FROM THE BENCH · GUIDE NO. 28 · 2026-05-05

Compliance 101 for software founders — what you actually need to know.

GDPR, SOC 2, HIPAA, PCI-DSS. These acronyms get thrown at founders constantly. Most of the anxiety around them is justified. Most of the advice is not. Here is what each one actually requires and when it applies to you.

The honest summary: you probably need less than you think.

The compliance industry is built to sell you fear. Most early-stage SaaS products do not need SOC 2. Most consumer apps do not need HIPAA unless they handle clinical health records. Most founders building in Europe need GDPR basics but not a full-time Data Protection Officer.

What you do need: to understand which regulations apply to your product, to build with them in mind from day one (retrofitting is expensive), and to know the minimum viable compliance posture for your first enterprise sale.

The four you will actually encounter.

GDPR
APPLIES IF

You process data of EU/UK residents, regardless of where your company is incorporated.

MINIMUM VIABLE

Privacy policy, cookie consent, data processing agreements with vendors, right-to-deletion mechanism, breach notification process.

REAL COST

$2k–$15k to implement properly. $0 if you use Stripe, Auth0, and AWS (they handle their slice). The rest is policy and process.

COMMON MISTAKE

Ignoring it because you are US-based. GDPR applies based on your users' location, not yours.

SOC 2
APPLIES IF

Enterprise customers with security teams will require it. Typically becomes a blocker at $50k+ ACV.

MINIMUM VIABLE

Type I (point-in-time audit) is faster and cheaper. Type II (6-month observation period) is what enterprise actually wants. Vanta or Drata can automate 80% of the evidence collection.

REAL COST

$15k–$50k all-in for Type II via a compliance automation platform. 3–6 months minimum.

COMMON MISTAKE

Starting SOC 2 before you have the enterprise pipeline to justify it. It is expensive process overhead for a product still finding PMF.

HIPAA
APPLIES IF

You store, process, or transmit Protected Health Information (PHI) — clinical records, diagnoses, treatment data. A wellness app that never touches clinical records is not covered.

MINIMUM VIABLE

Business Associate Agreements with all vendors, access controls, encryption at rest and in transit, audit logs, breach notification procedures.

REAL COST

Highly variable. AWS, Google Cloud, and Azure all have HIPAA-eligible services. Your architecture must use them correctly. Add $20k–$100k for proper implementation.

COMMON MISTAKE

Assuming you need HIPAA because your product is health-adjacent. If you never touch PHI, you likely do not.

PCI-DSS
APPLIES IF

You store, process, or transmit cardholder data. If you use Stripe or Braintree and never touch raw card data, you are largely covered by their compliance.

MINIMUM VIABLE

Use a compliant payment processor. Never log card numbers. Complete the Self-Assessment Questionnaire annually.

REAL COST

Near zero if Stripe handles everything. Significant if you process cards directly.

COMMON MISTAKE

Building your own payment form. Use Stripe Elements or Checkout. Let Stripe be the compliance layer.

The day-one compliance checklist.

□Use a reputable cloud provider (AWS, GCP, Azure) — they handle infrastructure compliance
□Enable encryption at rest and in transit from day one
□Never log passwords, payment card numbers, or SSNs
□Use Auth0, Clerk, or similar for authentication — do not roll your own
□Use Stripe for payments — do not touch raw card data
□Write a privacy policy before you launch (use a generator if needed)
□Add cookie consent if you have EU users
□Keep a list of every third-party vendor that touches user data
□Define who internally can access production data
□Set up automated backups and test restoring from them
← ALL GUIDES