John Collison: preference

Transcript context

…We do like to market. Then going back to the other part of the question. How does the layer work for… The rule book might be a thousand pages long. Compiling that rule book into the steps that are actually actionable for me, because I am not a farm, and so all the farm parts of the rule book don't apply to me. Yeah. The initial… The initial version of it actually was… This was back when we were founders on a couch, was getting as many SOC 2s as we could. It was Salesforce, Slack, AWS, whatever, and actually opening them all and just comparing them and trying to extract what was common and doing it that way. That was the first cut. What we do now is, hopefully more advanced, but there's a bit of… Now that we have probably 30,000 audits completed, we can just go back and be like, "Okay, for a company that looks like you, and for this auditor often, what sorts of controls are there?" We have that input in. Then we can also layer in both for a company in particular and in general. You get questionnaires. What are the themes and the questions you're being asked? We just launched a new commitments product that ingests contracts and scans the contracts for things that are contracted. Then you can both pull them out and say, "Hey, this should be a control." And God forbid, something happens, but you're like, "What are my obligations to my customers?" You can just basically have all that structured data. But one of the most important things is they just want to see progression over time and increase maturity over time. You've probably had this at Stripe where you wanted to use some cool new tool that had no security posture and a contingent… Sorry, hack that, maybe. But one part of it was like, "Can you just walk this up over time and show me you're making progress?"…

Stored transcript either side of the excerpt. The highlighted words are the published quote; the surrounding text is unedited source, never generated.