The work, in motion

How we work. stage by stage.

The Trust Framework names the destination. This page shows the route. Three stages, three rhythms, three outcomes, picked up wherever you are.

Map your stage → See the framework →

Onboard in week one · First evidence in week two · First audit on the calendar in week three

The first 30 days

What week one looks like, every time.

Stage doesn't matter for the first month. The opening four moves are the same: get a Trust Architect in your Slack, run a diagnostic, build the plan, ship the first deliverable.

Day 0–3

Channel up.

Shared Slack opens. Your Trust Architect, your senior reviewer, your delivery lead. Alfred is provisioned against your stack.

Day 4–10

Diagnostic.

We map you against the Trust Framework. Where you are, where you need to be, and what's blocking the next move.

Day 11–20

The plan.

Stage-specific roadmap shipped. Frameworks, deliverables, cadence, owners, dates. Reviewed with your team, not over their heads.

Day 21–30

First win.

Something concrete ships: policy stack, gap closure, questionnaire returned, vendor program kicked off. Trust as a habit, fast.

Stage 01FFoundation

Compliance leads. Security follows.

You're early. The first audit is on the calendar because a buyer or investor put it there. Policies are rough. Vanta isn't connected. The CTO is the security team. You need a program that fits in a startup-shaped life.

Cadence · Weekly Slack standup Reviews · Bi-weekly with senior Time horizon · 30–90 days to first audit

Deliverable 01Policy stack20 policies, customized to your stack. Drafted by AI, reviewed by senior, approved by you.

Deliverable 02Vanta operationalConnected, monitored, with named owners on every control. Not just installed, tuned.

Deliverable 03SOC 2 Type IAudit-ready in 30–60 days. Defended in-room when the auditor walks through.

OutcomeYou can answer "do you have SOC 2?" with a yes, and back it up with evidence buyers and investors recognize.

Stage 02OOperate

Shift left. Security in the SDLC.

Compliance is on rails. Customers are bigger. Questionnaires are constant. Now security shifts left, into how engineers ship, IT grants access, and sales sells. The Trust Architect stays; the scope widens.

Cadence · Embedded vCISO retainer Reviews · Quarterly business review Time horizon · Ongoing, multi-year

Deliverable 01Pentest cadenceAnnual pentest, plus targeted retests. Findings tracked to closure, not to a PDF.

Deliverable 02Vendor programContinuous third-party review. Sub-processor inventory. DPAs and SCCs in place.

Deliverable 03Trust Center liveCustomer-facing portal: SOC 2, ISO, sub-processors, status. Sales stops chasing for it.

OutcomeTrust stops being a cost center and starts being a sales accelerant. Questionnaires take hours, not weeks.

Stage 03SScale

Trust as a moat. Multi-framework. Multi-region.

You sell to enterprises in multiple regions. The auditor isn't the bottleneck, the breadth is. ISO 42001 for AI governance. AIUC-1 for AI underwriting. BACEN for banking. Multiple frameworks, one team, no re-onboarding.

Cadence · Continuous program management Reviews · Board-grade reporting Time horizon · Multi-year, multi-framework

Deliverable 01Multi-framework programSOC 2 + ISO 27001 + ISO 42001 + LGPD/GDPR mapped to a single control library.

Deliverable 02AI governanceISO 42001 / AIUC-1. Model inventory, evals, policy. Defensible to enterprise legal.

Deliverable 03Agentic riskContinuous risk register. Real-time control monitoring. Board-ready dashboards on demand.

OutcomeTrust becomes a competitive advantage. You win deals competitors can't qualify for, in regions they don't operate in.