Name: Leaving Vanta Behind: How Flourish & Thrive Labs Built Compliance Into Its System of Record
Uploaded: 2026-10-28T20:06:07.610Z
Duration: 47 min
Description: Leaving Vanta Behind: How Flourish & Thrive Labs Built Compliance Into Its System of Record

Transcript for "Leaving Vanta Behind: How Flourish & Thrive Labs Built Compliance Into Its System of Record": Alright. Welcome, everyone, and thanks for joining today's session. It's a little different from our usual product walk through. We're gonna start with a real customer story, from Flourish and Thrive Labs and use their experience to show what automated continuous compliance actually looks like in a day to day. And then we'll widen the conversation and close with a live demo. Quick intro on me. My name is Matt Lombardo, and I am an IT evangelist here, and I'll be moderating today. Jefferson, over to you. You know, please introduce yourself. Give us a quick version of what Flourish and Thrive Labs does. Yeah. Thanks, Matt. Hi, everyone. I'm Jefferson McMillan Mulhoid. I am the chief executive officer for Flourish and Thrive Labs. And we are a technology company focused on, supporting local, state, territorial, and federal, and tribal public health departments. And our goal is to give them the operating systems that they need to do good public health no matter if they are a one person health department all the way up to, a couple thousand person health department. And our product, is we make a product called Public Health three sixty or p h three sixty. It's the AI operating system for public health. So all of our operating system pieces, sit on top of our p h three sixty platform. And we have everything from, just allowing health departments to get safe, reliable access to artificial intelligence to help them do their job, all the way to doing, very specific workflow operation tasks, like, being able to perform environmental health inspections in the field and, being able to provide care and case management to patients or people within, their communities. And as you could imagine, there's a lot of compliance that sits within that. We're in this, like, real interesting world of government and, health care. Right? Because a lot of public... Even though public health is very different from health care, we do provide health care services, which means that we have to deal with HIPAA a lot. And so our platform has to be able to provide all of that. And so super excited to talk about why the platform and then why, why we're really in... Why why we're really looking and have been doing a lot of compliance work within it. Awesome. Looking forward to hearing about it. AJ, do you mind introducing yourself? Yeah. Absolutely. Hey, everyone. I'm AJ Yan. I'm the product lead and GRC engineer here. I'm the automated compliance team at Rippling. I've, been in the GRC space for forever and have been building products and working with folks like Jefferson for a very long time. So I was super excited because I think, people forget how important this stuff is. So I'm excited for Jefferson to share how important it is for him and also for his customers. And Rav. Yeah. Of course. Great to meet everyone. My name is Rav. I lead our go to market motion here at Rippling for our automated compliance products. So I lead both our pre and post sales teams, for GRC. So my background has been... I worked at another compliance automation company before this, and also I've worked in the GRC space both as an auditor and a head of GRC at a startup and an enterprise. So really excited to talk about the product today and what we're solving for. Awesome. This sounds like a great crew. Alright. So here's how set... The today's session's gonna go. First, we're gonna do a direct case study conversation with Jefferson about, you know, moving off of Vanta and consolidating into rippling. And then AJ and Rave are gonna zoom out on why automated continuous complements, is the bigger shift happening across the market, and then we'll get into, like, a little bit of a demo around automated compliance. With that, you know, context matters a lot for kinda what's coming, and a company that handles public health data for government agencies cannot treat compliance as a side project. So, you know, we're gonna get into it. You know, how did you actually get your compliance, programmed where it needs to be today? And, you know, so this... The next section that I kinda wanna, you know, pivot into is the heart of the session. And and, Jefferson, we're gonna walk through your actual journey step by step, and wherever you can, put a real number on it. So let's start to kinda kinda at the beginning there. Before Rippling, you were running Flourishing Thrive Labs across eight separate systems, things like ADP, Harvest, EasyLama, QuickBooks, and Intune. Walk us through what consolidating all of that actually saves you. You know, is there a number that you put to it, hours per week or dollars? I mean, the hours per week number is probably the easiest. Right? Because, you know, if you can imagine every one of those systems takes somebody maintaining it, takes somebody putting in, information into it. And then not to mention the fact that most of those don't talk to each other. So then we have to cross information into all of those systems. So if we think about it, right, so eight... We were using 80 Feed per payroll, Harvest for timekeeping, Easy Llama for, training and compliance, QuickBooks, which technically we still do use, but it's gotten a lot better because we're consolidated on to Rippling and then Intune. K? So ADP at least was ten to fifteen hours a month just doing the payroll stuff. We had to pull harvest hours into ADP, add another ten hours to that. Then EasyLlama setup, that's every time we onboard somebody, we need to get them into EasyLlama, and we use track their training because it didn't come over into ADP or anywhere else that we were holding all that information. So let's call that another ten hours. So now we're up to thirty five. QuickBooks is at least twenty to twenty five hours without an integration to try to do close. So now we're up to... What is that? Thirty five... That's fifth... Sixty hours ish. And then Intune, like, let's just throw