Digital Health Vendor: SOC 2 + HITRUST in 9 Months

Series B due diligence at Pinedale Health surfaced a compliance gap. The lead investor wouldn't close until SOC 2 + HITRUST were on a defined timeline. The internal estimate was 18 months. The investor wanted 12.

Business Challenges

The due-diligence finding from the Series B lead investor at Pinedale Health arrived in March 2025. The investor's technical-diligence team had reviewed Pinedale's security posture and surfaced a specific concern: 14 enterprise customers worth $4.2M in stalled ARR were waiting for SOC 2 Type II and HITRUST CSF certification before contract signature. The investor's investment thesis assumed those contracts would close in the first 12 months post-Series B. The compliance gap was a thesis-blocking issue.

The investor's diligence team gave Pinedale's CEO, Aisha Tomberlin, a specific framework: the Series B would close on contracted terms if Pinedale produced a credible 12-month plan for dual SOC 2 + HITRUST certification. The plan had to be specific — vendor partner, work-plan, milestone schedule, evidence collection cadence. Pinedale's internal estimate for the same work was 18 months. The CEO had 30 days to produce a plan that the investor would accept.

Supporting operational reality was difficult. Pinedale had no compliance-specific staffing — security work was done by two engineers part-time. Control framework mapping was being done in spreadsheets by a single senior engineer in his weekends. Evidence collection ran via Slack and email; audit-readiness was impossible to gauge in real time. The incident-response process existed in policy but not in runbook form. Building the certification work-plan against this baseline within 12 months was operationally implausible without a structural change.

• Series B due diligence surfaced a thesis-blocking compliance gap; lead investor required a 12-month plan for SOC 2 Type II + HITRUST CSF certification.
• The internal estimate was 18 months for dual certification; the investor wanted 12.
• $4.2M ARR was stalled with 14 enterprise customers waiting for certification.
• Control framework mapping was being done in spreadsheets by 2 part-time engineers; evidence collection ran via Slack and email.
• Incident-response processes existed in policy but not in operational runbook form; audit-readiness was impossible to gauge in real time.

Solution

Aisha's procurement compressed to two weeks. The Series B timeline forced it. The selection criterion was specific: which vendor could credibly commit to a 7-month timeline for SOC 2 Type II + HITRUST CSF dual certification with Pinedale's existing engineering team carrying minimal additional load?

eCareComply's compliance-as-platform engagement model was selected after a deep evaluation conversation. The platform automated 70%+ of the evidence-collection burden through direct integrations with Pinedale's existing infrastructure (AWS, GitHub, Slack, JIRA, Okta). Control implementations were tracked continuously rather than assembled retrospectively at audit time. Incident-response runbooks were operationalized into the platform's automation infrastructure. The combined platform-and-services engagement produced an operational compliance posture rather than just a certification deliverable.

The selection moment came during a reference call with another Series B digital-health company that had completed dual certification through eCareComply in 7.5 months. The reference CEO told Aisha specifically what the engagement required from Pinedale's engineering team (approximately 8% of total engineering hours over the certification period) and what the engagement freed Pinedale from (the internal-team time that would have otherwise been consumed). The reference's framing was direct: “Outsourcing this work was the right call for us. Engineering capacity was the asset we couldn't afford to consume.”

Value Delivered

The dual certification was completed in 9 months — 5 months ahead of the investor's 12-month requirement and 11 months ahead of the internal 18-month estimate. The Series B closed on contracted terms within 60 days of the certification plan being accepted by the investor. The 14 stalled enterprise customers closed contracts over the 8 months following certification.

• SOC 2 Type II + HITRUST CSF certification in 9 months (vs 18-month internal estimate, 12-month investor requirement).
• $4.2M stalled enterprise ARR unblocked; 14 of the 14 stalled customers closed contracts within the year following certification.
• 100% control coverage with automated evidence collection — evidence is continuously current rather than assembled at audit time.
• Tested incident response runbooks across 4 scenarios; the runbooks are operational rather than theoretical.
• Auditor-ready portal cut audit time 62% compared to comparable digital-health audits.

