All customer stories
How Rex treated SOC 2 as infrastructure from day one
Rex is the AI operations partner for enterprise order-to-cash. Rex agents run finance workflows across customers’ existing systems, with dedicated finance experts in the loop. Working with sensitive financial data made security a foundation to establish from the outset.
“It’s easier to do it early on and stick to it than it is to implement it later.”
Lewis Blackwood
Rex (S26) | AI for order to cash
REX
AI operating system for order-to-cash operations. Rex deploys AI agents to automate end-to-end finance workflows—including collections, customer portal submissions, and payment reconciliation—integrating directly with existing ERPs, CRMs, and communication channels.
FRAMEWORKS
SOC 2 Type II
ALREADY HELD
ISO 27001
INDUSTRY
Financial Operations / Accounts Receivable (Order-to-Cash)
COMPANY SIZE
Early Stage
BACKING
Y Combinator
FAVOURITE PART
Pentest
01
What Rex does
Rex is an AI operations partner for enterprise order-to-cash. Its agents handle collections, the shared accounts receivable inbox, invoice submissions and rejections in customer portals, disputes and cash application, with dedicated finance experts managing delivery.
Working across existing systems such as Oracle NetSuite and Salesforce, Rex helps finance teams collect cash faster and scale their operations with a leaner team, under their own processes, controls and SLAs.
Merlin Kafka and Lewis Blackwood started Rex in early 2026. Prior, Merlin & Lewis build finance automation software for fast-scaling start-ups.
Four months later, Rex won the Vercel AI Accelerator out of 2,500 teams. By summer, it was in Y Combinator’s S26 batch and running order-to-cash operations for Synthesia.
“We wanted to focus on larger enterprises, and focus on delivering an actual outcome for these finance teams, rather than another piece of software teams have to manage ” Lewis says.
02
SOC 2 for AI startups selling to enterprise: start before anyone asks
Rex knew from the start that selling software into enterprise finance teams would mean answering serious questions about security.
So they decided to handle SOC 2 before a customer forced the issue.
“We came into building thinking this is one of those things to do right away,” Lewis says.
He had been part of SOC 2 projects at previous companies and came away with a simple lesson about doing it early.
“It’s easier to do it early on and stick to it than it is to implement it later.”
Lewis Blackwood · Co-founder and CTO, Rex
03
SOC 2 as infrastructure as code: one engineer, no button toggling
Rex was still a two-person company, and Lewis ran SOC 2 essentially on his own alongside being CTO.
His approach was to make compliance fit the way Rex already built software.
Rex runs on AWS, with its infrastructure defined in code.
“I took the approach on the tech side to try and automate it all as much as possible,” Lewis says. “Everything is infrastructure as code. I didn’t want to be toggling buttons in AWS.”
When a control failed, he could pull it into his existing workflow, investigate the issue and work out the fix without living inside another dashboard.
04
Why Rex switched SOC 2 platforms mid-process
Rex originally started its SOC 2 process on Vanta.
The compliance platform and audit process were separate, which meant finding, evaluating and coordinating with an auditor became another project for a two-person team to manage.
Lewis wanted the audit to feel like part of the same process.
After speaking with Erik, one of Oneleet’s co-founders, Rex moved to Oneleet and selected Constellation as its independent auditor.
05
Switching compliance platforms without starting over
Most of the technical work Rex had already completed carried over.
“Maybe two thirds of it just transferred straight over, because you’ve already done all the stuff in AWS, so it’s going to pick up the same,” Lewis says.
Policies and risks needed to be recreated, which took roughly two days.
From there, Oneleet coordinated the audit process.
“I never really spoke to the auditor in the process,” Lewis says. “All the comms went through Oneleet.”
For a two-person company, that meant less time coordinating compliance and more time building Rex.
06
The result: SOC 2 Type II
Rex holds a SOC 2 Type II report audited by Constellation.
Its security program sits alongside product controls including enterprise SSO, tenant isolation and a logged trace for every action its agents take.
When an enterprise finance team reviews Rex, the team can share its report alongside details of how its agents are secured and governed.
For Lewis, that was the point of starting early: build the foundation before a customer forces you to.
07
What’s Next
Rex continues to expand the work its agents handle across order-to-cash, helping enterprise finance teams bring AI into more of their operations. The goal: collect cash faster, deliver a better customer experience and scale with a leaner team.
Rex secures its compliance with Oneleet