a hundred hours into there because, like, Intune is just crazy. Right? Like, there's just a lot of stuff to do there. And as a small business, you can imagine that, like, we have we have people to do that, but it takes somebody's time away from actually building a product that we're we're working on. So what we've actually done is... And I had the team compile this before I got on today. So we're actually probably down to about fifteen hours across all of those for the maintenance and overhead that we would... That we require for that. So we're... We went from sixty five hours to fifteen hours, which is really crazy. And we got to sort of disperse some of that work out because now instead of us, you know, harvest to ADP is a great example. So we use Rippling for timekeeping. We use Rippling for payroll. Timekeeping goes directly into payroll. Right? If, you know, I... It was a person's job to transition harvest data into ADP. Now everybody just files their time sheet. And if they file their time sheet, it goes into payroll. And so, like, we've democratized that maintenance, which is just... That's also a part of the time savings that I don't know even where to begin to calculate. Wow. That is a huge amount of hours saved. You know, you added that... You added rippling automated compliance to replace Vanta starting with SOC two. What was the tipping point for for you guys, and what's the clearest, you know, before and after number you can point to? Maybe, you know, you kinda just touched on hours, but, you know, spent on, like, duplicate evidence requests or policy sign offs between two systems. You know, what can you kinda share there? Yeah. So the policy sign offs between two systems is probably the clearest evidence. So we were running GRC and Vanta. So our our automated... Or our compliance work was all in Vanta. And Rippling holds all of our people data. Right? And when somebody onboards, they have to review all the policies, and they've gotta sign off on all the policies, including all of our technology and finance and HR policies, all of which are required for SOC two and for HIPAA. So they do that. They do it all in Rippling. And then in order to get the evidence into Vanta, they then have to go over to Vanta and do it again. They basically just go and click a button and say, yes. I read all of these policies, which, you know, thirty minutes maybe to go through all the policies, but, like, there's just a check when Rippling already has all that data and, like, there was no way to move it over. So that's one of the biggest areas where we found a lot of, like, why we pushed over to, automated compliance on Rippling. I mean, the other thing is just, like, everything else on our company runs on rippling. So, like, why not? Like, why not move our compliance where all of the data already lives anyways? Yeah. Everything under one roof is is always nicer. Yeah. You knocked out SOC two first, you know, and HIPAA is next, which matters a lot given, you know, p h three sixty servers and public health departments directly. How much of your HIPAA groundwork do you feel you can already demonstrate through, what you've built for SOC two as, like, a rough percentage or timeline? I can give you an exact percentage. We're at about 89%. And that rate, that's the power of Rippling GRC is I was able to just go pull in, like, where we started once, like, once we flagged that up and turned it on. Like, okay. We're at 89% of our stuff. I will say, like, one of the things that we had done, we started with SOC two, but we knew HIPAA was coming. So we did start to, like, prepare some of our stuff in Rippling automated compliance ahead of that. So it may not be 89% for everyone. But, like, still 89% is, like, quite a bit. And we're really just talking about, like, the stuff that wasn't there was really policies that needed to get brought in and signed off. Like, those are... All of the other monitors, all of the other pieces were already there. So, like, adding... And that's what I just... That's what I love about automated compliance is, like, when you add a new, we add a new compliance framework, it pulls everything in that you've already got anyway, so you're not duplicating that work. So, like, if, you know, tomorrow, I decided we wanted to go do ISO twenty seven zero one, we could do that. We could just go and, like, you know, that's a thing that we could add on and we'd be a part of the way there already, which is really nice. Yeah. As you mentioned, like, not having to do that duplicate work is obviously going back to your hours time saved, which is... Yeah. Exactly. Yeah.... Peace of mind thing too. Right? Like, it's just, like, knowing that, you know, I'm not having... Like, we're not having to figure out where things map in because we're... It's just one view of our compliance instead of having to figure out what's SOC two and what's HIPAA and, like, those sorts of things. Of course. You know, you've gone further than most customers kinda testing the trust center, you know, AI remediation and new HIPAA security risk assessment as a beta partner. Which one has moved the needle most for you so far? And can you, again, kinda put a number on it, like time to close finding or time to turn around a security questionnaire? Yeah. The thing that has probably moved us the farthest is the AI remediations. That is by far the biggest time savings because what we'll do is we'll see something in automated compliance. We'll figure out, okay, this needs to get fixed. We'll use AI remediations to tell us what needs to actually get fixed, and then it gets logged into Jira and gets worked. So that, like, time to... I like to think about it as, like, the time to discovery and architect review. I don't really... We don't really have to do a whole lot of architecture review because, like, at the AI remediations has already done that for us. And so really, it's just the, okay, now we've got it, log it, and do it. So our time our time to remediation has gone down significantly. Just more more time saving. More time. And, right, as a small business, like, that's what it's about. More time for... And for us, even more than that, more time... Like, the time savings means that we can build more