Solution Provided

The engagement ran 30 weeks (9 months). The work was tightly scoped against the certification deliverables. eCareComply's compliance services team operated as Pinedale's compliance function for the duration; Pinedale's engineering team continued building products.

Weeks 1–6: Control Framework Mapping and Gap Analysis

The first six weeks were the structural compliance build. eCareComply's compliance services team mapped Pinedale's current state against the SOC 2 trust services criteria and HITRUST CSF control framework. The output was a documented gap analysis: which controls were already in place, which needed implementation, which needed policy work, and which needed operational evidence collection to be instrumented. The gap analysis became the work-plan.

Weeks 7–14: Control Implementation

The control implementation phase ran 8 weeks. eCareComply's compliance team executed the policy work, the runbook development, and the workforce training. Pinedale's engineering team provided technical context and reviewed implementations; the engineering load was tracked against the budget commitment Aisha had made to the engineering leadership.

Weeks 15–22: Evidence Collection Instrumentation

The evidence collection automation went live across Pinedale's infrastructure. Control evidence began flowing continuously into the eCareComply platform. By week 22, the platform had approximately 6 months of continuous evidence for each in-scope control — sufficient for the Type II audit window.

Weeks 23–26: Audit Preparation and Pre-Audit Review

The audit prep phase ran 4 weeks. eCareComply's compliance services team produced the audit narrative documents, the control evidence packages, and the auditor portal access. A pre-audit dry run with an external compliance consultant validated audit readiness.

Weeks 27–30: SOC 2 Type II + HITRUST CSF Audits

The audits ran sequentially. SOC 2 Type II audit completed in week 28 with a clean opinion. HITRUST CSF assessment completed in week 30 with full certification. Pinedale received both certificates within the 7-month timeline.

Business Value

Aisha presented the engagement results to Pinedale's board in fall 2025. The framing was that compliance had moved from being a thesis-blocking risk to being a competitive asset.

What the engagement preserved at the company level

The Series B closed on contracted terms. The $4.2M in stalled ARR closed over the following year. The enterprise customers who had been holding open deals were not lost to competitor processes during the 7-month certification period. The combined preserved value substantially exceeded the engagement cost.

What changed about Pinedale's go-to-market posture

The SOC 2 + HITRUST certifications have become a sales asset rather than a sales-blocking absence. Pinedale's enterprise sales team now leads with the certification posture in early-stage conversations. Subsequent enterprise customers have specifically cited the dual certification as a primary selection factor. The competitive position has shifted; Pinedale is now a credible enterprise-tier vendor rather than a Series B startup carrying compliance risk.

The financial picture

The $4.2M stalled ARR unblock is the immediate financial impact. The deferred internal-team load (the engineering hours that would have been consumed building compliance internally) represents approximately $1.4M in preserved engineering capacity. The closing of subsequent enterprise customers driven by the certification posture has produced additional ARR; Aisha estimates approximately $2.8M in incremental customer acquisitions attributable to the certification position. Total financial impact in the first year: approximately $8.4M against a $640K engagement cost.

What changed about the compliance function

Compliance at Pinedale is now an operational discipline maintained through the eCareComply platform. The company has not hired internal compliance staff; the function continues to be managed through the platform-and-services partnership. Subsequent certification cycles (annual SOC 2 Type II renewals, HITRUST CSF surveillance audits) have run on the operational infrastructure built during the initial engagement.

What Aisha said publicly

“The Series B due-diligence finding was the gift. Without that forcing function, we would have continued treating compliance as something to do later. The investor's pressure produced the alignment to invest at a level that fundamentally changed our enterprise-readiness. The platform was the operational vehicle. The decision to invest at the deadline rather than negotiate the timeline was the most important call our leadership team made that year.”

— Aisha Tomberlin, CEO, Pinedale Health