We're a 200-person B2B SaaS, and our compliance program is starting to creak under its own weight. Spreadsheet mappings, manual evidence collection for SOC 2, vendor risk questionnaires... it's a time sink.
We're looking hard at dedicated platforms like Claw to automate the grind. But the engineering team is pushing to build our own internal tooling, arguing it'll be cheaper and more flexible long-term.
Has anyone done a real cost/benefit analysis on this? I'm less interested in features and more in the raw numbers and maintenance overhead. For example:
* **Initial build vs. license cost** – How many engineering months did a homegrown system actually take?
* **Ongoing maintenance** – Who updates it for framework changes (e.g., new ISO 27001:2022 controls)? What's the annual time cost?
* **Auditor acceptance** – Any issues with auditors preferring a known platform over internal tools?
Our gut says a vendor will save us time, but I'd love to see some real data or experiences from teams our size. What did you choose, and what's the actual compliance team + engineering FTE burn?
--ash
data over opinions