things for public health departments. And that's at the end of the day, what matters is that, like, we can do more things that are going to help them serve their communities. Absolutely. You're also adding help desk to replace a custom app that your team built in house for access requests. You know, roughly, how many access requests are you processing today, and, you know, what does the process look like once it's automated, end to end? Yeah. So we probably process, I would say, maybe two to three access requests a day. And you've gotta think about, like, access requests. Are... Anyone on our team needs to have, like, a permission set added to our AWS accounts, or they need to get, access to a system they don't already have access to or expand their access to systems that they already have access to. So, like, two to three a day is probably a good average. Today, the way that that works is, somebody sends a team request to somebody. They put it into the system. We work it, and then, it gets... And then the the, the access gets added, and then we tell them, and then they test it, and then it's all good. Right? With help desk, what... And we've actually... I just saw it today because somebody somebody needed to get something new in AWS, and they went through help desk, and it was great. And so what they'll do today is they'll just go into Rippling. They'll say, I need this access to this thing. You know, for instance, I need access to our AWS account, and I need this level of access. We have a policy set up for that. It comes to me for approval or whoever the owner... I I own the AWS system. So, like, it comes to me for approval. I approve it. And then all of a sudden, their access is granted, and nobody has to do anything. And, like, what would have taken probably four or five hours for us to do that whole process took maybe a couple of minutes. Be... And that means that they were able... Because they needed this access to test something that they were experimenting on, that that means that they were able to do the experiment faster, which means that they were able to get a decision faster, which means that they were able to get to product faster. So all of this transitions to, yes, time saved, but it's more so time to delivery, which is huge. That one definitely lands with me, you know, coming from internal IT, access requests, even though you're saying two to three as if that's a small number, you quantify how much time that takes. I mean, those are, again, huge time saving things when, you know, you... Like, you... You've been saying throughout this... The theme here is you guys have a mission and a job to do, and to be able to focus your time and energy on that is where you need to be. Not, like, as you said, adding someone to an access policy for AWS. Like, it's important, but in the grand scheme. Right? Yeah. So that's awesome. So if you zoom all the way out, is there one number that you would say best captures the return so far, hours saved per week, audit prep time cut or headcount that maybe you didn't have to add after, you know, GRC and and everything and automated compliance that you've shared? Yeah. So I actually... I like the headcount idea, but I wanna spin it just a little bit differently because it's not the headcount that we didn't have to add. It's the headcount that we got to use on our product instead of assigning them to have to be a compliance manager or to have to deal with access requests. Right? Like, we were able to put a new developer onto our product instead of having to hire someone to manage our compliance program and to manage our access requests and to do all of those sorts of things. So I love the headcount number. One of our big thing... Like, it's a big thing in public health that we always like to think about, like, not necessarily reducing staff or not necessarily, not adding staff, but adding the right staff in the right places to forward the mission. And that's for us the big thing is it's not that we didn't have to add... It's not that we didn't add headcount because we did. We just got to add headcount in a place that it matters versus... And not that compliance doesn't matter. I shouldn't say that. Like, compliance is important. We are all here because of that. But, like, for us, getting product to our our customers so that they can do their mission is the most important thing. And so being able to have a... Being able to use that headcount there instead of having to have it in the overhead side is just makes a world of difference. Yeah. I mean, not having to have people kinda wear multiple hats. Right? Like like, you kinda stated then now they can kinda stay focused on the product and what you're delivering to your to your customers is a lot more beneficial than kinda going the opposite way. Right? So Yeah. You know, now I kinda wanna zoom out a little bit because, Jefferson, your story is is not unique. You know, it's kinda a pattern that I think both AJ and RAV see constantly. So, you know, AJ, just to kinda... You built automated, compliance knowing companies like Flourish and Thrive Labs exist. What's the pattern you see across customers who make this, you know, same switch? Yeah. I think, it's a it's a few things. Like, the really cool aspect of what Jefferson has described is the shift that we've seen in GRC and compliance over the last five years where we want the outputs of our GRC activities, our compliance activities, our risk activities to be as close to the systems of record as possible, because that means that we can make much better decisions. People can feel a lot more confident when they're making vendor evaluations in the data. So it only makes sense as as as everybody's hearing all of this and thinking about how do I make sure when I say I'm compliant, it's real, and it also does not require me to, you know, never sleep again. I'm going to want to use a system where the data is integrated, where it's close, and I don't have to have a PhD in someone's API to to connect things. Right? It's it's all about the data's here. So I think the aspect of being close to the system of record is where we're we're headed, and and we're in this new era where everybody talks about context is everything in in the in