definitely. i’ve been doing startups selling to enterprise customers for a while. audits and soc 2 compliance generally do lead to improvements or caught some things we’ve overlooked, but it certainly is not comprehensive. you’re checking boxes in some horrific xlsx file so some folks at Acme Corp can check boxes in another horrific system of theirs.

earlier on i tried to fight the good fight on some points and explain why it was unimportant or nonsensical in our context. that’s a brutal way to live though. i try to go with the flow and have more of an open mind these days. it’s easier for all parties involved. i just want them to write us a check.