Compliance has a reputation for being paperwork. In practice the questionnaire is a proxy for a real question: if something goes wrong inside your product, can the customer explain it to their own regulator.
This piece walks through how we think about it at Paycux, what we have changed our minds about, and where the sharp edges are.
Why compliance matters in B2B
Why compliance matters in B2B is where this gets concrete. Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Enterprise security reviews
Enterprise security reviews is where this gets concrete. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
- Keep audit events append-only and separate from user records
- Describe each control in one sentence before automating it
- Produce evidence automatically, not by hand
- Decide retention per data category, in writing
Risk & security teams want specific technical controls
That brings us to risk & security teams want specific technical controls. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
The compliance certifications B2B companies need
The compliance certifications B2B companies need is where this gets concrete. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
Separate the record from the data.
SOC 2 (System and Organization Controls 2)
SOC 2 (System and Organization Controls 2) deserves its own treatment. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
ISO 27001
ISO 27001 is where this gets concrete. Separate the record from the data. Audit events are append-only and describe what happened; user records are mutable and describe who someone is. Keeping the two apart makes retention a job over a timestamp and erasure an operation on a row, instead of a negotiation between them.
Evidence is the deliverable. Not the policy document — the artifact that shows the policy was applied on a specific date to a specific system, produced without anyone editing a spreadsheet.
GDPR (General Data Protection Regulation)
GDPR (General Data Protection Regulation) is where this gets concrete. Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Write down the control before you automate it. A control nobody can describe in a sentence will not survive its first review, no matter how well it is implemented.
Where this leaves us
None of this is exotic. It is the ordinary discipline of deciding what you own, writing down what you assume, and making the failures loud enough to notice.
If you are working through the same problem and want to compare notes, the docs cover the mechanics and the console shows the behaviour on your own data.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.