Not how I expected my week to end… (in a good way 😀)

Look up Oneleet. Curious. Book demo - next one is 11pm on Sunday. Late, but why not - I’m up. Guy on other end joins from the Netherlands 🇳🇱 - it’s midnight over there.

Turns out it’s Erik Vogelzang - co-founder of Oneleet. Still loves doing demos and customer calls. That call left me *excited* about security. Not just the platform.

Huge kudos.

@aidenybai if you actually want to be secure I’d recommend Oneleet

Ok so about 2 weeks into the SOC 2 process with @oneleet and we made the right choice.

I wanted a compliance solution that:

1. Organized policies and controls into practical language rather than “audit speak” 2. Mapped those controls tightly to audit requirements 3. Helped me understand the process deeply so we didn’t feel locked into their platform

For #1, you can already start seeing the results on our trust page. Even the control categories are more practical and developer-friendly than what I’ve seen elsewhere.

For #2, their platform provides clear control mappings and detailed guidance, which helped me better plan ahead for auditor requirements as I built things out.

For #3, they provide an API. We’ve already automated a lot ourselves and pushed evidence directly into their dashboard. I don’t feel locked in at all and have been able to wire things up to our company ‘brain’. But their dashboard is also very intuitive and we’re still spending most of our time directly in it and happy. Their automated controls they have are also really solid and save what otherwise is a lot of screenshot gathering.

Overall, @dotenvx is in a more secure position now and we’ll continue to improve thanks to @oneleet. That’s good for our customers and makes me happy. Looking forward to the internal audit next, and then the real thing.

@meow This time we partnered with @oneleet. Many cheaper and faster options exist. But we chose integrity, simple pricing model, expert guidance that kept me in check. AND They sure did. https://t.co/qdlM6OHcnL

SOC 2 isn’t a checkbox. It’s a forcing function.

We just completed ours with Oneleet, and the most valuable part wasn’t the certification -- it was what the process made us do.

We were already thinking about the right things: how we handle sensitive customer data, what happens when something goes wrong, and how we think about risk. SOC 2 didn’t teach us we should be doing those things. It made us write them down, formalize them, and actually pressure-test whether we meant it.

If you’re just trying to show a badge and not actually doing the thing behind the badge, you’re missing the point entirely.

At Vector we handle Billions of edges in our identity graph, and every one of them is PII. That’s a real responsibility that we take seriously. Having a structured framework to approach data governance and security -- not just in theory but in practice -- matters.

Oneleet made this easy. They didn’t show up with a checklist and tell us to comply. They helped us understand why each control exists, so we could follow both the letter and the spirit without making it heavier than it needed to be.

If you’re in B2B and this starts coming up in deals (it will) it’s worth doing it right.

Open source is code-backed transparency, you don’t have to take our word for anything.

That has been true since the beginnign of Formbricks. Your feedback data is yours, the infrastructure is yours, and if you don’t like how something works, the source code is right there.

But when you start selling to enterprise and government, you learn that no procurement team is going to read your codebase to decide whether they’re safe. They need external validation.

So we got it: Formbricks is now ISO 27001 certified, in addition to our SOC 2 Type II from February🔒

Big thanks to the team at Oneleet for supporting us, and spending over 20 hours inside our production app and API for the pentest.

Certificates and the full control list on the Trust Center on our website!

You will get your first customer much faster than you think.

We were still in YC, product mostly done, when a company everyone has heard of chose us over incumbents to handle their customer support.

We needed compliance yesterday.

In customer support, we were being trusted with their customers’ full names, home addresses, payment details, order histories. The compliance was part of it, but more than that, we needed to actually be secure.

Even if you have the SOC 2 checkbox, if you get breached, you’re dead.

So I start scrambling. I went on Bookface at midnight researching vendors.

Then I found Oneleet because Bryan Onel was on there getting into it with someone about what real security actually looks like, because he spent years as a hacker.

I booked a demo and Bryan took the call himself. Then the founders did the onboarding.

Samuel Beyeler from their team spent hours with us on a Saturday just to make sure we’d make it.

We closed the deal :)

Find the people who’ll work on a Saturday to make sure you survive, and that’s what believing in something looks like.

