Challenge
- Respond to growing customer requests for SOC 2 with a repeatable program owned by the startup team.
- Expand the compliance program to include GDPR requirements and ISO 27001 as customer and market needs evolved.
- Keep controls, evidence, policies, vendor reviews, and customer questionnaires current while moving quickly.
- Give infrastructure, engineering, and customer-facing teams a shared way to manage trust work.
Solution
- Used Drata as a shared system for controls, automated tests, evidence, policies, audits, and ownership.
- Connected systems and monitors to identify drift, used policy templates, and combined guided onboarding with human support.
- Reused controls, evidence, and policies across SOC 2, GDPR, and ISO 27001.
- Used the Trust Center to support customer self-service and assurance.
Results
- Completed its SOC 2 and GDPR compliance work and progressed ISO 27001 through internal audit and into third-party audit preparation.
- In some audits, when automated tests and ongoing evidence were in place, completed the work in roughly one to two weeks.
- Reduced repetitive customer-assurance work through Trust Center access, FAQs, NDA workflows, and organization whitelisting.
- Accelerated its sales process through Trust Center support, based on an internal estimate.
- Expanded compliance ownership beyond one person by delegating controls and audit work across engineering and operations.
Background
Unblocked is the context layer for agentic software development. It connects to a team's code, pull requests, Slack, issues, docs and production systems, then reasons over the relationships between them so AI agents complete work correctly with less human intervention. Agents reach it through an MCP server, CLI or API. As you can imagine, connecting to these critical systems requires trust and a strong security posture.
Unblocked’s team brought experience from larger-company environments where compliance work was supported by dedicated teams, legal counsel, and subject-matter experts. As a startup, the team initially used white papers and other customer-facing materials to support early conversations.
As Unblocked began working with customers in production environments, SOC 2 became a business requirement. The team needed to build and own the full program while continuing to develop the product and support enterprise customers.
After evaluating several platforms, Unblocked selected Drata. The team prioritized access to human guidance, a structured control model, automated testing and monitoring, and policy templates.
“When you’re first building a compliance program, there’s a lot of ambiguity and what feels like a sea of tasks. We wanted access to a human that could guide us through the process rather than sifting through a long email thread. Drata provided unmatched support and it’s a major reason why our compliance foundation is so strong.”
Building a Compliance Foundation with Guidance
With Drata’s product guidance and compliance support, Unblocked assessed its current state, identified gaps, and prioritized the work required to build its program. This gave the team a structured path from initial scoping through implementation.
The team connected its systems and began using monitors to identify infrastructure gaps. Mahdi described the first phase as a practical cycle: connect systems, address failing controls, identify missing evidence, and work through the related policies.
“Implementing the platform has been one of our favorite parts of the Drata experience. Instead of a product runthrough, we met with Drata experts who truly understand compliance. That expertise, paired with the power of the platform, gave us the visibility we needed into existing gaps and our overall compliance posture. We realized the value of Drata immediately.”
Unblocked also used Drata’s policy center and human support as questions surfaced. Over time, the team moved from onboarding guidance to using in-product support for day-to-day decisions.
Keeping Controls Current as the Company Moves Fast
Unblocked uses Drata as part of its regular operating rhythm. The infrastructure team checks control status, investigates monitor failures, reviews evidence, and tracks policy renewals. Evidence-library alerts also surface upcoming renewals, including cyber insurance, before they become audit or customer issues.
Automated testing changed the work required for audit preparation. Unblocked may receive requests for 30–40 evidence items or screenshots during an audit, and preparing one manual monitor’s evidence can take about half an hour. With automated tests in place, some audits have taken roughly one to two weeks when ongoing evidence was already available.
“The automation that powers the Drata platform has led to significant time savings on our compliance journey. Having to collect evidence manually easily eats up hours of our day, and creates a massive backlog of requests. Automating evidence collection not only saves me time, but also reduces back and forth with the auditor.”
The program also became easier to distribute across the organization. During the ISO audit exercise, the VP of Engineering and DevOps teammates took ownership of relevant controls while Mahdi focused on infrastructure and technical work.
Making Customer Assurance Part of the Sales Process
The Trust Center became an important capability after the initial implementation. Unblocked uses it to give customers access to security documents, manage NDA workflows, and let approved organizations self-serve information. The team also uses FAQs to answer recurring questionnaire questions before they create another round of manual work.
For Brandon Waselnuk, Developer Relations at Unblocked, the Trust Center changed the role compliance could play in enterprise conversations. Prospects can review the company’s security posture earlier, while customer-facing teams spend less time routing documents and more time moving conversations forward.
“Building our Drata Trust Center took our compliance program to another level. We have a live, integrated page that shows our security and compliance posture in real time to accelerate sales deals at a pace we’ve never seen before. This allows us to utilize our compliance program as a sales lever, trust builder, and fuel our growth even faster.”
The Drata Trust Center also accelerates the team's sales process and serves as a prerequisite for some conversations: prospects may choose not to engage if SOC 2 is not visible and available for review.
What Drata Unlocked
Using Drata, Unblocked built a shared operating model for compliance, from control monitoring and evidence management to audits and customer assurance. The team can see what needs attention, assign work to the people closest to it, and keep the program connected to day-to-day infrastructure changes.
Program expansion also became cumulative rather than a series of greenfield projects. When Unblocked added GDPR requirements, existing evidence, controls, and policies created a starting point for the new work. The same foundation now supports ISO 27001 activities.
“After achieving SOC 2 attestation, we decided to pursue GDPR, which comes with its own stringent requirements. Rather than starting from scratch, the platform showed us we were already 60% of the way there based on our existing controls, evidence, and policies. I don’t think we could have survived the path to GDPR without Drata’s multi-framework support.”
The result is a centralized compliance program with distributed ownership—and a trust motion that supports both audit readiness and enterprise growth.
Future Outlook
ISO 27001 is Unblocked’s immediate priority because customers require it for specific segments and opportunities. The team plans to select future certifications based on business objectives and customer demand rather than pursuing frameworks in isolation.
