AI lets a tiny team build what used to take a big one. I'm building Avori, a platform where teams share the AI agents, skills and workflows they build, and it moves faster than anything I've built before.
Speed gets you to the conversation with a bigger customer. Trust is what gets them to sign. So I'm putting security in from day one instead of bolting it on later. Here's my checklist, what SOC 2 actually is, and how I'm using Vanta to stay on top of it.
SOC 2 In Plain English
SOC 2 is a security framework from the AICPA. It isn't a certificate. It's a report from an independent CPA firm that checks your security controls against a set of criteria. Security is required in every report, and you can add Availability, Confidentiality, Processing Integrity or Privacy depending on what your customers care about.
Type I checks that your controls are designed well at a single point in time.
Type II checks that they actually work over an observation period, usually 3 to 12 months. This is the one most bigger customers ask for.
That observation window is why I'm starting now. The controls have to be running for months before a Type II report can cover them, so the earlier they're in place, the sooner Avori is ready for the customers who need it.
How I'm Using Vanta
Vanta is an agentic trust platform. It replaces the spreadsheets and screenshots of compliance work with automation that keeps running after the audit. More than 16,000 companies use it, and it covers 35+ frameworks, including SOC 2, ISO 27001, HIPAA and GDPR.
Connect your tools. Vanta plugs into the cloud, code, identity and HR tools you already use, with 400+ integrations.
Let it watch your controls. Over 1,400 automated tests monitor your controls year-round and flag what needs fixing, so you're not finding gaps the week before an audit.
Get your policies in place. Start from templates, then track that everyone on the team has read and accepted them.
Let the Vanta Agent help. It works from your full program context to draft policies, answer security questionnaires and call out issues.
Work with an auditor. When you're ready, your auditor reviews evidence inside Vanta instead of chasing you for files.
Show it off. A Trust Center gives prospects your security documents and live controls in one place, so security reviews move faster.
This is the list I'm working through. Copy it or download it, then check things off as you go. Most of the first section takes an afternoon.
AI Startup Security Checklist
# AI Startup Security Checklist
From Mariah Brunner, built while building Avori (getavori.com)
## 1. This week: the foundation
- [ ] Turn on multi-factor login for every work account, starting with email, cloud, code and finance
- [ ] Get the whole team on a password manager and share credentials through it, never in chat
- [ ] Use single sign-on (SSO) wherever your tools support it
- [ ] Make a list of every tool and vendor the company uses, who owns it and what data it touches
- [ ] Encrypt every work laptop and turn on automatic updates and screen lock
- [ ] Turn on backups for your production database and test a restore once
## 2. Access: the right people, nothing more
- [ ] Give everyone the least access they need to do their job
- [ ] Keep admin access to a short list of named people
- [ ] Write a same-day offboarding checklist and use it every time
- [ ] Review who has access to what once a quarter
## 3. Customer data
- [ ] Write down where customer data lives, how it's encrypted and how long you keep it
- [ ] Separate production from development and testing, and keep real customer data out of test environments
- [ ] Decide how a customer can get their data exported or deleted
- [ ] Keep an up-to-date list of subprocessors (outside services that handle customer data)
## 4. AI tools and agents
- [ ] Use business or enterprise plans for AI tools that touch company or customer data, and confirm your data isn't used for model training
- [ ] Never paste API keys, passwords or customer personal data into AI chats
- [ ] Give every AI agent its own scoped credentials, read-only by default
- [ ] Require a human approval before an agent sends, deletes, pays or changes permissions
- [ ] Treat anything an agent reads (web pages, emails, documents) as untrusted input that can't override your instructions
- [ ] Log what your agents do so you can see every action they took
- [ ] Add your AI providers to your vendor and subprocessor lists
## 5. Code and infrastructure
- [ ] Require code review before anything merges to your main branch
- [ ] Review AI-written code the same way you review a new teammate's
- [ ] Keep secrets in a secrets manager, out of code and out of the repo, and rotate them on a schedule
- [ ] Turn on dependency and vulnerability scanning in your code repository
- [ ] Turn on logging and alerts for your production systems
- [ ] Use infrastructure settings you can see and review, not one-off manual changes
## 6. People and policies
- [ ] Have everyone read and accept your core policies (security, acceptable use, access, incident response)
- [ ] Run short security awareness training when someone joins and once a year
- [ ] Write a one-page incident response plan: who's in charge, who to contact, how you tell customers
## 7. Prove it
- [ ] Choose your first framework (for most B2B startups selling to bigger companies, that's SOC 2)
- [ ] Set up Vanta and connect your tools so controls are monitored continuously
- [ ] Fix what the automated tests flag
- [ ] Pick an auditor and decide between a Type I report first or going straight to Type II
- [ ] Publish a Trust Center so prospects can review your security without a long email thread
- [ ] Keep a library of answers to common security questionnaire questions
Security Habits For The AI Era
Building with AI adds a few habits the old playbook didn't cover. These are the ones I'm building into Avori from the start.
Know where your data goes. Every AI tool you paste into is a vendor. Check its data settings, use the business plan for anything sensitive, and add it to your vendor list.
Give agents the smallest key that works. An agent that only needs to read your calendar shouldn't be able to send email. Scope each one and expand access only when you need to.
Keep a human on the big actions. Sending, deleting, paying and changing permissions should wait for a person to approve.
Write your instructions where agents can't overwrite them. Agents read web pages, emails and documents. Set them up so that content is treated as information, not as new instructions.
Review AI-written code before it ships. It moves fast and it's often right. Check it for hardcoded keys, risky packages and missing permission checks before it merges.
Keep a record of what agents did. Logs make it easy to answer "what happened?" for a customer or an auditor.