Pieces’ SOC 2 Journey: Critical Compliance for AI Developer Tools

Since we founded Pieces for Developers, we’ve been focused on privacy and security. Our 100% offline AI capabilities are cutting-edge, and solo developers from all fields have gotten huge productivity boosts from our products.

In 2022, we began laying the groundwork to expand Pieces for Developers to support entire engineering teams at enterprises of all sizes. To continue supporting our users, we decided to earn our SOC 2 Type II compliance certification so that every developer can confidently add Pieces to their workflow.

First: What is Pieces for Developers?

We’re an AI-enabled productivity tool designed to increase developer efficiency and effectiveness through personalized workflow assistance across the entire toolchain. Our centralized storage agent works on your device and integrates various developer tools to proactively capture and enrich useful materials, streamline collaboration, and solve complex problems through a contextual understanding of your unique workflow.

Ideal for solo developers, teams, and cross-company projects, Pieces minimizes context switching, speeds up onboarding, and significantly elevates the overall development experience while maintaining the privacy and security of your work.

It’s pretty cool.

Why SOC 2 is Important for Pieces

Earning SOC 2 compliance marks a significant milestone in our company development. This certification underscores our dedication to upholding stringent data security standards, a core aspect that resonates with our product’s promise and our users’ expectations.

Our users, who range from individuals to expansive cross-company teams, can now be even more confident in our platform. The rigorous process of earning SOC 2 compliance has fine-tuned our internal processes and fortified our defenses against data breaches and cyber threats. It positions Pieces as a secure place to work with your most important development projects.

SOC 2 Type II compliance allows our users at larger organizations, in regulated sectors, or on projects that contain sensitive or proprietary code to further trust our systems. SOC 2 compliance aligns with our mission to deliver a tool that enables developers to leverage LLMs, copilots, and other productivity tools while maintaining a highly secure developer workflow.

What is SOC 2 and Why Did We Choose it?

Compliance is important! But, we’re a fast-paced startup (we shipped more than 50 releases in 2023), and it’s challenging to integrate these compliance measures with tight product development schedules. It’s crucial for us to allocate engineering resources efficiently, without compromising on either innovation or compliance.

Before we dove into “compliance,” it was important to understand which compliance framework was the best for us. There are dozens of frameworks, but going after all of them would be time-consuming, expensive, and probably unnecessary. The right framework depends on our industry (software) and the markets we intend to serve (businesses that employ software developers— so, most of them).

SOC 2 was the first compliance standard we set out to meet, as it is applicable to a broad swath of industries. It assures clients of our commitment to data protection across various parameters, from HR and operations to software development. When we became “SOC 2 compliant,” this means an independent auditor determined that we met the standards set by the Service Organization Control 2 (SOC 2) framework, which is a set of criteria for managing customer data based on five "trust service principles:" security, availability, processing integrity, confidentiality, and privacy.

What’s SOC 2 Type II?

SOC 2 Type I and Type II include all of the same controls, but have key differences in scope and timing. SOC 2 Type I is a snapshot evaluation of a company's systems and controls at a specific point in time, which ensures that they are suitably designed to meet trust principles.

SOC 2 Type II goes a step further by examining the operational effectiveness of these controls over a period, typically three months or more. While Type I is ideal for organizations looking to demonstrate their system's capabilities quickly, Type II provides a more comprehensive and historical perspective and is suitable for those with more mature security practices. We chose to pursue a Type II audit.

For a software startup looking to work across various industries with numerous enterprise clients, achieving SOC 2 compliance is crucial for several reasons:

1. Trust and Credibility: Many enterprise clients view SOC 2 compliance as a necessary condition for business partnerships. By achieving SOC 2 compliance, we not only show potential clients and investors our serious commitment to data security and privacy but also significantly boost our credibility and reliability. For enterprises considering partnerships with Pieces for Developers, this compliance acts as a symbol of trust, signaling that we are a dependable, long-term business partner.

2. Risk Management: SOC 2 compliance helps identify and mitigate risks related to data security and privacy, which is essential for protecting both us and our clients from data breaches and other security incidents.

3. Market Advantage: In a crowded and competitive marketplace, achieving SOC 2 compliance sets us apart, particularly in the eyes of clients who prioritize data security. While SOC 2 compliance is often a basic expectation for considering a business partnership, companies that haven't attained this compliance are likely to be overlooked in favor of those that have, especially if both companies offer similar services.

4. Operational Excellence: Achieving SOC 2 compliance typically results in enhancing internal processes and systems, which boosts operational efficiency and effectiveness. This advancement signifies that we have reached a level of maturity and are ready to conduct business at the highest level.

SOC 2 compliance is more than just obtaining a certification; it represents a promise to our customers that we consistently uphold high standards in data security and privacy. This commitment is a key part of our value as a software startup in the current, data-centric business world.