the AI era. Well, that has always been true for GRC. It's always been true in compliance and risk and governance that that context is everything. And now with us building what we built here at Rippling and what everybody just heard Jefferson describe, your compliance program with Rippling is going to have all the context it needs. And then when it comes time to actually operate the controls, people actually are gonna do the right thing because it's built into the system. Whether it's the help desk example, whether it's the HR example, it's built into the system. So people aren't just gonna go and approve a policy because it's just in this compliance system. And Rob talks about this often as well where when people get a notification from Rippling, they respond to that. They're like, hey. That might have something to do with pay. Might have something to do with access. Like, I prompt... But if you get a notification from just a plain GRC tool compliance, so you're like, alright. Whatever. I'm gonna go check the box. So I think just having it all give someone like Jefferson who's running the business who, again, like, this stuff matters, especially in the health care space. You have to do these things, and you need your organizations to have a culture of compliance. And I think having a tool like Ripland allows you to do that for sure. Yeah. That's awesome. Yeah. I mean, we kinda... Like you said, we already have the context. Right? So it just kinda makes sense. Rad, from from a solutions consulting seat, what's the question every prospects... A prospect asks you right before they decide to make the switch? Yeah. Really, the number one question they ask is, why haven't you guys created this sooner? Really, it doesn't make sense. I mean, that was my question. Yeah. That's exactly it. And that's a... It's a conversation we have often. Look. I've I've worked at another compliance automation tool. They're great tools. And they do the job, but they only do one job. And it's just helping you become compliant. And it doesn't make sense, especially in this economy and in this industry, to pay $25.30, $50,000 just for a tool to collect data from other tools to tell you to become compliant. And on top of that, it's not just purchasing that tool in the first place. It's just a single use tool where you have to buy other tools. And so when I used to sell this previous, compliance automation tool, I'd sell the product. And then the customer would, try to implement the product, and they realize they have to buy an HR platform. They have to buy a performance reviews platform. They have to buy an MBM, and the list goes on and on. And that one purchase turns into seven different purchases across the board. And so that 50 k, you're paying for a compliance automation tool for the SOC two. While they may seem, you know, quick efficient on paper, it turns into a procurement process. So you're having to procure seven different vendors to do just SOC two just to make that tool that you paid for already work. And it becomes a procurement process, and then you have to set up the integrations, and then you have to actually set up the product. And then you have a single use product that just helps you become compliant in a place that doesn't hold any data. And especially for our customers in Rippling, it doesn't make sense to have your HR and IT data live in one environment and pay for another tool just to send that over, especially when it comes to controlling that information. Again, I've been a GRC manager in the past. The hardest controls to attest to and to meet the evidence requirements for are HR and IT for what it's worth because these are really fragmented options. Somebody in GRC usually doesn't have a lot of visibility to the HR space because that's just how things work. However, if you use a platform like Rippling, we give you the ability to get that data and action on that data, which we'll talk a little bit more about here in a second. And and Jefferson, before I get your reaction, Rob, kinda like what you just mentioned kinda resonated with me too. Right? Like, if you have to go out and get all those systems that you just mentioned, someone has to learn all those systems. Right? And you have to make sure that they feel comfortable navigating. And, Jefferson, you kinda spoke about it at the top of the conversation of learning Intune and all these different platforms that you may not be familiar with. Right? And that in itself Yeah. Task. Yeah. Yeah. It... It's a task, and, Angel can can respond as well. But it's a task not only for you as an individual, but it's a task on someone else's plate. And, again, like Jefferson said, when you have to spend time and use other teams to work on compliance, that just takes away time from their actual role itself. The other side of it is a lot of people don't understand the urgency. If I go to the HR team and say, like, hey. I need this performance reviewed on for SOC two. They They don't know what SOC two is, and they don't need to know what SOC two is. That's not their role. That's not their requirement. However, for us in the GRC space, it's very imperative to move that forward. Rather than sending a ticket out to somebody else and, like, pinging them every day to close the ticket so you don't get an exception on your SOC report, why not have the ability to action on that in the same place that holds the data as your SOC report? When I love... I just wanna... I loved what AJ said about, like, this culture of compliance. Right? Because what what a tool like automated compliance does inside of a platform like Rippling is it democratize... I talked about this. Like, it democratizes compliance. So now instead of every... Like, instead of me or, like, two other people in the company worrying about whether or not we're complying with SOC two and HIPAA, Now all of a sudden, it's everybody's job. Compliance becomes not just two or three people's job in our organization, but it becomes everyone's job because now everybody has visibility into it. And it doesn't become this, like, overhead thing where you have to learn about SOC two and you have to learn about HIPAA. Right? You're just doing your job, and it flows down. So that's... I