Compliance

Compliance tooling has grown from a niche into a substantial category, driven by data protection regimes, security certification demands from enterprise buyers, and accessibility requirements becoming enforceable. The launches here cover evidence collection and audit readiness, privacy operations, policy management, vendor risk and accessibility auditing.

For a small software company, the compliance question usually arrives as a security questionnaire from a prospective customer, and the tools that automate certification readiness exist to answer it. What they genuinely do is collect evidence continuously — that access reviews happened, that machines are encrypted, that logs are retained, that changes were reviewed — so that an audit is a report rather than a scramble. That is real value. What they do not do is make you secure; they document controls you have implemented. A company that adopts the tool and not the controls has bought an expensive way to be audited.

Privacy operations is the other large piece: handling access and deletion requests, maintaining records of processing, managing consent, and tracking where personal data actually lives. That last one is the hardest and the most valuable, because most organisations cannot answer it, and every obligation depends on it. A tool that builds an honest inventory is worth more than one with better workflows over an incomplete map.

Vendor management matters more than it seems, because your obligations extend to processors you use. Knowing which vendors touch personal data, what agreements exist and what happens if one has an incident is basic and frequently absent.

Accessibility auditing deserves a specific note: automated scanners reliably catch perhaps a third of real issues. They find missing labels, contrast failures and structural problems, and they cannot tell whether a flow is operable by keyboard or whether the reading order makes sense. Automated tooling plus periodic manual testing is the honest approach; a green scanner score alone is not compliance.

As with everything in this area: software supports a compliance programme and does not constitute one, and obligations vary by jurisdiction, sector and the data you hold. Confirm your specific position with someone qualified.