Carbide

We started selling into larger companies, and these larger enterprise customers said, 'Okay, it's great that you're HIPAA certified, but we also would like you to be SOC 2 compliant.' It was an intense and rigorous process, and it's not a one-time thing; it's an ongoing effort.

We were able to achieve SOC 2 compliance within about four months. I've heard horror stories of people taking a year or longer to achieve SOC 2 compliance.

I have to hand it to the platform and the team that helped us get through that process. They made it smooth and easy. They told us exactly what we needed to do. We were able to capitalize on the work we had already done with HIPAA, fill in any missing information on the platform, and keep the information up to date.

Without a dedicated security resource, we really rely on the platform and the tools that are provided within it to set up security policies, set up tasks, assign those tasks to people, and then understand where our efforts are at any stage. With Carbide, we have been able to validate existing controls and build new ones, while also really allowing us to do the monitoring and the reporting of our entire security program.

The team has been fantastic. Their knowledge in the area is very specialized — knowledge that we just didn't have internally. They know what they're doing, and they're able to help guide us through the process.

Without their help, there's no way that we would have been able to achieve HIPAA compliance or our SOC 2 certification.

I mentioned that we're bringing on large enterprise customers. Those enterprises are going to absolutely make or break this business. And because we have those customers, now we're able to raise capital.

Talkatoo is a SaaS company that produces dictation software to help doctors and veterinarians. Our customers have hectic schedules, and our software speeds up their time to do clinical documentation. By using our software, they end up having more time in the day.

As we moved into human health, we needed to be HIPAA-compliant, which is the privacy and health regulation in the United States. We deal with a lot of very sensitive, secure patient data — health records and information on people's lives that doctors and other healthcare professionals deal with. We need to treat that information with a level of privacy and security. And our customers need to know that we take those issues seriously and that we have strong security and privacy.

Our growth plans would be pretty much impossible to do without the security program we have in place.

We don't have a dedicated security resource, and I think that would be too expensive for a company of our size. That's why we needed help from experts and access to a platform that allows us to fill that gap and perform in the security area in the way that we need to.