Spire

Spire is an AI-powered compliance automation platform for B2B SaaS companies that need SOC 2 Type II certification and EU AI Act readiness to close enterprise deals. It replaces the manual, spreadsheet-driven audit preparation process with continuous evidence collection, automated control evaluation, and AI-driven security questionnaire responses. How it works: Spire connects to your existing infrastructure via 9 read-only API integrations — AWS, GitHub, Google Cloud, Vercel, Cloudflare, Clerk, Supabase, Stripe, and Resend. Each integration collects evidence mapped to specific SOC 2 trust service criteria and EU AI Act articles on a recurring schedule. The GitHub integration retrieves branch protection rules (CC6.1), pull request review requirements (CC6.1), secret scanning alerts (CC7.2), and organization membership changes (CC6.3). The AWS integration pulls CloudTrail logs, IAM configurations, S3 bucket policies, EC2 security group rules, and KMS key rotation status. All evidence is timestamped, cryptographically verified, and stored in an evidence library that's ready for auditor review. AI compliance agent: Unlike traditional platforms that only collect evidence, Spire includes an AI agent that performs on-demand audit readiness assessments. The agent evaluates collected evidence against all applicable controls — covering SOC 2 Common Criteria and EU AI Act Articles 4, 50, 52, 53, and 55 — and produces a structured audit report with pass/fail verdicts per control, evidence citations explaining each verdict, and remediation recommendations. This turns audit readiness from a quarterly manual review into an on-demand automated process. Security questionnaire automation: Upload a vendor security questionnaire in any format (PDF, DOCX, CSV, markdown, HTML, or plain text). Spire's AI maps each question to the relevant evidence in your library and generates a response. Each answer is scored by confidence (0–100%), supporting evidence is attached automatically, and only uncertain answers are flagged for human review. A typical 200-question enterprise questionnaire drops from 40 engineering hours to under 4 hours. Audit-ready evidence export: Generate structured compliance evidence packs for SOC 2 and the EU AI Act in one click. Evidence is organized by control, timestamped with source system attribution, and ready for auditor or procurement review. Supported frameworks: - SOC 2 Type II (all five trust service criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy) - EU AI Act (Article 4 AI literacy, Article 50 transparency, high-risk classification, GPAI Code of Practice) - ISO 42001 AI management system governance alignment Integrations: AWS (CloudTrail, Config, IAM, S3, EC2, KMS, GuardDuty), GitHub (branch protection, PR reviews, secret scanning, code scanning, Dependabot), Google Cloud (IAM, audit logs, encryption), Vercel (deployments, environment variables), Cloudflare (WAF, SSL, DNS, DDoS), Clerk (MFA, sessions, users), Supabase (RLS, encryption, auth), Stripe (PCI compliance, data retention), Resend (email encryption, DMARC). Pricing: - Starter: £200/month — 3 integrations, core evidence collection, AI compliance agent, 5 questionnaire auto-fills - Growth: £1,200/month — 10 integrations, unlimited questionnaire auto-fills, team member invitations, priority support - Enterprise: £3,000/month — unlimited integrations, dedicated support, custom onboarding Target customers: B2B SaaS companies with 10–200 employees (Seed through Series C) that sell to enterprise customers and need SOC 2 certification to close deals. Primary users are CTOs, VPs of Engineering, and compliance leads who own security reviews and procurement questionnaires. Competitive differentiation: - AI compliance agent performs on-demand audits with structured pass/fail verdicts (no other platform offers this) - Native EU AI Act coverage alongside SOC 2 (competitors have roadmap or partial support only) - AI questionnaire automation included at every tier (competitors charge as paid add-on) - Transparent pricing with no sales call required - 60-second setup for standard stacks (AWS + GitHub + Google Workspace) Security (Spire's own infrastructure): - Runs on Cloudflare Workers edge network with Neon PostgreSQL (AWS-hosted) - AES-256 encryption at rest, TLS 1.3 in transit - Zero data retention with AI model providers - DPA and subprocessor list available on request