How FYDY is building enterprise trust from day one — before their first big customer

When FYDY set out to build Theatre, a next-generation studio for developers working with LLMs, the founding team knew security would matter early. Not because a buyer was demanding it today, but because the buyers they wanted tomorrow would.

FYDY handles sensitive developer data — codebases, workflows, AI model interactions. The kind of data that makes enterprise procurement teams ask hard questions before they'll even start a pilot.

Rather than wait for that first enterprise deal to force a scramble, Alapan Chaudhuri, FYDY's founder, made a deliberate choice: get SOC 2 ready before the ask comes, not after.

FYDY partnered with ComplyJet to build a structured compliance program from the ground up — while the company is still pre-revenue and raising its seed round.

Company Overview

FYDY (Fuzzy Dynamics) is building Theatre, a development studio for teams working with large language models. Think of it as the next evolution of developer tooling — purpose-built for the AI era.

Backed by GradCapital, FYDY is a lean team of three, moving fast to ship product while simultaneously laying the groundwork for enterprise readiness.

Their bet: by the time enterprise customers come knocking, the security story should already be written.

Challenge

Most startups at FYDY's stage don't think about compliance. They're focused on product, users, and fundraising. Compliance comes later — usually as a fire drill when an enterprise prospect sends over a security questionnaire with a two-week deadline.

FYDY decided to break that pattern. But doing compliance early as a three-person team brings its own challenges:

• No dedicated security or compliance hire — every hour spent on compliance is an hour not spent on product
• Infrastructure is still evolving — cloud resources, CI/CD pipelines, and tooling are being set up in parallel
• Limited budget — pre-seed capital needs to stretch across product, hiring, and go-to-market

The question wasn't whether to do SOC 2. It was how to do it without slowing everything else down.

The Environment

FYDY's technical stack includes:

• GitLab for source code management and CI/CD
• Google Cloud for production infrastructure
• Google Workspace for team collaboration and identity management

A modern, cloud-native stack — but one that was still being configured and scaled as the product took shape. Compliance had to work alongside an evolving environment, not wait for things to "settle down."

Getting Started with ComplyJet

FYDY kicked off their SOC 2 journey with ComplyJet shortly after signing up. The approach was designed for their reality: a small team, limited bandwidth, and an infrastructure that was still maturing.

Policies and training first

Shivansh Subramanian, FYDY's engineering lead, started with the foundational work — security policies, employee training, and MDM enrollment. ComplyJet's guided workflows meant these weren't blank-page exercises. Policies were drafted with AI assistance and mapped directly to SOC 2 requirements.

Integrations connected to real infrastructure

ComplyJet connected directly to FYDY's GitLab, Google Cloud, and Google Workspace environments. This meant controls weren't theoretical — they were mapped to actual configurations and monitored continuously.

Engineering tasks scoped and prioritized

Rather than a generic compliance checklist, ComplyJet helped FYDY identify the specific engineering tasks needed for their environment — vulnerability scanning, access controls, logging — and prioritize them alongside product work.

Where FYDY Stands Today

FYDY is now in their SOC 2 Type 2 monitoring period. All controls are in place, evidence is being collected continuously, and they're fully set to complete their audit whenever they're ready to pull the trigger.

Here's what they've accomplished:

• Security policies drafted and adopted
• Employee security training completed
• MDM enrolled across all devices
• Core integrations (GitLab, Google Cloud, Google Workspace) connected and monitored
• All engineering security tasks implemented
• Continuous monitoring active across their environment

The team built their entire compliance foundation without hiring a single compliance person or slowing down product development.

Why This Matters

FYDY's approach flips the typical startup compliance story. Instead of:

1. Build product
2. Land enterprise prospect
3. Panic about compliance
4. Scramble for 6-8 weeks
5. Hope the prospect is still interested

They're running:

1. Build product + build compliance foundation in parallel
2. Land enterprise prospect
3. Share Trust Center link
4. Close the deal

For a startup handling sensitive developer data and targeting US enterprise customers, this isn't just good hygiene — it's a competitive advantage.

Looking Ahead

FYDY can complete their SOC 2 Type 2 audit at any time — the monitoring period is underway and controls are operating consistently. The path from "monitoring" to "certified" is a matter of scheduling the audit, not scrambling to get ready.

When that first enterprise buyer asks "Are you SOC 2 compliant?" — FYDY won't need to ask for time. The answer will already be yes.

With ComplyJet, compliance isn't something FYDY will have to retrofit later. It's built into how they operate from the start.