No time for
the wrong fixes
How a YC-backed AI startup kept its ISO 27001 preparation focused on what its product needed.
Madeleine MalmstenCTO & Co-founder“The team came with very concrete recommendations.”
Early-stage voice AI startup for employee interviews. San Francisco, US.
for DAkkS- and UKAS-accredited certification bodies
Starting point
For a startup, security work that doesn’t apply is time lost.
Sona8 builds a voice AI that interviews a company’s employees about their work and turns the answers into process maps and a ranked list of problems. Its customers are large companies, and their security teams ask for ISO 27001 before they sign.
By the time of the internal audit, the team had done the groundwork: their ISMSISMSInformation security management system. The rules, processes and controls a company uses to keep its information secure. was in place, built on Vanta, with the evidence in order and the platform’s checklist covered. For the audit itself, they wanted experienced auditors who would look at everything with the product in mind. Anything that checklist doesn’t go deep enough to show needed to come up now, because found at the certification auditCertification auditThe audit by an accredited certification body that decides whether the company gets the ISO 27001 certificate., it could delay the certificate. At the same time, the team’s effort had to go only into what mattered for Sona8, leaving out anything that doesn’t apply to them.
The timeline
- 14 October
Documents in
Sona8 sent their policies and records ahead of the audit, so both auditors knew the setup before the opening call.
- 21 October · 9:00
Opening call
Both auditors met the founders and the team on one call to confirm the scope of the audit, who is responsible for what, and the plan for the morning.
- 21 October · 9:30
Audit calls
Track 1 · OrganisationOne auditor went through the organisational side with the people who run it: policies, onboarding and offboarding, and the commercial agreements behind customer deals.
Track 2 · ProductThe other auditor covered the product with the engineers: how interview data is anonymised, where transcripts are stored, how records get deleted, and how code changes reach production, so every question was about Sona8’s real setup.
21 October · 9:30 · Two tracks in parallelAudit calls
Track 1 · OrganisationOne auditor went through the organisational side with the people who run it: policies, onboarding and offboarding, and the commercial agreements behind customer deals.
Track 2 · ProductThe other auditor covered the product with the engineers: how interview data is anonymised, where transcripts are stored, how records get deleted, and how code changes reach production, so every question was about Sona8’s real setup.
- 21 October · 12:00
Closing call
We explained each finding to the whole team while the context was still fresh, with a fix sized to the risk.
- 28 October
Report in 5 business days
The report rated every finding, with its cause and the steps to close it, and included the audit plan and auditor credentials the certification body asks for.
- Now
Closing the findings
Sona8 is working through a short list, with a check-in from us before the certification audit.
- Next
Certification audit
Stage 1: the certification auditor reads the documentation, the internal audit report included, and decides whether Sona8 is ready. Stage 2: the auditor checks that the ISMS runs in practice.
- Then
The certificate
With the certificate, the deals that wait on it can go ahead.
Findings and fixes
The internal audit confirmed a solid base. Sona8 built data protection into the product from the start: interview data is anonymised before analysis, and the product collects only the personal data it needs.
The issue list that came back was short and specific to Sona8. Here are three that mattered for the startup.
- 01
Code reviews sorted by risk
Two engineers write most of Sona8’s code, with help from AI coding agents, so a human review on every change would slow the team down without making it safer. We showed them how to sort each change by type and risk. Now automated tests cover the routine changes, and a second engineer approves the risky ones.
- 02
Licence checks on dependencies
Sona8 already scanned every change for vulnerabilities in the open-source code it depends on. We pointed out that a dependency can also change its licence after it is in use. The team now checks for that too, so its customers don’t inherit a legal risk they never agreed to.
- 03
Clear roles from the start
Some responsibilities in the security setup were shared between people without a clear owner. The team now has clear roles, so everyone knows what they are responsible for and can prepare their part of the audit in advance.
Code reviews sorted by risk
Two engineers write most of Sona8’s code, with help from AI coding agents, so a human review on every change would slow the team down without making it safer. We showed them how to sort each change by type and risk. Now automated tests cover the routine changes, and a second engineer approves the risky ones.
“We’re a startup, so we move fast, and our customers trust us with what their people tell us in interviews. That’s why a proper internal review of our data security mattered so much to us. Louis and his team came with very concrete recommendations. They helped us meet everything compliance requires, and then go further, so the way we protect data will hold up as we grow.”
Madeleine MalmstenCTO & Co-founderCTO & Co-founder · Sona8The takeaway
With deals waiting on ISO 27001, Sona8 could not afford a delay. Any problem that first turns up at the certification audit can hold up the certificate, so the team used the internal audit to find and fix issues early.
Time and resources mattered just as much. A fast-moving team can’t spend weeks on work that doesn’t bring it closer to the certificate. The internal audit kept the effort focused: every item on the list was relevant to Sona8’s product. Every hour before the certification audit now goes into the fixes that count.
An internal audit should
keep you focused on
what your product needs.
Worth reading
The internal audit is the one check you run yourself, and the cheapest place to find a gap. Here is what auditors look at and what you get out of it.
ISO 27001 · October 15, 2026
ISO 27001 Clauses 4–10: the first steps in setting up your ISMSGoing for ISO 27001 for the first time? See what Clauses 4–10 require you to document and evidence, with a focused plan for your first 90 days.
ISO 27001 · March 3, 2026
ISO 27001 Clause 10.2: nonconformity and corrective actionProblems will surface in any ISMS. Clause 10.2 decides whether you learn from them: how to find the root cause and close findings with evidence auditors accept.
ISO 27001 · May 26, 2026
See more articles on the Knowledge HubInternal audit with your product in mind
Book a free consultationNo. Platforms like Vanta, Drata, or Scytale are great at collecting evidence and monitoring your security setup, but Clause 9.2 asks for an independent audit by a qualified auditor, not a dashboard check.
Yes, if the auditor is objective and impartial, which is what Clause 9.2 asks for. They can't have designed, implemented, or operated the security measures they're testing. Larger organisations with a separate compliance or audit function can do this in-house. Smaller ones rarely can, and when the same team builds and audits the security setup, the result is friendly findings, familiar blind spots, and confirmation bias.
Internal audit is your own test of whether your security setup works, on your timeline, with findings yours to fix. External audit is your certification body deciding whether you meet the standard, on their timeline, with findings in the report that decides your certificate.