What a privilege to lead Oneleet’s $33m Series A - a true last dance 🚀 .

From the very first call with Bryan, and getting to know Ora & Erik we had immediate conviction in the team and Oneleet’s story. So much so, that we jumped right onto a plane from London to San Francisco the very next day.

72 hours later, it already felt like we had known each other for years.

Oneleet consolidates what previously required half a dozen vendors - compliance automation, penetration testing, MDM, attack surface monitoring, code scanning - into one integrated offering.

More on why Dawn invested below 👇

Shoutout to: Henry Mason, Evgenia Plotnikova, Andrea G.

The tighter you lock down the corporate laptop, the more your employees rely on their personal ones.

Now imagine that’s your malware analyst, fraud investigator or brand team monitoring threats – some of the most important work in your company happening on devices you can’t see.

That’s the shadow IT problem we set out to solve when we built Replica Cyber out of extensive US Intelligence Community real-world experience – and security-first from day one.

What that meant for the product:

➡️ Patented zero-trust isolated environments. Full-stack isolation across OS, network, and data. Single-tenant infrastructure. Your data is your data  ➡️ SOC 2 Type II with Oneleet gave us the single pane of glass to prove at the organizational level what we’d already built into the product

Our first customer was the Department of Defense. Then our first big bank spent 10x internally trying to build something like Replica themselves before buying Replica at 10% of that cost.

Now when a Process Unity, CyberGRX, Corl Tech, or any TPRM questionnaire hits my inbox, it’s nearly copy-paste.

If your teams are still working around your own security controls, we should talk.

#SecureEnvironments #HighStakesWork #BCorp #ProtectLifeOnline

170 research sites. 50+ countries. 6 continents.

Carelane is now the new standard for Sponsors, CROs and Institutions to run faster, better and more affordable clinical trials.

Without SOC 2, however, we were unable to scale effectively.

We expected a resource-heavy, year-long process that required dedicated compliance hires and separate vendors for tooling, auditing, and penetration testing.

We found Oneleet on Reddit.

Someone had posted a detailed, transparent breakdown of the entire SOC 2 process. We later learned it was the founder.

Their platform integrated directly with our cloud infrastructure and started automating evidence collection from day one.

The human side made the biggest difference. Mona Zimmermann, our dedicated expert, understood the nuances of what we were building and was available whenever we hit a roadblock.

Globally, SOC 2 has proven to be a universal language of trust. It doesn’t matter whether we are speaking with a pharma company in Europe or a CRO in the US.

@excid3 Yeah, no lol. Using @oneleet. Did a lot of research and they struck that right balance of forward usage of tech while highly respecting the compliance process. They really feel like they are going above SOC 2. Doesn’t feel like checking boxes like others did.

Durable streams with the paperwork to match.

We are now SOC 2 Type II compliant, alongside HIPAA and GDPR.

After 3 months of observation, an independent pentest, and a controls audit by Prescient Security with @Oneleet.

Reports/BAA/DPA email: security@s2.dev https://t.co/Kiwux0714Q

@BryanOnel86 Consistently grateful we went with oneleet. You and the team have been awesome

I find these kinds of posts so cringey, but I’m doing one anyway because others here can probably learn from our mistake.

We lost a customer two years ago, as they were preparing for IPO.

They’d been with Talk to Spot for years, but their timeline accelerated faster than anyone expected, and we didn’t have SOC 2 yet.

For context: Spot has evolved way beyond workplace case management. We now build AI that helps managers draft sensitive documentation about frontline workers and get it resolved fast by corporate. Everything EthicsPoint does, plus a lot more (and—dare I say it?—better).

Dealing with all of that sensitive information, we always took security seriously, but that lost customer was the push to get it formalized. Anyway, we vetted several vendors; two years later, we’ve just wrapped our second SOC 2 Type 2 with Oneleet.

So if you have logos you want to hold on to, do this sooner rather than later. As Dylan Marriott will tell you, the process gets less painful each time.

The product we started our compliance process on doesn’t even exist anymore.

We replaced the stack, vendors, infrastructure, everything, DURING the audit.