think, like, that cultural piece is really important too. Yeah. I I just wanted to add, you know, Rab mentioned that, excuse me, that most of the controls that fell, you find in HR and IT. IT. And as a former auditor, we actually did, like, an assessment across, like, thousands of SOC twos, and we found the exact same thing. And I think the reason for that is not because HR or IT folks are doing the wrong thing or malicious. It's that the systems, as Rab are saying, are disconnected. So when something happens, if somebody doesn't acknowledge a policy, somebody's device isn't encrypted, just something happens, the GRC person doesn't know about it, so the audit. So they show up, and they're like, ah, why didn't you tell me? Because if we would have remediated, we would have been fine, but I didn't know until the auditor shows up. So now with Rippling, you have an early warning system. You you get... And then to Jefferson's point, because it's all integrated where people already come in and do their job and do other things, it's very easy to execute, and it's not, what it... Like, it's just not... There's so much confusion. You know? We we love our acronyms in GRC and compliance. So the people that are outside of it are like, what is going on? What are all these words? So I think the the simplification is something that I'm I'm really, loving a part of this conversation because that's what it's all about. It's like, how do we help people do the right thing that wanna do the right thing? As I always always tell my my auditors, like, these people we're working with, the HR folks, the IT folks, they want to do the right thing. They're trying to do the right thing. The problem is it's disconnected from the work that we're tech... We're looking at. So this brings it all together, which makes this stuff work very well. AJ, I had a smile, and I'm laughing because as an IT person, I'm like, not my device. My doc... One... A device under my watch cannot be encrypted. Right? Like, I'm sure you guys have heard that more times than you can probably count. But, Jefferson, to kinda to kinda round it out, you know, does this kinda... Like, everything we just spoke about, does this match what you've experienced? Was there anything that kinda, you know, surprised you maybe along the way? No. I mean, it matches our experience almost exactly, which I think is, like, why we ended here. Like, why we ended up in rippling with automated compliance is because my first question when I saw this come out when I met with Rob the first time was, why did you not make this sooner? Like, because it's been such a headache to do to do compliance with disconnected systems. And now that everything is connected, it just... It makes it... It it really has built in that culture of compliance, which is what we all talk about. And it's a dream we all have. But until you have systems that, like, support that dream, it's just a it's just a dream. And so, I mean, I just... I love every minute of being in automated compliance, which is not something I think anyone would ever say of their GRC product before. And that is purely because I know what I'm looking at. I know what needs to get done because it's right there in front of me, and I don't need to go find a bajillion different people to figure out what it needs to do. Like, it's just it tell... Like, it's just right there, heads up display, ready to go. And that, for me and for my team, is just, like, amazing. That's awesome. Jefferson, AJ, I just wanna thank you guys both for joining us. Jefferson sharing your your real life example. It's been amazing to hear, and all the work that you guys are doing at your organization, you know, we'll we'll continue to look forward for that. Yeah. Thanks for having me. Awesome. So let's see it. You know? Rab is gonna walk us through kinda an automated compliance live right now. We'll kinda touch on anything that might kinda tie back to things that Jefferson described. So grab some of the other What I'm gonna do here is demo just one of our automated compliance accounts. So give me a free... Give me a second here. And, essentially, what I'm gonna walk you guys through is our automated compliance product. Since we've talked last or over the past few months, we've made a significant amount of improvements within the product that are really gonna help our customers not only become compliant today, but remain compliant in the future as well using Rippling. And all that being said, the first big change here is that we have multiple frameworks within the product. We launched with SOC two specifically. We really wanted to have a really strong SOC two product since that's the basis for our common control framework. And on top of that, we really wanted to complete a lot of SOC twos with our customers before sending out the framework. So all that being said, we started with SOC two. We had a really successful launch thanks to customers like Jefferson, and now we've added new frameworks into the product as well. So you'll see things like HIPAA in here. You'll see things like ISO, and you'll see things like custom frameworks as well, along with other frameworks coming up soon, like ISO 42,001 and PCI and twenty seven seven zero one. And all that being said, that means you can continue to expand your compliance framework in the same place that holds your existing compliance frameworks and the data that's relevant for compliance as well. So you'll see in this demo account right now, we have both ISO and SOC two, and it's fairly easy for me to add other frameworks as well and manage multiple frameworks in one space. As you think about your compliance journey, getting a SOC two is usually the first step. And as you expand, whether that be internationally in using something like ISO or into the privacy space or The EU or something like GDPR, Ripon will continue to help you not only continue to automate that compliance for you, but but remain a consolidated solution for you as you continue to grow as a company. That being said, the other side of it is we've introduced a lot of AI features into our platform as well. And the number one feature we'd like to talk about is AI remediation, And we do this in two steps. For Rippling, when it comes to