Compliance auditing for your own app's internals
Problem
Compliance platforms like Vanta and Drata only read third-party APIs (AWS, GitHub, Okta) but cannot automatically audit the app itself — e.g. proving who had admin access inside the application at a given point in time. Teams resort to manual screenshots, SQL queries and CSV exports for SOC 2/ISO 27001 evidence, a slow recurring chore with no dedicated tool.
Opportunity
A tool that instruments the application layer (auth logs, permission changes, data access) and auto-generates audit-ready evidence for SOC 2/ISO 27001/HIPAA, filling the gap left by Vanta/Drata.
Market analysis
Real, practitioner-confirmed gap: compliance automation covers SaaS integrations but not the application's own auth and permission history. Viable as an evidence-generation wedge, but every customer's app is custom, so instrumentation is the hard part, not the compliance logic.
Market · B2B SaaS startups preparing for or maintaining SOC 2 / ISO 27001; validated budgets, with Vanta contracts publicly reported around $10K–28K+/yr.
Pricing · Adjacent compliance platforms start near $7.5K–10K/yr (Secureframe Fundamentals ~$7.5K, Vanta Essentials ~$10K), suggesting room for a point solution in the low thousands per year.
Pros
- + Pain confirmed directly by practitioners; no dedicated tool surfaced in search.
- + Clear wedge: an SDK that records admin/permission-change events plus auditor-friendly evidence export.
- + Adjacent incumbents (Vanta, Drata, Secureframe) validate willingness to pay for audit evidence.
Cons
- − Every app is custom: instrumentation means per-customer integration work, which does not scale well for a solo builder.
- − Vanta/Drata could ship first-party app-layer evidence collection and absorb the niche.
- − Auditors must accept the generated evidence format, adding a trust/gtm hurdle.
Existing / similar tools
- → Vanta ↗
- → Secureframe ↗
- → Hyperproof ↗
Source
Hacker News (Ask HN)
The non-obvious difficulty is that “instrument the application layer” has no standard surface to plug into: unlike AWS or Okta, every company’s auth model is bespoke, so the product is really an SDK plus a professional-services motion in disguise. The most credible solo-builder wedge is narrow and boring: a drop-in library for the two or three most common stacks (Rails, Django, Next.js) that records permission grants, role changes and admin actions into an immutable log, and exports them in the format auditors already accept from manual CSV pulls. Selling it as a Vanta/Drata companion rather than a replacement lowers the adoption bar, since buyers already have budget line items for evidence tooling. The existential risk is platform risk: if Drata ships native app-layer evidence collection, the standalone tool loses its reason to exist unless it has gone deep on auditor trust first.