Our Journey to SOC 2 Type 2 Compliance

Let’s dive into how we worked toward our SOC 2 certification without sacrificing momentum in a critical development and growth stage of our company. This is a difficult thing to do when operating with a small team of people, all of whom wear multiple hats. Looking back, it was not as challenging as we had thought at the outset, but it wasn’t simple!

1. Establish a Point of Contact to Lead the SOC 2 Process

To ensure successful SOC 2 compliance, it's crucial to appoint a dedicated point of contact (POC) within your company who will spearhead the process. This step is vital because the path to SOC 2 compliance involves detailed research and a methodical approach. The selected individual or team will be responsible for gathering necessary information, conducting in-depth research, and formulating and assessing policies.

This role is more than just a task; it needs to be an integral part of the job description to guarantee focus and accountability. Their responsibilities will include managing communications such as emails, overseeing policy development and reviews, and organizing necessary meetings. Given the fast-paced nature of startups, these activities require a well-organized and carefully managed approach. Without a designated leader or team, the complex and time-intensive tasks essential for SOC 2 compliance could easily be overlooked or delayed.

We designated our business administrator as our SOC 2 POC, with secondary POCs on the engineering team and in executive leadership to ensure the process could work efficiently.

2. Hire Vanta to Help

When aiming for compliance, particularly with frameworks like SOC 2, it can be highly beneficial to engage a specialized firm for assistance. These companies act as guides by simplifying and streamlining the complex journey towards compliance. When we began our SOC 2 journey, we evaluated several such firms and ultimately chose Vanta. Their platform stood out due to its user-friendly interface, automated testing, sample policies, and structured guidance, which made our compliance process much smoother.

Hiring Vanta offered us significant value. First, it saved time. The volume of policies, controls, and standard procedures required for SOC 2 compliance is… vast. Without expert help, creating these from scratch is daunting and extremely time-intensive. Second, it ensures accuracy and completeness. Vanta’s compliance experts have the knowledge and experience to ensure that nothing is overlooked, which is crucial for meeting all standards effectively. Third, it reduces the risk of non-compliance. Mistakes or oversights in the compliance process can be costly; professional guidance minimizes these risks and provides peace of mind that the process is handled correctly.

3. Meet regularly with your Representative from Vanta

Preparing for a compliance audit, like the one required for SOC 2 Type II, was a challenging process, akin to studying for a major exam or defending a Ph.D. dissertation. Preparation involved meticulously reviewing and customizing hundreds of pages of policies to fit our organization, engaging in 2-3 discussions with every employee, and dedicating hours of work from our engineering team to address security controls.

During this intense period, the importance of seeking assistance and guidance cannot be overstated. We met weekly with Vanta in the early stages of preparation. These meetings ensured that we were on the right track, using their software effectively, and implementing policies correctly. This consistent engagement with experts not only prevented doubt about the process, but also helped us maintain forward momentum. They were valuable opportunities to get expert insights, clarify uncertainties, and receive reassurance that we were heading in the right direction.

4. Align Engineering Timelines with Compliance Work

For an efficient SOC 2 process, it was essential to establish a coordinated effort between our administrative SOC 2 POC and our engineering POC. This collaboration was crucial due to several key responsibilities:

• Deep Technical Understanding: Our engineering POC needed comprehensive understanding of and administrative access to all of the company's infrastructure and partner services. This included platforms like Google Cloud, Azure, Auth0, and GitHub.

• Insight into Data Management: They were well-versed in the company's software data pipelines, including what data is collected, how it is used and stored, and the security measures in place to protect it.

The collaboration between our administrative and engineering POCs was not just a technical necessity but also a strategic one, ensuring that our SOC 2 compliance efforts were seamlessly integrated with Pieces for Developers’ overall strategy and development cycles.

5. Enter the Audit Window

A SOC 2 Type II audit lasts at least three months and is overseen by an independent auditor; we worked with the Johanson Group. During this three-month period, we made sure that all of our automated tests were passing and that we fulfilled our security and operational obligations within our stated service level agreements. This was far less time-intensive than audit prep, as all of the groundwork was complete and now we were in maintenance mode.

6. Answer Questions from the Auditors

Once the audit window closed, our auditor sent us some questions about security events that hadn’t occurred during the window, like offboarding an employee and annual reviews. Thanks to our preparation and work with Vanta, we were prepared with all of the documentation we needed for this period of the audit to go smoothly.

Once we answered all of our auditor’s questions, they took a couple of weeks to prepare our final audit report.

7. Receive our Final Audit Report— We Passed!

About a month after our audit window closed, we received our final audit report. This is a comprehensive document that outlines our platform and the processes we have in place to meet SOC 2 controls and certifies that Pieces for Developers is SOC 2 Type II compliant.

We passed! Now it’s time to display the AIPCA SOC 2 badge on our website and share with the world that our hard work has paid off: We earned our SOC 2 Type II compliance certification.