the data that we pull in as a platform, we either will pull in data externally. So think of something like AWS or GitHub and, use that to test for compliance or anything that Rippling has inherently. So think of things like our MDM product and device data or our HR product and things like policy data or training data. One of the biggest things that we built over the past few months has been the AI remediation piece. And what that looks like is this. If I come into Rippling here and I run a report on computers, and I run a report here saying that employees' devices need to have firewall enabled, and I notice the firewall is not enabled. Again, in any other platform, you would get this notification, and the best thing you could do is potentially create an automatic Jira ticket, and it would get assigned to somebody who is assigned assigned to control owner. And that's what most folks call, like, AI remediation. But that really doesn't do much. You're still just creating a ticket. You're just sending it to someone else, and that other person still has to take time out of their day to, one, open the ticket, review it, have to understand what SOC two is and what you're talking about in the first place, and then has to go into a separate system, whether that be another MTM product, another HR product, another identity product, fix that issue with the same urgency that you have, and then close out that ticket so it can be remediated within your platform. And what that means is not only do you have to take time out of your day to identify the issue and follow-up with this individual or even a team, but that other team or individual has to take time out of their busy day to fix a compliance issue that they either don't care about or they just don't know about and don't have the same urgency for. That, to me, is just way too many steps and way too many hours out of every one's day. And, again, if you have a single use compliance platform out there, one that doesn't own any data itself, that's going to be your life moving forward regardless of how many, issues pop up. In Rippling, however, because we own data inherently, because we have HR data, IT data as our first party data, not only can we provide that same report, we can actually fix those issues for you too. And so, previously, we gave you the option to fix the issues with one click. Again, we take you directly to the MDM page to set up that, like, firewall profile. But now with AI, we can actually take an AI agent to remediate that. And, again, this is unique to Rippling. Every compliance platform says they have AI agents, but only ours has the ability to actually remediate data within our own first party data because we have that data in our platform. And so not only will I get a summary of what's wrong and the guidance within the platform, can actually go ahead and investigate and actually fix that issue as well. And this is a big part of it. Again, as you, heard Jefferson say, as you heard AJ say, and you... As you've heard me say as well, we really want more ownership across compliance to generate a culture of compliance across the board. And not only do we want to have folks become compliant, we also want more ownership across the board. And so rather than me taking the time to set up a meeting with IT to talk about firewall rules and enable those firewalls and then have them have, like, create a whole project and take it around there, I can come into Rippling. I can notice that there's an issue, and I can click a button. And as you see here on the right, the AI is actually gonna go ahead and fix that for me in one space. And so, again, Rippling is always freeing people up. So... And we want people to work on their jobs. Not everyone's job is full time compliance, and nor do we want it to be. And features like this help you scale your compliance program not only from a a maturity perspective, but from a time perspective as well using less and less people so you can focus on what you wanna focus on and not just talk to. The other side of it is, again, we've expanded a lot of our AI features for things like trust centers as well. So this is a big part of it. Again, for our customers, it's... Including yourselves, like, as you get that first SOC two, the number one thing you're gonna wanna do is, like, show that and show that off for individuals. So we have a trust center within the platform that you can come in, add your frameworks to, add specific resources to, and then use as an external website for your customers to go to to do things like download that SOC report and pull in that information without them having to ask you. So not only will our products help you get that first SOC too, we'll also give you a way to externally share that, whether it be for prospective customers, current customers, and your sales team moving forward. Again, while SOC two is, like, really big for security and compliance internally, it's also really big for sales. If you've worked on a sales team or have to have support sales in the past, asking for a company SOC two is a pretty normal part of the procurement process and the security review process. Rather than having your team and your sales team have to come in, ask for the SOC report, send it over, get an NDA signed. You can actually just share this trust center with customers, and they can actually go ahead and get the SOC report themselves. And so, again, we're not just saving time for you when it comes to becoming compliant the first time. We're also saving time to continuously monitor compliance year after year, day after day, month after month, and also shortening sales cycles, which at the end of the day is a big deal, not just for you, the security team, but for the revenue of the company overall as well. In that same space, you know, you will... Like, as much as we wanna send out the SOC two to customers, you still may get questionnaires that come in. And so, again, Rippling has the ability to answer questionnaires, security questionnaires on your behalf using Rippling AI. And so you can come into, Rippling, and, again, you can upload any resources that you would want to use Rippling AI to answer questions. Again, we don't wanna make up answers on anyone's behalf. So