The Cardboard in the Window
What a Los Angeles health inspector can teach you about the compliance industry
In January 1998, Los Angeles County started making restaurants tape a piece of cardboard to their front window.
The cardboard had a letter on it. A, B, or C. It came from a health inspector who had walked the kitchen, looked in the walk-in, checked the temperature of the cold line, and assigned a score. There was no app. There was no dashboard. There was a letter, printed large enough to read from the sidewalk, and a county ordinance that said you could not take it down.
What happened next has been studied for a quarter century. Restaurant hygiene scores went up. Revenue at A-grade restaurants went up, and revenue at C-grade restaurants went down, which meant that for the first time the kitchen had a financial reason to care about the walk-in. Researchers at Stanford and Maryland estimated that foodborne illness hospitalizations in the county fell by roughly 13 percent in the year after the program started. That last number has been contested by other economists since, and reasonable people still argue about the size of the effect. Nobody argues about the direction. A piece of cardboard changed how thousands of kitchens ran.
Now ask the interesting question. Why did it work?
Not because the letter was informative in some abstract sense. It worked because of who wrote it. The inspector did not work for the restaurant. The inspector could not be persuaded, upsold, or retained on a monthly plan. The restaurant could not print its own card.
That is the whole mechanism. A signal is worth exactly what it costs to fake.
Economists have known this for fifty years. George Akerlof won a Nobel Prize for pointing out that when buyers cannot tell good from bad, the market fills with bad, because the bad is cheaper to produce and looks identical from the outside. Michael Spence won the same prize for the other half of it: the only signals that carry information are the ones that are expensive to produce if you are lying.
Hold that thought, because it is about to explain something uncomfortable about your SOC 2 report.
Your SOC 2 report is a piece of cardboard in a window
Every founder who has been through an enterprise security review understands the transaction, even if nobody says it out loud.
The buyer cannot inspect your kitchen. They cannot read your Terraform, interview your engineers, or sit in on your incident retro. So they ask for a letter from someone who did. The report goes in the window. Procurement moves the deal forward. Everybody gets on with their lives.
The report was never valuable in itself. It was valuable because it was supposed to be hard to get without actually being secure.
So what happens to a market when that stops being true?
The tenth that got cheap
Here is the part of the story that looks like progress, and mostly is.
Ten years ago, the expensive part of compliance was collection. Somebody had to go get the screenshots. Somebody had to prove that MFA was on, that offboarding happened within a day, that the backup restored. It was a folder, a spreadsheet, and an intern who hated their life.
That problem got solved. Then it got solved again, by a dozen companies, with the same architecture. Connect your cloud. Connect your identity provider. Connect the repo and the ticketing system. Watch the red items turn green. The demos are interchangeable now because the capability underneath them is interchangeable. It is a commodity, and commodity is not an insult. It is a description of a market where the thing is available everywhere at a converging price and no longer tells you who to buy from.
But look at what got commoditized, and look at what did not.
Evidence collection is roughly a tenth of a compliance program. The other nine tenths is deciding which controls you actually need. Designing them so they work operationally instead of merely photographing well. Writing the policies and keeping them true. Running a risk register somebody with judgment has actually read. Access reviews with complete populations, because an incomplete population makes the sample meaningless. Vendor reviews, incident drills, continuity tests, each on a schedule with a trail. Testing whether the evidence you collected is sufficient and current. Then surviving an auditor who is paid to be skeptical.
The tenth got automated and cheap. The nine tenths stayed human and expensive. And the industry, facing that gap, made a choice. It sold the tenth, priced it aggressively, and handed the customer the rest with a dashboard and an encouraging tone.
Which is how you end up with founders acting as the systems integrator on their own compliance program, at the precise moment in their company’s life when they have the least capacity to be one.
March 2026
You know where this goes.
In March 2026, an anonymous account published a long, detailed set of allegations about Delve, a well funded compliance startup with a thousand customers and a $300 million valuation. The allegations claimed audit conclusions were pre-generated before evidence was reviewed, that hundreds of reports were near-identical, and that evidence had been produced for processes that never happened. Delve denied the claims and said it does not conduct audits or issue reports at all. Parts of the accusation remain unproven and disputed.
What is not disputed is the aftermath. Y Combinator removed the company from its directory and asked it to leave. An investor quietly pulled down its own post about the investment. Named customers paid to be examined again by independent firms. One of them, LiteLLM, had malware planted in its open source code. Another, Context AI, disclosed a security incident that led to a breach at Vercel.
Sit with that last sentence for a second. Companies displaying valid-looking certifications got breached anyway, and their customers inherited the consequences.
I want to be careful here, because the easy version of this story is the wrong one. The easy version is that one company behaved badly and the rest of us are fine. Any market can produce an outlier. That is not news, and it is not an argument.
The real story is what the episode taught everybody watching. It taught enterprise buyers that a certificate is only worth the program behind it. It taught auditors that their independence is the entire product. It taught investors doing technical diligence to ask a second question after the first one. And it taught a lot of founders that the artifact they bought to unblock a deal might be the thing that loses them the next one.
The cardboard in the window turned out, in some number of cases, to have been printed by the restaurant.
The industry that discount compliance built
Once you see the signaling problem, you can see the business model that grew on top of it, and why it is now on a clock.
