Our approach
We do the work. You close the deal.
We assess where you stand, fix what’s missing, gather the evidence along the way, and leave you running on the Tudovu platform with everything you need to stay compliant.
This is for you if…
A customer or investor is asking for a compliance report and you have a deadline.
You don’t have a DevOps, security or compliance person on staff.
You bought a compliance tool, but someone still has to do the work.
Your cloud was built by hand and nobody is sure what’s in it.
Four steps, start to finish
It starts with a free 30-minute call to understand what your customer or investor needs. From there:
- 01
Gap assessment
We work with you to assess your infrastructure, policies and information security posture against the framework you need.
- 02
Remediation
We propose adjustments, then work alongside your team as a contractor to implement the fixes. You approve every change.
- 03
Evidence
We gather and submit compliance evidence throughout the assessment, so nothing piles up at the end.
- 04
Platform and handoff
We implement the Tudovu platform and hand it over to your team, along with your ongoing compliance requirements.
How long?
It depends on where you’re starting and what your goals are, but it’s likely a fraction of the time it would take on your own.
How much of your time?
Usually only a few hours, mostly reviews, approvals and short interviews to fill policy gaps.
What we cover
Infrastructure, security and compliance in one engagement, all on the platform you’ll keep using afterward.
Infrastructure
- Build new cloud environments the right way
- Bring hand-built resources under control
- Set up secure deployment pipelines
Security
- Find and fix security gaps
- Set up logging, monitoring and alerts
- Lock down access and review it
Compliance
- Write your full policy set
- Collect and submit audit evidence
- Coordinate with your auditor
- Answer customer security questionnaires
Frameworks:
SOC 2 FedRAMP PCI DSS HIPAA ISO 27001 AWS FSBPAfter the handoff
Where the platform fits
Once we hand off, Tudovu sits between your team and your cloud, doing the day-to-day work and waiting for your approval on every change.
Your team
Asks in plain language and approves the work
Tudovu
Builds, secures and documents, and waits for your sign-off on every change
Your cloud
Infrastructure, apps and data, kept secure and audit-ready
Who leads it
Led by someone who has done this before.
David Thompson, our CTO, has led about ten SOC 2 engagements and run compliance programs covering FedRAMP, PCI and HIPAA. He holds CISSP, CISM, OSCP and AWS Security Specialty certifications.
David Thompson
Founder and CTO
Former Director of Security at Sandbox Banking (YC W17). Also nCino and CoSo Cloud. Has run security, compliance and infrastructure through two successful exits.
Already pay for Vanta or Drata?
Keep it. We do the work your tool tracks, and we offer discounts with specific vendors so you aren’t paying twice.