you can come into here, either, upload previous security questionnaires or any documentation you would want to provide for a questionnaire. And then as you have requests come in, you'll see this example request here. If I click into it, you'll be able to see the questionnaire, who that's assigned to, when it was requested from, and then you'll see, like, the example RFP here. And then, again, rather than me going in and having to find the answers for these questions, whether me, like, having to reach out to my security team or my infrastructure team or my IT team, if I've gleaned these answers already, through a previous security questionnaire or through our security compliance documentation, I can just come into here, and I'll have the AI answer these questions for me. And, again, all of this here is to save you time and save you money because, again, you've done the work already. You already have the answers for a lot of these either in a previous security questionnaire or from your security compliance efforts. Rather than having everyone on your sales team have to come in and try to find this information yours... Themselves, you can just come in, upload the security questionnaire into Rippling, and it'll come in here and answer those questions for you. And it go... Again, the goal here is to make the compliance program efficient. Not only do we save you time in setting up the compliance program and getting that SOC two, as you get questionnaires, as you get requests coming down the line to show that SOC two, to show that ISO report, we will provide you the ability to do so within our platform. And then at the end of the day, again, we will not only, like, help you get that SOC two in a really efficient manner with the ability for us to add multiple frameworks within the product. We'll continue to grow with you and scale with you as well. And so Ritman as a platform isn't just here for, you know, HR or just IT or just compliance. We do everything you need to become compliant and efficient in that space. And so not only will you grow with us from an HR perspective and you'll continue to add, like, things like payroll or other features to manage your human workforce. You'll also start to manage your device workforce with Azure through the IT product, through whether it be our MDM product or our I'm product. And then automated compliance here helps show you off all of that work you've done. Not only does it take the data that you've already existed, that exists within our platform and helps you become compliant in the same platform without having to pay for a whole other tool just to become compliant. We can take that data. We can action and remediate on that on that data, which, again, no one else can in this in this space. And then, again, we can take that data and then do things like respond to questionnaires and help... And get you that external credit for a lot of these security questionnaires that come out. And so all that being said, over the last few months, you know, we've had a really exciting launch for for our automated compliance products, and we're continuing to grow. And all that being said is we'll continue to grow to make sure we can meet the needs of all of our customers moving forward as well. That's awesome. I think the thing that really resonated with me, Rob, as you were going through the demo there was as you and AJ were kinda talking about culture, and you were describing about how you get a questionnaire and you have to reach out. I remember being in that very seat and being that infrastructure guy where now I had to go, I had to go chase down multiple different people in multiple departments and say, Hey, I need you to get on board and fill out this section of the questionnaire because I'm outside of my wheelhouse. And how, you know, time consuming was that to to kinda have to do that. Right? So I love the ability to kinda be able to just bring everyone together, bring the culture together, make everyone care about the purpose, and be able to do it within the the product. That's that's really cool. And then, you know, I kinda said it earlier, but the AI remediation, I think, you know, as an IT professional, this is the direction we're going. Right? You kinda said it before. Just spinning off a ticket in another platform is an AI that's not really doing anything. And I think we can all agree as as we are sitting in our professions and and our seats, we have a job to do. And the more that we can have a AI agent take remediation on behalf of us before it becomes a problem or a ticket is such a game changer and a time saver. Yeah. And and that's really it at the end of the day. I think the number... Like, the two resources everyone cares about the most are time and money. And we wanna help solve for both so you can focus on what you need to solve for. So whether that be, again, focusing on the data that you have within our platform and saving you some money without having to purchase another platform just for this whole SOC two thing or compliance thing, or just the time it takes to remediate items. Again, it's not just the time that you have to take. It's the time that the other individuals at the company have to take just to fix an issue that maybe only you care about. And so rather than having you pay for another platform that, like, pay for another platform that may increase the amount of time and money anyway, Why not just give you a more efficient platform in the same place that holds your HR and IT data and lets people work on what they wanna do and not just compliance issues? Couldn't agree more. Rob, thank you for walking us through that. And, again, thanks to Jefferson and, AJ earlier. Really appreciate everyone's time today. Hope everyone enjoyed it. Thanks, guys. Thanks. Good afternoon, everyone. Thank you for joining today's session. We are, very excited that you joined us today. To dive in first to our q and a, let me just pull up my slides here. Awesome. We had a few questions come in during the demo session, so I will knock those out from easiest to most difficult. The first question is from Jody Page. Jody asks, does the trust center have NDA capability? And the quick answer to that is yes. Our trust center does have