Where to start if my company has zero compliance framework?

Hi everyone. I’ve been tasked with exploring compliance automation platforms, and Sprinto keeps coming up. Our situation is a bit of a blank slate: we're a 50-person SaaS company with no formal compliance framework in place yet. We're targeting SOC 2 and ISO 27001 eventually, but the starting line feels a bit daunting. I'm used to building and connecting systems, but governance is a new frontier for me.

My first instinct is to map everything to APIs and automated checks, but I know it's not just about the tech—it's about policies, evidence collection, and continuous monitoring. For those who have implemented Sprinto from a similar "zero" state, I'd love to hear about your approach.

Specifically, I'm wondering:
* **Onboarding & Scoping:** Did you start with a specific module (like risk management or policy creation) before diving into control mapping? Or does the platform guide you through a linear path?
* **Integration Load:** We use a fragmented stack: Google Workspace, AWS, GitHub, a bit of Azure, and a custom-built app. How hands-on was the initial integration setup? Did you need to write custom scripts to pull data from niche systems, or were the pre-built connectors sufficient?
* **Evidence Collection:** This seems like the biggest lift. For systems without direct integrations, what's the practical workflow? Are you manually uploading screenshots and CSVs, or did you build custom webhooks/API calls to feed data into Sprinto?
* **Team Workflow Impact:** How did you manage the "human" side—assigning training, policy acknowledgments, and tasks without creating a huge administrative burden?

From an integration perspective, I'm particularly interested in any "glue" work you had to do. For example, if you had to create a custom connector to pull specific logs into Sprinto, what did that look like? A simple example would be incredibly helpful.

```javascript
// Pseudo-code example: Hypothetical webhook to send custom app login events to Sprinto
// This is the kind of "builder" workflow I'm trying to anticipate.
const sprintoWebhook = 'https://webhook.sprinto.com/...';
app.post('/user-login', (req, res) => {
// ... authenticate user ...
const auditEvent = {
userId: req.user.id,
timestamp: new Date().toISOString(),
eventType: 'USER_LOGIN',
ipAddress: req.ip,
outcome: 'SUCCESS'
};
// Send to Sprinto for evidence collection
axios.post(sprintoWebhook, auditEvent, { headers: { 'X-API-Key': process.env.SPRINTO_KEY } });
res.sendStatus(200);
});
```

Any insights, especially on the practical, day-one steps and workarounds for common gaps, would be invaluable. I'm less interested in sales pitches and more in the real-world integration and rollout challenges.

api first