Hacker News Reader

Comment by debarshri | Hacker News Reader

Every org that starts out with an compliance oriented SaaS in my experience ends up migrating out of it eventually because when they grow - they have more capital to build their own infrastructure as hire more engineers who do not want to deal with kinks of a SaaS abstraction.

If you are using Vanta or Drata at early staging and opt for HIPAA framework, you do get the list of controls that you have to implement that also include cloud specific configuration changes that you need to do. And these changes are one time thing, continuously monitored by the framework.

My argument is that, the target market you trying sell - early stage HIPAA compliance market is not difficult anymore.

I hope this feedback helps you to foresee possible problems.

View on HN

Thanks for the transparency and thoughts on this!

We provide a lot of active elements, such as our infrastructure logging/monitoring dashboard, email alerts, and code vulnerability scans every time you git push, so that we aren't just a one-time purchase. We help you be proactive about preventing breaches instead of just integrating with your AWS API and passively monitoring. One of the biggest things about HIPAA is that it isn't just your initial setup that matters, it's how you manage compliance on an ongoing basis that's important for maintaining security and privacy.

We're also growing with our customers and moving upstream, and keeping in mind exactly what you said about preventing SaaS churn. As we do this, we're following the core thesis that compliance should bridge legal, DevOps, and cybersecurity, and when you combine all these you can get much deeper insights into security and can integrate deeper within an organization to provide more proactive measures.

Solutions like this wont work in large orgs that have lead to huge ACVs.

Would be more happy if you prove me wrong.

No you're right for sure. Aptible is mentioned a few commends down, and is/was basically the same business (compliance focused hosting for small startups). Now Aptible has seemingly pivoted away from that focus and are now trying to compete in the PaaS space. There are a couple of obvious reasons here.

1. You're limiting your TAM to just healthcare startups. Why? 2. After not that long, it doesn't make financial sense for your customers to stick with you. I speak from experience on this one having moved some number of customers off of Aptible in the past. Aptible was charging 10X AWS for a pretty thin wrapper around AWS. At any kind of scale beyond a handful of machines it makes sense to just bite the bullet and hire a devsecops person, who in the end will do more for you.

My advice here is to think bigger. Think about what value the GRC/Security/DevOps teams of bigger orgs are delivering and how you could displace (some) of them.

We absolutely agree. HIPAA compliance for startups is only the beginning for us. We're rolling out SOC2 soon and then will use these as a foundation to moving upmarket.

Our end goal isn't to work with startups to automate compliance - we're using this as a launchpad to going upstream in the GRC space.

I have an opinion about that too. It is super competitive and very democratised. Last I checked there platforms that would charge just $2500 per year for their GRC platform. That's pretty low in my opinion.

As a founder, I'll ask you why not start with the actually value proposition or goal you want to achieve right away. Why are you making your jouney very convoluted?

You bet. We get an interesting mix offering Heroku-like deployment with Vanta-style compliance preparation. We're not just an annual subscription-based GRC checklist that passively monitors, we're an active tool that enforces security on a technical front and runs checks every time an engineer git pushes. We also don't charge usage-based fees, so no one is charged an additional 10x of their AWS usage cost, which any large organization would with good reason want to churn.

It's been an effective entry point into the market for us -- establishing a foundation with companies that need to become compliant for the first time and building out core compliance features is a great stepping stone. Lets you work with additional customers while building out your larger product visions.

I'd say your offering seems to fill a void for nonprofit agencies like mine, and possibly public entities (like counties) who don't have the internal staffing/expertise to spin up and monitor HIPAA-compliant infrastructure, and are responsible for integrating health data from disparate sources.

Reply on news.ycombinator.com