The standard path
is a trap.
Build fast, add compliance later. It sounds like a reasonable trade-off until you understand what “later” actually costs. Architecture decisions made in month 1 determine your compliance bill in month 18. PHI data flows, access controls, and encryption boundaries cannot be retrofitted onto a live production system without rebuilding it. That rebuild costs 2–4× the original build and takes longer than the original build did.
The Audit Letter Problem
The OCR investigation or SOC 2 auditor letter arrives 14 months after launch — after the architecture is set, after the data is live, after the cost of change has compounded. Architecture decisions made in month 1 determine your compliance bill in month 18.
The Series A Kill Shot
1 in 3 Series A deals is delayed or killed by compliance gaps discovered in due diligence. The data room opens, the buyer's technical team runs a security questionnaire, and the gaps that were always there become the reason the valuation drops 30%.
The FDA / FCA Wall
FDA 510(k) and FCA authorisation both require software documentation written to a standard that was not designed after the fact. Pre-submission meetings get cancelled when the technical file doesn't exist. These are not gaps you can close in a weekend.
Three tracks.
One principle.
Every track is fixed price, fixed scope, and ends with a production system — not a report. Choose the track that matches your stage.
Compliance Foundation
HIPAA baseline, SOC 2 Type I readiness, and GDPR data model built into your architecture before a single audit letter lands. We design the data flows, access controls, and encryption boundaries from the first sprint.
- —HIPAA Security Rule technical safeguards mapped to code
- —PHI data flow diagrams + BAA templates
- —GDPR-compliant data model and retention policies
- —SOC 2 Type I readiness assessment and gap closure
- —Incident response plan and runbooks
Scale Track
Full SOC 2 Type II, FCA or FDA pre-submission readiness, and enterprise security posture. Built for founders who are about to enter due diligence and need the gaps closed before the data room opens.
- —SOC 2 Type II — 6-month observation period support
- —FCA authorisation technical file preparation
- —FDA 510(k) pre-submission software documentation
- —Enterprise security posture and penetration testing
- —Vendor risk management and third-party BAA programme
Regulated Product Build
For founders who want to build the product and the compliance simultaneously. EHR integrations, clinical decision support, fintech APIs — built compliance-native from the first commit, not retrofitted after the audit letter.
- —EHR integrations (Epic, Cerner, HL7 FHIR) — HIPAA-native
- —Clinical decision support — FDA SaMD pathway from day one
- —Fintech APIs — FCA or SEC-compliant by architecture
- —ALICE compliance gate in your CI/CD from week one
- —Full IP transfer on delivery — no vendor lock-in
Compliance gaps
that kill
Series A deals.
The data room opens. The buyer's technical team runs the security questionnaire. The gaps that were always there become the reason the valuation drops — or the deal dies. These are the eight most common killers.
- ✕No SOC 2 reportEvery enterprise buyer asks. Most kill the deal within 48 hours of finding out.
- ✕PHI stored without audit logsHIPAA §164.312(b) is not optional. One breach and the OCR investigation ends the company.
- ✕No encryption at rest/transit documentationNot the encryption itself — the documentation. Due diligence teams need proof, not promises.
- ✕No incident response planRequired by HIPAA, SOC 2, ISO 27001, and every enterprise security questionnaire.
- ✕Vendor contracts with no BAAsIf your Stripe or AWS contract doesn't include a BAA, you are already out of compliance.
- ✕GDPR data maps missingArticle 30 records of processing activities. Every EU deal will ask for them.
- ✕No penetration test evidenceSOC 2 Type II requires it. Enterprise security teams require it. FCA expects it.
- ✕Access controls not documentedRole-based access control that exists but isn't documented is the same as no access control in an audit.
We build the
systems. Not
the report.
The standard startup compliance path: hire a consultancy for an $80,000 assessment that delivers a 200-page report — and leaves.
That report sits in a Google Drive. The gaps it identifies are still open six months later because nobody built the systems to close them. The consultancy is long gone — onto the next engagement.
We are not a compliance consultancy. We are an engineering firm that builds compliance-native systems. Our deliverable is working code, production infrastructure, and audit documentation that was generated by the engineers who built the thing — not written by a junior analyst who never touched the codebase.
ALICE — our QA and compliance engine — validates every commit against your regulatory framework before it merges. HIPAA, SOC 2, FedRAMP, UK GDPR, UAE PDPL. Not a post-hoc review. An enforcement gate in the pipeline, active from week one of your engagement.
Build it right
the first time.
Fixed price.
Fixed scope.
The first call is with a senior engineer who has read your problem. Not a sales rep. In 30 minutes, we can tell you whether we are the right fit and what a fixed-price engagement looks like for your stage.
Fixed-price proposal within 5 business days.
Tell us what you're building.
We'll scope the right compliance track for your stage, your regulatory exposure, and your timeline — before we talk budget.