Series A–C B2B SaaS selling into mid-market and enterprise

Research {{company}} and produce a SOC 2 readiness brief.

Inputs:
- Website: {{website}}
- Recent funding (if known): {{funding}}
- Target buyer segment (if known): {{buyer_segment}}

Find and synthesize from public sources:

1. Stage signals
   - Funding rounds, headcount range, hiring pace (LinkedIn).
   - Customer segments named on their site — call out any regulated buyers (banks, payers, federal, education).

2. Existing trust posture
   - Is there a /trust, /security, or /legal page? Does it mention SOC 2, ISO 27001, HIPAA, PCI?
   - Public penetration test summaries or bug-bounty programs.

3. Tech stack inference
   - Cloud (AWS, GCP, Azure) — guess from job postings.
   - Identity (Okta, Auth0, Workforce, custom).
   - Source control & CI (GitHub, GitLab, CircleCI, Buildkite).
   - Observability (Datadog, Honeycomb, New Relic, Grafana).
   - Data stores (Snowflake, BigQuery, RDS, Mongo, ClickHouse).

4. Security org
   - Is there a Head of Security yet? VP Security? GRC manager? CISO?
   - Recent hires in security or compliance roles in the last 6 months.

5. Trigger surface
   - Recent enterprise customer wins (case studies, logos page).
   - Job postings mentioning "SOC 2," "compliance," "security questionnaires."
   - Public mentions of lost deals or RFP pain.

6. Outreach hook
   - One sentence connecting a specific trigger to the Opsfolio SOC 2 readiness assessment.

Return as markdown. Cite every external claim with the source URL.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Build a list of 25 B2B SaaS companies that are likely 90–180 days from needing a SOC 2 Type II.

Filters:
- HQ: US (or UK selling US)
- Funding: Series A or B in the last 18 months
- Headcount: 25–250
- Sells to mid-market or enterprise (signal: case studies featuring buyers ≥1,000 employees, or buyers in fintech / healthtech / govtech)
- NO existing SOC 2 Type II on their /trust or /security page
- AT LEAST one of:
   - Posted a "Head of Security," "GRC," or "Security Engineer" role in last 90 days
   - Hired a VP Sales targeting enterprise in last 90 days
   - Public mention of moving upmarket

Return as a table:
| Company | Funding stage | Last raise | Headcount | Sells to | Existing SOC 2? | Recent security hire? | CTO / Founder LinkedIn | Best opening hook |

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Write a 3-touch outbound sequence to {{first_name}} ({{title}} at {{company}}).

Context:
- {{company}} is a {{stage}} B2B SaaS selling into {{buyer_segment}}.
- Trigger: {{trigger_event}} (e.g. "just raised a $20M Series B," "posted a Head of Security role last week," "case study with [enterprise customer] dropped Monday").
- They likely do NOT have a current SOC 2 Type II.
- Sender: {{partner_name}}, {{partner_company}}.

Constraints:
- Touch 1: ≤100 words. Lead with the trigger. Bridge to "the deal where security review eats six weeks." Soft CTA = quick reply.
- Touch 2 (day 4): ≤70 words. Reference a specific failure pattern (e.g. CC6.1 logical access for first-time audits).
- Touch 3 (day 9): ≤40 words. Break-up.
- No "I hope this finds you well." No "circling back."
- CTA: {{affiliate_link}} for a self-service readiness check.

Return three labeled blocks: SUBJECT + BODY each.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Draft a LinkedIn outbound cadence to {{first_name}} ({{title}} at {{company}}).

1. Connection note (≤300 chars). Reference a specific public artifact: a post they wrote, a podcast they were on, a hire they made, or a customer they landed. Zero pitch.
2. Day-2 DM (≤500 chars): one specific observation about their security posture or their buyer base + a single open question.
3. Day-6 DM (≤300 chars): share {{affiliate_link}} framed as "a 1-hour TSC mapping, not a sales call."
4. Day-13 DM (≤200 chars): polite break-up, leave the door open.

Voice: peer founder / security leader. Reference TSC categories (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P) where natural. No buzzwords.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

Build a 20-minute discovery call script for {{first_name}} ({{title}} at {{company}}).

Sections:
1. Open (90 sec): confirm time, restate hypothesis ("you're being asked for SOC 2 in security reviews and the existing tooling assumes you know your gap"), ask permission for 6 questions.
2. Six qualifying questions:
   - How many open security questionnaires are sitting in your sales pipeline right now?
   - What's the largest deal currently blocked by 'we need a SOC 2'?
   - Type I, Type II, or both — what's the buyer-side request?
   - Have you scoped which TSC categories apply yet, or is it still 'all of them'?
   - Are you running Vanta / Drata / Secureframe today, or evaluating?
   - Do you have an audit firm selected, and is there an observation window committed?
3. Bridge (2 min): map their answers to the self-service readiness assessment.
4. Close: book a working session OR send the {{affiliate_link}}.

Include branching: if they already have a Type II in progress with <2 months to report date, downgrade to "renewal prep" framing.

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.

You are a former SOC 2 audit partner responding to {{first_name}} ({{title}} at {{company}}).

They said:

"{{objection}}"

Reply in 3–5 sentences. Rules:
- Mirror their language first.
- Cite AICPA Trust Services Criteria categories (CC, A, C, PI, P) or specific criteria (e.g. CC6.1, CC7.2) when relevant.
- Reference SSAE 18 / SSAE 21 only when accurate.
- End with a forward-moving question, not a pitch.
- Never sound defensive. Never say "actually."

Rules:
- Be concrete and specific to {{company}}; no generic compliance fluff.
- Cite the regulation by section number where relevant.
- If you don't know, say so — do not invent contract numbers, names, or dates.