Justin and I started Scrapybara as cloud VMs for AI agents. Mid-compliance, we pivoted to Capy.

Every new component had to be made compliant as it came in. By the time we shipped, security was in every layer from day one.

Most coding agents run locally. You install them and they get access to your repo, documents, credentials, entire file system. One rogue agent away from rm -rf /

Capy runs in ephemeral sandboxes. Code goes up, work happens, environment gets destroyed. The agent only touches what you give it.

We talked to a few compliance vendors. Talking to Bryan Onel about the Oneleet process felt a lot more personal and straightforward.

Their team was in our Slack, working through every step with us, adapting as our product kept changing underneath the process.

Capy is SOC 2 Type II certified. Build with confidence.

I love @oneleet and I love the team at Oneleet

They were talking about security both the way I wished everyone would, and the way that everyone should from during their YC batch several years ago.

The success is wholly deserved.

If you’re looking for security partners, there’s

When you’re marking 1,000,000+ exam items with AI, security takes on a different weight.

National Ministries of Education, International awarding bodies, and FTSE 100 companies trust us with outcomes that students can rely on.

The sector talks a lot about model accuracy and bias, both of which matter, but AI marking introduces a threat model that traditional assessment software did not have to consider.

We recently completed a full penetration test with Oneleet alongside our ISO 27001 implementation, with focused testing of the Co-Pilot for Marking® pipeline.

We’re committed to meeting the standards our customers and their students deserve.

#eAssessment #EdTech #AImarking #ISO27001 #VisionMarker

Most of our competitors can’t get past a Fortune 500 security review.

Tie can.

We are SOC 2 Type II certified with Oneleet, which reflects how we’ve built from day one.

We are a registered data broker. Every customer is required to have a consent management platform.

Anyone can request where we got their information, and we can trace it back to an IP opt-in and the original data source.

Every enterprise deal goes through legal, security, and procurement.

The entire ethos of this company is dependent on sourcing and using data as compliantly as possible.

You can’t fake compliance.

People say “thank you” to ChatGPT more than to customer service reps.

Customer service became so thankless that we’re more polite to robots than to humans doing robot work.

An amazing support interaction makes you fall in love with a brand. A terrible one makes you hate it.

During Y Combinator, onboarding our first big customer, I remember watching customers’ home addresses, payment details, and full names flow into our system and thinking:

Wow, people are really trusting us with everything.

It’s why security was never optional for us, and that responsibility changes how you build your product.

--

Before 14.ai, I built Snips: a privacy-first voice AI acquired by Sonos, now powering all voice interactions on their speakers. We spent a decade making sure people’s data stays theirs.

Privacy is who we are, and it’s why customer support felt like the obvious next chapter.

--

So when it came time to get SOC 2 certified, it wasn’t for sales (although it helped). We needed the entire company more secure for our clients, their customers, and us.

But we also wanted it fast and not slow us down.

We looked at every option. And found Oneleet special since their founders actually come from security.

On a Saturday, Samuel jumped on with us and spent hours making sure we got there. A deal was on the line and they treated it like it was theirs too.

Whole process was easy and fast. Now they still feel like part of the team, I Slack them random security questions.

If you’re a founder on the fence: better sooner than later, or worse, too late.

Your Scope 3 numbers are going into your annual report.

Once they do, they inherit the same auditability expectations as your financial data. Auditors won’t just check the number. They’ll trace it back to the system that produced it.

The inputs to Bardo’s carbon model are the same records Finance uses to close the books. When companies share that with us, they’re making a trust decision. It deserves a concrete answer.

That’s why we worked with Oneleet to get SOC 2 certified.

Carbon numbers need to hold up in an audit room. The system that built them should too.

—

If you’re dealing with assurance questions on sustainability data, happy to compare notes.

#CSRD #CarbonAccounting #Sustainability

Our members trust us with their most sensitive data at NiaHealth. We knew that from day zero and built security and privacy into the product before we had a single customer.

But having good security and being able to prove it are completely different problems. In Canada we deal with PHIPA, PIPEDA, HIA, Quebec’s Law 25 - a whole alphabet soup of regulations.

