What buyers actually buy when they buy compliance software.
Nobody writes a check for SOC 2 software because they want SOC 2. They write the check because they want their next deal. The artifact — the report, the binder, the questionnaire response — is evidence in service of a decision someone else is about to make. Compliance vendors that build for the artifact end up selling the wrong thing.
This is a category-level mistake the compliance software market made early and is still paying for. The pitch optimizes the artifact. The buyer pays for the artifact. The market rewards the fastest, cheapest artifact. And then the artifact reaches the next buyer’s desk, and the seller discovers that what they actually needed to buy was something else entirely.
What the surface story says we’re buying
Walk into any compliance-software demo. The shape is consistent.
The customer wants SOC 2. The vendor automates evidence collection and reporting. The output is a SOC 2 report, faster.
The customer wants RFP responses. The vendor generates RFP responses. The output is a stack of RFPs, faster.
The customer wants questionnaire automation. The vendor automates questionnaires. The output is a filled questionnaire, faster.
In every case the vendor claims speed. The buyer compares on speed. The market consolidates around speed. The value proposition is well-formed; the buyer feels well-served. Nobody is lying.
The story is also incomplete.
What buyers are actually buying
Behind the SOC 2 report is a buyer at the next deal — a security team, a procurement panel, a vendor risk reviewer — deciding whether to rely on this company. The report is what they read on the way to the decision.
Behind the RFP response is a procurement panel deciding whether this company can deliver. The response is what they read.
Behind the questionnaire is a security review deciding whether this vendor introduces unacceptable risk. The questionnaire response is what they read.
The artifact is read by someone deciding whether to rely on a person — the team behind the artifact, the company behind the team. The artifact is evidence. The decision is the product the buyer’s company actually purchases.
When that lands, several things follow at once. Speed at the seller is not the same as defensibility at the buyer. A faster artifact is good. A faster artifact that the buyer can’t verify is worse than a slower one. A faster artifact the seller can’t defend, when the buyer’s review team comes back with questions, is worse still — because what the seller was actually purchasing was the right to give a buyer confidence, and the artifact has now made that harder.
If the artifact is wrong, fast, and untraceable, the decision the next buyer makes is harder, slower, and more skeptical. The seller’s speed gain becomes the buyer’s review-table friction. The compliance vendor solved the wrong problem at the right speed.
What this means for product design
If you accept the reframe — that what’s actually being purchased is the right to rely on someone, mediated by an artifact — product decisions cascade.
Citation is non-negotiable. Without it, the artifact erodes the decision it’s supposed to support. Every claim in a security questionnaire that the buyer can’t trace back to a real source is a claim the buyer has to take on faith — and buyers don’t take vendor claims on faith on the way to a security review.
Speed without defensibility is a regression. A wrong answer that arrived in two hours is louder than a slow right one. It gets forwarded. It comes back as a follow-up question. It introduces doubt. The seller’s productivity metric improves; the seller’s deal close rate doesn’t.
Auto-submission is malpractice. The audit trail of human approval is part of what’s being purchased. A questionnaire that goes out without a person standing behind it is not a faster trust artifact; it is the absence of a trust artifact, packaged in the same shape as one. Removing the human approval step is removing the product.
The reviewer at the seller matters as much as the reviewer at the buyer. A good compliance tool makes the sales engineer’s review faster, not optional. The engineer’s name goes on the questionnaire either way. What the tool can do is hand the engineer a draft they can defend, with citations they can verify, in a fraction of the time it would take to build it from scratch.
The principles this points to
This is exactly what we mean by Trust is the product. Compliance is the deliverable; trust is the product. The artifact is the evidence; the decision is what’s being bought. A vendor whose entire roadmap optimizes the deliverable is competing in a category one layer below the one that matters.
It is also why Humans always decide is a constraint in our products, not a configuration setting. Every step the AI takes uncontested moves the eventual buyer’s decision further from a person who can defend it. The buyer at the next deal doesn’t want to read the output of a confident model. They want to read the output of a person, accelerated by AI, traceable to a source.
Compliance is the deliverable. Trust is the product. Everything downstream of that confusion is the difference between a deal that closes and a deal that doesn’t.