compliance

CCPA/CPRA and the US patchwork

Threshold-based applicability (revenue / records volume — verify current numbers); rights: know, delete, correct, opt-out of sale/share (GPC signal honored); "sale" is defined disturbingly broadly (adtech data flows count). US state laws multiply yearly — websearch the map when a US audience matters.

SOC 2 readiness

• Type I = design at a point in time; Type II = operating effectiveness over 3–12 months — customers increasingly accept only Type II; the observation window means starting the habits now.
• Security (common criteria) is mandatory; add Availability/Confidentiality only if customers demand them — each added criterion is added audit surface.
• The controls that fail most: offboarding (access revoked within 24h, with evidence), quarterly access reviews (documented, not "we looked"), change management (PRs + approvals as evidence), vendor review, tested backups, and an incident-response doc that's been exercised once.
• Evidence discipline beats heroics: screenshots/exports collected monthly into an organized folder turn the audit from archaeology into paperwork.

Questionnaires and policies

Answer what's true today; "No, planned for Q3" beats a yes that a breach later disproves — misrepresentation in a questionnaire is contract fraud territory. Policies state what you actually do, dated, owned, review-scheduled; copying a competitor's policy imports their practices as your promises.