r/Compliance

We are very small India based SaaS company and our SOC2 is up for renewal. We got it done from one of the software's last time- they did not contact us even once for audit and are now ofcourse behind us over the renewal. The reason given (for no contact)- internal role changes (??!!)
The biggest reason we are getting it renewed is because one of our clients wants us to be SOC2 compliant- and potentially newer clients too.
Is it cheaper ot go through an agency- cost is another issue. We are really disappointed in the Software company and their lack of interest in following up after the payments were made and certificate was issued.

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

Small company, limited security resources. People still paste API keys, customer emails, and passwords straight into Slack channels. We have basic acceptable-use language, but it is clearly not enough.

I do not want to start reading DMs or turn this into heavy surveillance. At the same time, this is a real data-handling and access-control problem, especially if we ever need to show that sensitive information is not sitting unprotected in chat.

For those in compliance or risk roles: how are you addressing secrets and PII in collaboration tools without creating a process nobody follows? What controls or workflows have actually reduced this in practice?

Hi everyone, I'm a legal practitioner in Cameroon. I have some compliance experience, especially data privacy compliance. Now I know how hard it is for Africans to be trusted with legal tasks.

However, I can work with startups, draft website terms and privacy policies that comply with relevant regulations (although AI seems to be challenging me at that now).

My question is, are there any fully remote compliance roles that my portfolio could win? Or is compliance just highly jurisdictional.

PS: I've been a writer for a while and part of my portfolio is articles across self development, freelance, personal development and law-related topics.