How do you bootstrap a company with strict compliance and security requirements?