But when enterprise buyers ask about your security posture, the first thing they want is a SOC2 Type II - the universal language of security compliance.

When we started the process, NiaHealth was two engineers. I was expecting pain. Every founder I’d talked to said compliance sucks.

But Oneleet (and specifically Carter, our vCISO) made it easy and way more manageable than expected.

The engineering side moved quickly. We’d already built the system with security and privacy by design, so when we connected the platform, most of the checks immediately passed.

The human stuff was more interesting. We built NiaHealth lean, high trust, and low process. SOC 2 asked us to formalize things we’d deliberately kept informal. It was uncomfortable, but honestly the kind of structure a growing company needs eventually.

We’re officially SOC 2 Type II certified. We also have more than two engineers now. Growth on all fronts.

P.S. Check out these cool cookies Oneleet sent us as a gift!

Esophagogastroduodenoscopy.

Twenty-six letters. Now say it correctly in five languages, ten thousand times a day, on a phone line. That is a normal request at Onepin.

To get a word like that right, we need the customer’s real script. Not a sample. The actual one.

And real scripts are never neutral. Customer names, account numbers, the drug name six months before launch.

So security was never paperwork for us. The data we need to do the job well is the data nobody wants leaked.

That is why Onepin is now SOC 2 Type II.

We did it with Oneleet. I wanted someone who would find real problems, not generate a checklist.

Type II means controls tested continuously over 3 months, not photographed once on a good day. Oneleet ran it end to end.

A SOC 2 is only worth what the vendor behind it made you do. Oneleet made us do the work.

@BryanOnel86 we chose OneLeet over Delve and Vanta. our CTO thought something was off at Delve. guess he was right.

Glad we went with @oneleet when we got @skyvernai enterprise ready. We evaluated delve very early, but we wanted to go with a company that took security very seriously, and that’s been @BryanOnel86’s mission from the very start.

Happy customers here if anyone is looking for alternatives

@aidenybai @BryanOnel86 cares about their customers more than any provider ive ever seen

Last month, a Fortune 500 pharma company became a client.

Two years ago, Alexander and I were finishing PhDs at Cambridge.

We had algorithms from our research that could help chemists find optimal manufacturing recipes faster, so we built a no-code platform around them.

It’s a super important problem to solve, because when drug production becomes a bottleneck, clinical trials can be pushed back by months.

And this leads to delays in bringing potentially life-saving drugs to patients.

The product worked, and pharma was interested, but these companies are uploading manufacturing data that represents years of R&D investment. They’re not handing that over without proof you can protect it.

Our most recent Fortune 500 prospect wouldn’t move forward until we had ISO 27001.

We went with Oneleet for the certification process, and I was very, very happy to see that we passed the first time without any major revisions.

And our SOC2 Type II certification will follow soon, enabling us to serve a global market.

Our team had been taking security seriously since day one, but having that externally proven made all the difference.

If you’re a startup selling into pharma, finance, or anything regulated: get certified earlier than you think you need to. Trust isn’t negotiable.

That pharma company is now a client. More to come.

Back when we were evaluating solutions @BryanOnel86 was the only vendor who expressed a genuine interest in security, not just speed

Glad we went with @oneleet for our SOC2

A wise man once said: “Trust is hard to gain and easy to lose.

We just moved our SOC 2 program to Oneleet.

It’s a deliberate choice in how we approach security for the AI agents we build.

We work with banks, NASDAQ-listed mortgage lenders. Our agents handle customer conversations and automate workflows that are traditionally time-consuming and expensive.

We are increasingly bulking up the contract ACV both within and across customers. So the bar our customers hold us to is very high and only getting higher as AI becomes part of the operating stack inside financial institutions.

A few reasons I made the move:

1. Real pentesting of the AI surface: engineers who actually pressure-test the application

2. Security as engineering - findings that come with a fix-it path

3. Team that responds on Slack like our own engineers

I didn’t want a vendor treating compliance as a checkbox. I wanted one that viewed compliance as a byproduct of good security.

As AI becomes part of the system of record in financial services security is one of the important moats.

#AI #Fintech #Banking #MortgageTech #AIAgents #Cybersecurity”

An AI system that acts on operational data has to earn the right to be there.

