system they govern live apart, so proving one about the other is a project. StartupBuilder closes the gap. Every write travels one path: a Change to a definition, or an Action recorded with its Events.
A Control is a rule on that path plus a test over its records. Nothing needs collecting, because the record the Control governs is the record its test reads.
What a Startup inherits
The platform, each Studio and each Startup form one tree. A Control set high in the tree applies to every namespace below it, and no namespace can loosen it.
A Startup created a second ago already sits inside every platform Control. It holds no Setting that could weaken one. Inheritance explains how each Control resolves, and how the platform proves that every Startup runs the same tested Versions.
What a Startup still does
Inheritance leaves each Startup its floor: the Controls it shares or owns, and four signed acts per report period. An officer approves the policies, accepts the risk assessment, records oversight, and signs the management assertion.
Agents prepare each act, and a person signs it. A Studio's officer desk signs for every Startup the Studio holds, in one batch.
A solo founder running a booking app for dog groomers signs those four acts once a year. The rest of their floor is a few choices only they can make, such as how long grooming records are kept.
Proof, not screenshots
Each test reads the whole population, not a sample, and seals its result as a Proof. The Event log is append-only and hash-chained, and its roots are published. Anyone holding a root can check that no record is missing.
Proof explains the chain. Frameworks shows how one Control answers SOC 2, ISO 27001, HIPAA and GDPR at once.
Who reads it
The same records serve every reader. The platform provides and proves every Control, and the opinion belongs to an outside firm, so a Startup is covered by a report, never certified.
| Reader | Reads |
|---|---|
| An auditor | Auditors: a scoped, read-only seat, the full population, and replay at any date |
| A Customer's security reviewer | Answering a security review: the report, live status, and answers drawn from records |
| A Customer | Customer guarantees, and what happens to their data |
| A founder | The regulated perimeter and acceptable use: what the platform builds and what it refuses |
Next
- Security practices, API key handling and data residency: what a security review asks first.
- Inheritance: how Controls resolve from the platform down.
- The floor: what each Startup still signs and sets.
- Subprocessors: every outside company that touches the data.