Aegis / Nimbus Platform - Comply v2 Preview

Yeah that was — that was a long time coming, honestly. It opens up a whole new set of customers for us in the financial services space, which is exciting but also, you know, comes with its own compliance headaches, which is actually very relevant to why we're here today.

Oh perfect, yeah that's a great segue actually. So, um, the whole reason I wanted to get this call on the books is that we've got Comply v2 going GA on April seventh — so like a week from today — and I really wanted to get you guys in front of it early, kind of a sneak peek before the broader announcement goes out.

Yeah I appreciate that. And honestly, the timing is — it's almost too good, like we were literally in a board meeting two days ago where our CFO was asking about our compliance posture going into Q2 and I didn't have a great answer for him on the reporting side.

Okay so let's fix that. Let me share my screen here and I'll walk you through what we've built — and Keith feel free to just interrupt me whenever, this is not meant to be a one-way demo.

Perfect, that's exactly what I want. Okay so, uh, you can see the new dashboard here — and the biggest headline with v2 is the on-demand reporting engine. So previously, as you know, generating a SOC 2 report was kind of this... painful, manual export process. That's gone.

Okay yeah because I remember when we went through our last SOC 2 audit and my team spent like three days just pulling data together. Three days. That's not a compliance process, that's just suffering.

-1Frustrated about the three days spent pulling SOC 2 data in a past audit. · compliance reporting

Ha — yeah, suffering is a good word for it. So what you're looking at now is — you click here, select your framework, and the report generates. Full audit-ready SOC 2 report, on demand.

Wait, how long does that actually take? Like when you click generate, what's the — what's the actual wait time?

+1Calls the four-minutes-versus-three-days difference meaningful. · compliance reporting

So it depends on the size of your environment, but in our testing with accounts similar to Nimbus in terms of scale, we're seeing somewhere between, uh, ninety seconds and about four minutes for a full SOC 2 Type II report.

Right? And it's not just SOC 2 — so v2 launches with multi-framework support out of the gate. You've got SOC 2, PCI DSS, HIPAA, and ISO 27001 all in the same interface. And given what you just said about financial services customers, PCI DSS is probably relevant now in a way it maybe wasn't six months ago.

That is — yeah, that is extremely relevant. We've been kind of, um, putting off the PCI conversation internally because nobody wanted to deal with the overhead of standing up a whole new reporting workflow. If this just... works, that changes the conversation completely.

+1Enthusiastic that the new reporting workflow changes the PCI conversation. · compliance reporting

Okay I need to send this recording to my head of security engineering because he has been building, like, a custom internal tool to do exactly this and I think I just saved him about three months of work.

+2Says the tool just saved his head of security engineering three months of work. · compliance reporting

So this is a SOC 2 Type II sample — you can see the trust service criteria on the left, the controls mapped to each one, and then for each control there's a linked evidence section that pulls directly from your Aegis environment. So like here, for availability, it's pulling in the uptime data, the incident logs, backup verification records from Protect — it all connects.

The cross-module data pull is — that's actually huge. Because right now we're stitching that together manually across three different tools and it's — it's a mess. Having it come out of a single platform is a massive operational improvement.

+1Calls the cross-module data pull a 'massive operational improvement.' · product capability

Yep, and that's really the power of having Protect and Comply sitting in the same ecosystem. Um, I want to ask you something actually — you mentioned you're also using Detect, right? Are you on the full suite or just Protect and Comply?

We're on Protect, Comply, and Detect. We're not on Identity yet — that's actually something we've been evaluating but haven't pulled the trigger on.

Got it, okay. I'll put a pin in Identity for now. But the reason I ask about Detect is — and this is something I wanted to mention — Detect also feeds into the compliance reports in v2. So your threat monitoring data, your detection events, your incident response logs — those surface in the relevant control sections automatically.

Exactly. You don't have to go pull it separately, it's baked in. Now — and I want to be transparent here — there was a period in March where Detect had some availability issues, you may have noticed that, the outage around March tenth through the eighteenth. We've made significant infrastructure changes since then — redundant processing nodes, circuit breaker architecture — so the reliability story is much stronger now, but I wanted to flag that proactively.

Yeah we did notice that, and honestly I appreciated the communication during it — your team was pretty on top of the status updates. It wasn't fun but I felt like we knew what was happening. And the fix sounds solid, the circuit breaker pattern is the right call for that kind of cascading failure scenario.

+1Appreciates the communication during the Detect outage and calls the fix sound. · support experience

Yeah our engineering team was — they moved fast on it and I think the architecture is genuinely better for it. Okay so — let me swing back to Comply v2, I want to make sure we cover the onboarding side of this since that's really the point of today's call.

Yes, yeah — let's talk about what actually getting live on v2 looks like for us. What's the migration path from current Comply?

So the good news is there's no big bang migration here. v2 is deployed as an upgrade to your existing Comply instance, your historical data comes with you, your custom configurations and any existing scheduled reports are preserved. The typical onboarding for an account your size is — we're looking at kind of a one to two week window to get fully configured and validated.

So you'd have me as your SA throughout, and we'll also loop in a dedicated onboarding specialist from our CS team — they'll run the technical setup sessions with your team. It's not self-serve, we're hands-on for the whole window.

Ha, yeah, we try to make it a little more human than that. Okay, so — given that v2 goes GA on April seventh, what would your ideal timeline look like? Do you want to be in the first wave of production upgrades, or do you want to let it bake for a few weeks?

Honestly, given the PCI angle and the board conversation I mentioned, I'd love to be in the first wave. Like if I can go back to my CFO in mid-April and say we have on-demand PCI DSS reporting live and ready, that's a very good story to tell.

+1Wants to be in the first wave to tell the CFO about on-demand PCI DSS. · compliance reporting

I love that. Okay, so let's talk about what we'd need to do to make that happen — I'd want to get the upgrade scheduled for the week of April seventh, kick off the onboarding sessions the week of the fourteenth, and target you being fully live and validated by April twenty-first. Does that rough timeline work for your team's bandwidth?

April twenty-first is — yeah, that works. I'd want to loop in my security engineering lead, Priya, she'd be the one running point on the technical side. Can I have her connect with you directly after this call to get the details?

Absolutely, yes — have her shoot me an email and I'll get the onboarding specialist intro'd right away. And Keith, honestly, I'm really excited about this one — I think v2 is going to genuinely change the way your team experiences compliance and I can't wait to see you use it with auditors for real.

Of course, that's what we're here for. I'll send over a recap and the onboarding guide this afternoon, and I'll hold a spot for you in the April seventh first-wave rollout. Looking forward to it.