An entire tier of this market was priced on an assumption nobody wrote down: that the program behind the certificate did not really have to be there. Cheap tooling, a fast certification, an audit firm doing volume, and a buyer whose procurement checklist only required the document to exist. Every party in that chain had a reason to be satisfied. None of them had a reason to look closely.
Get Shashank Tiwari’s stories in your inbox
Join Medium for free to get updates from this writer.
That works right up until the moment the market gets a public demonstration of what a hollow certificate is worth. Then the buyers start looking closely, and looking closely is the one thing the discount model cannot survive, because the discount was never a pricing innovation. It was a scope reduction that the customer could not see.
I do not think this ends with regulation or with some dramatic reckoning. I think it ends the way these things usually end. Diligence questions get harder. Trust pages start getting read instead of glanced at. A few large buyers start asking who prepared the evidence and who examined it, and whether those two parties have any financial relationship. And a business model that depended on nobody asking simply stops working.
What is actually hard
If collection is commoditized and paperwork is losing its value, what is left is the thing that was always hard, and it deserves a better name than compliance.
Think of it as engineering. A control has an owner, a frequency, a test procedure, and a failure mode, exactly like a service in production. A policy has a lifecycle and a version. A risk has a treatment plan and a date. Evidence has a freshness requirement, and stale evidence is a defect rather than a warning. Populations are complete or the sample proves nothing.
Nobody sold this to startups before for a reason that has nothing to do with ambition. It takes senior people, and senior people cost more per year than a seed-stage company was ever going to spend on compliance. The market sold what it could afford to deliver.
The part where AI actually matters, stated honestly
Here is the argument for agents, and it is narrower and more boring than the marketing you have seen.
Agents do not make compliance disappear. They make the nine tenths affordable.
An agent can hold a control library across every framework in scope and keep it harmonized, so one piece of evidence answers to many requirements. It can draft and version a policy set against your actual architecture. It can run collection continuously and then do the part collection tools skip, which is testing whether what came back is sufficient and whether the population is complete. It can assemble workpapers, find the gaps before the auditor does, and answer a security questionnaire from live control state with a citation pointing at the evidence behind each answer.
That is a junior GRC team’s entire workload, running continuously, at a marginal cost that does not scale with headcount.
And that changes the shape of what a vendor can sell you. When the work is performed by a system instead of billed by the hour, the vendor can stop selling tooling and start owning the outcome. Owning an outcome is not a tagline. It means a named person is accountable for you passing. It means the penetration test is inside the scope instead of on a separate invoice. It means the answer to “who is doing this” is not “you are.”
One caveat, and it is the important one. The Delve episode gets read in some quarters as an indictment of AI in compliance. It is the opposite. The allegation was never that agents did too much of the work. It was that the work got skipped and the artifacts appeared anyway. Automation that produces evidence is worth exactly as much as the design and testing wrapped around it. Agents, plus real engineering, plus an auditor who is genuinely independent of both. Any two of those three is a story waiting to break.
Four questions
If you are buying compliance in the next twelve months, ask these out loud and watch what happens.
- Who designs the program? If the answer is a dashboard of tasks, you are the designer, and you are paying someone else for the privilege.
- Who owns the outcome? Ask specifically what happens if you fail. A tool has no answer to this question. A program does.
- Where does the auditor come from? The right answer is that you select and contract them directly and your vendor takes nothing from them. Anything that blurs the line between the party preparing evidence and the party examining it is the exact structure that just failed in public.
- Is the evidence tested, or only collected? Sufficiency, completeness, and freshness are not the same thing as a green checkmark, and only one of them survives fieldwork.
Why we built Compliance Launchpad the way we did
Those four questions are the design spec, more than any product roadmap was.
One engagement covers the program design, the control set, the automation, the independent penetration testing, the auditor liaison, and the certification at the end. One published annual fee rather than a quote shaped by how badly you need it. Unlimited frameworks mapped onto a single harmonized control set, so the second certification is an addition instead of a rebuild. The auditor stays independent, selected and contracted by you, because a conflicted opinion is worth nothing the moment anyone looks at it. And a named lead carries the outcome, with agents doing the volume of work that made this unaffordable at your stage until about now.
We run our own program on the same platform. SOC 2 Type II and TX-RAMP Level 2 today, ISO 27001 underway. Our own first customer, our own evidence, examined by auditors we do not control.
The last thing
Nobody ever chose a restaurant because of the letter in the window. They chose it because they wanted dinner and they did not want to spend the next day regretting it. The cardboard was never the product. It was a promise that somebody with no stake in the answer had already checked.
Your enterprise buyer is not asking for a SOC 2 report because they enjoy PDFs. They are asking because they are about to bet part of their business on you, and they want to be right about it.
Build the program so they are right. The certificate will follow, and it will be worth something, which is more than a lot of certificates can say this year.
Sources and further reading
- Ginger Zhe Jin and Phillip Leslie, The Effect of Information on Product Quality: Evidence from Restaurant Hygiene Grade Cards, and the follow-up study in the Journal of Environmental Health
- Stanford RegLab, a response contesting the hospitalization estimate
- TechCrunch, Another customer of troubled startup Delve suffered a big security incident
- Inc., The Delve scandal
- Evan Epstein, When the compliance company becomes the governance story