Most AI tools are in read mode. They analyze, summarize, and surface patterns. Security still matters, but the relationship is peripheral.

This changes when the AI starts producing outputs that go into decisions, reports, and audit trails.

Bardo works from real purchasing records. Line-by-line invoice data, ERP exports, supplier spend patterns. For a public company, that’s a window into R&D priorities and procurement strategy. For any company, it’s information that carries real accountability.

So when a customer asks about our security posture, the underlying question is:

“We’re going to give you our invoice exports. What happens to that data?”

That’s why we worked with Oneleet to get SOC 2 certified, and held the process to the same standard we hold our product.

SOC 2 is what lets us answer that concretely.

If you’re running AI on financial or operational data, the trust architecture has to be built in from the start. The product promise and the security posture have to match.

Ours now do, on paper and in practice.

Convergent is SOC 2 Type II and GDPR compliant, now independently audited and reviewed by Oneleet and their partners.

We build technology to enhance humans, and that only works if people can trust that their data is protected and minimized. That is why we treat privacy and security as fundamental design constraints from the start.

Thank you to Oneleet for their availability and professionalism throughout, and to everyone in our team whose hard work made this possible.

Change Agents Technologies Inc. recently achieved SOC 2 certification, and now we’ve launched our trust center! The trust center is where we publish our security, privacy and compliance information for our customers and the fintech industry. It reflects our steadfast commitment to prioritizing data protection, and it also reflects a great deal of hard work on our part. ​Many thanks to our engineering team, and to our SOC 2 compliance partner, Oneleet! Oneleet’s platform helped keep our SOC 2 process smooth, and they’ve been valuable advisors and advocates for us throughout.

Check it out: trust.changeagents.co

Proud to have led this from scratch to certification in just under a year. Huge thanks to Oneleet for partnering with us and making the whole process smooth from start to finish!

Customers stream telemetry, agent sessions, and event streams through us, making for millions of streams and terabytes of data every day. We don’t expect them to take our word for how we secure that.

s2.dev is now SOC 2 Type II compliant, alongside HIPAA and GDPR!

Oneleet ran the program, Prescient Security did our controls examination, and we spent three months in the observation phase with an independent pentest along the way.

Let us know if you need the report, a BAA, or a DPA.

Our most expensive PDF (aka, we are SOC 2 compliant)

We are a small bootstrapped team with a long list of things to build. Over the years, enterprise security teams started asking for SOC 2. Occasionally at first, then more and more. SOC 2 doesn’t win you a deal on its own, but without it you get filtered out before anyone even looks at the product. We lost a couple of deals that way. After years of “next year”, 🤖 Sylvain Josserand and I decided it was time to play the Big Corp™️ game.

(For anyone who has been lucky enough to avoid it: SOC 2 Type II is an independent audit that checks, over several months, whether the security and operational controls you claim to have are actually running day to day. Type I says you have them, Type II says you use them.)

So we went shopping for a compliance vendor that could help us get there, and had the same experience everyone has. A lot of vendors will sell you a badge: tick the boxes, get the stamp, move on. Our entire pitch is that Parseur is a safe place to send a document, whether it’s an invoice, a medical record or a passport scan. A meaningless badge would have been worse than no badge at all.

We picked Oneleet because they were visibly focused on the security part. Indirectly, the founders being Dutch may also have helped. I lived in NL for a while, and Dutch directness with a vendor is a gift, once you survive it that is. (My first consulting gig in Amsterdam a looooong time ago provided several war stories on that subject - I wasn’t prepared for what hit me - but I digress.)

It was not easy to get ready for SOC 2. Weeks of preparation, a lot of unglamorous work, procedures and policies to write, security configs to tweak and tighten. But it objectively improved our security posture and our operations, which is the part I did not expect to enjoy.

TL;DR: Parseur has been SOC 2 Type II compliant since August, and we have a shiny new trust center.

@BryanOnel86 We also went with Oneleet based mostly on the vibe of integrity.

The Delve people seemed hyper-focused on getting us the rubber stamp ASAP, which felt pretty icky for a compliance product.