NDA capability. If you would like to kind of see more about that, please feel free to request a demo. The next question is from Sean Kaelber. Apologies if I mispronounced your last name there. Sean asks, how soon are you looking to add other cyber frameworks like NIST and CMMC? And the answer there is, natively, we support SOC two, ISO 2,701, and HIPAA with PCI, DSS, GDPR, ISO 4,201, and ISO twenty seven seven zero one coming December. NIST and CMMC aren't on that near term list, but you aren't blocked waiting on us. You can bring your own framework into automated compliance, your control sets, your language, your structure, and you can map it to the monitors and evidence already running in your tenant. It will behave exactly like a native framework, same automated tests, same evidence collection, same audit portal. And the cool thing is you don't have to hand build that mapping. Rippling AI does that for you, and then you can point it at the framework and the maps... And it maps the requirements to your existing controls, tells you what's already covered, and shows you the real gaps. So regardless of the framework, you can bring in custom frameworks into our system, and you don't have to hand build anything within the automated compliance platform regardless of what compliance framework you're trying to achieve. And then the last question comes from Benjamin Tim. This one is a little long. But a question for the team, when it comes to the USP of rippling when facing the potential of working with larger scale companies that have no intention of centralizing its tooling system, What differentiates you from other companies such as Vanta, Drata, and other players in the market when it comes to the actual automated compliance functionality within the platform? This is a very good question, Ben, Benjamin. So thank you for asking. Vanta and Gerata connect your tools from the outside and ask each tool for a snapshot. Rippling is your system of record for people, devices, and access, so the evidence isn't collected. It's already there. We don't pull an HRIS to learn about a termination twenty four hours later. We run the termination. On the decentralized customer specifically, there's three things there. We don't require centralization. You bring everything in. The compliance later... Layer reads from whatever you're already running. We don't force you into our framework. Most platforms will hand you their control set and make you map your program to it. We go the other direction, your framework, your controls, your structure, and we map to it using Rippling AI. And then, where you do run something on Rippling, the automation is a different class. Not that we checked and it looks fine, but the control is actually executing itself. Access reviews, off live role data, offboarding evidence produced by the offboarding. So, ultimately, every every solution right now automates the evidence assessment, but where we differentiate is we automate the control. The number we hold ourselves to is zero touch rate. The share of controls that stay compliant with no human in the loop because that's what actually predicts how much of your quarter an audit eats. So, if there's no more questions coming, please feel free to throw any additional ones in the q and a there. In short, ripping automated compliance cuts down on the manual work of compliance with AI built in at every stage before, during, and after the audit. So if you're in a pre audit stage and you need to do a SOC two or an ISO 2,700, but you don't want to go through all the upfront work to set those up, that's where we have you covered. Ripley AI can guide you through the setup and allow you to self serve, regardless of the process that you're trying to, be compliant with. From the intra audit process, say you need to resolve compliance gaps before they slow down your audit, we got you covered there as well. Ripley AI will surface open tasks and help admins move through remediation so your evidence is audit ready. And last here in your post audit process, say you have prospects that keep emailing for a SOC two report, and every deal cycle, you're answering the same question over and over again. As we heard, we've got our handy dandy trust center there. So everything will be mapped out as you want to share that evidence so you won't have to deal with those annoying compliance headaches. As a marketer, I've dealt with RFP proposals in the past. This is something that I had to deal with time in and time out in the compliance and GRC space. So it's very cool that we have this trust center built out as part of our tool. It would have saved me hours and hours on the marketing side. I can't imagine what it's going to do for the rest of you all as you try and grow your businesses. And as I know a lot of you hang out here until the end and join us for these sweepstakes giveaways. Either way, we hope you are walking away with new knowledge about rippling IT, any IT best practices, and for today's session, better ways to cover compliance now and in the future. A little bit of a drum roll if you guys wanna drum along, but the gift card winner today for the $500 Mastercard gift card is Zena Piber Piber, p I b e r, who is the director of technology at Base Powers. So congratulations, Zena. Thank you so much for joining us today. To everyone else, we are really appreciative of you joining our sessions. We've got a fun one coming up on 11/18 that will be in partnership with CrowdStrike, so please look out for an email invite for that or anywhere on social media. We will also be promoting it, but we hope to see you for future sessions. And, I'm going to launch a quick survey. So please give us any sort of feedback. Let us know any topics you wanna see in the future. Very important to me, if you want to see a demo of the product, let us know in that survey. Hit that book a demo button at the top of your screen or click one of the links, in the docs tab. We would love to connect with you in person to kind of walk you through a personalized instance of automated compliance or rippling help desk to show you how rippling IT can help your IT stack. And with that, we will see you at a later session. Thank you, and have a great Halloween, everyone.