Deepak Gupta

The Seed-Stage Identity and Security Stack

Startup · intro · 8 min read · last reviewed 2026-08-15

After the solo-founder floor: workforce identity, machine credentials, customer RBAC, exportable audit, and SOC 2 on a trigger. What to add, and what to still defer.

TL;DR

The solo stack is for 1 to 5 people. Seed adds layers a buyer, an auditor, or a leaked laptop will force.
Triggers: a non-founder can break a customer, a prospect asked about SSO or SOC 2, or production access has spread.
Do now: managed CIAM, phishing-resistant MFA for admins, OIDC for CI, a three-role RBAC, exportable audit logs.
Architecture for SSO now. Admin UI and SCIM when a deal requires them. SOC 2 when a deal stalls.
Still defer a SIEM, a dedicated security hire, and a full zero-trust network.

The solo-founder stack is for one to five people: buy auth, turn on MFA, get secrets out of the repo, stop. At seed, roughly 8 to 30 people with a real pipeline and the first enterprise conversations, that list is no longer enough. You still should not build a security team. You should add the layers a buyer, an auditor, or a leaked laptop will now force.

I have watched companies skip this middle and jump from "we use Google login" to a 90-control SOC 2 theater. The middle is this page.

What changed since the solo list

Three triggers, not a headcount chart:

Someone who is not a founder can close or break a customer
A prospect has asked about SSO, a security questionnaire, or SOC 2
You have more than one environment, more than one laptop you do not personally update, or a contractor with production access

If none of those are true, stay on the solo stack. Gold-plating is still how you burn the raise. If you are raising the raise, Series A readiness will ask whether the machine survives you taking vacation. Identity is part of that machine.

The seed stack, in order

1. Keep the managed customer identity provider. Do not start hashing passwords yourself because you hired an engineer who "likes auth." Add passkeys for customers if you have not. Keep SSO as a config switch, and build the admin UI only when a signed deal requires it.

2. Workforce identity that is not "we all share the 1Password and the AWS root." Everyone in Google Workspace or Microsoft 365. MFA that is not SMS. Hardware keys or platform passkeys for anyone with cloud admin, billing, or production GitHub. Offboarding is a same-day checklist, not a Slack message.

3. Secrets and machine credentials. Secret manager in CI. OIDC federation to the cloud, not a long-lived access key. This is the static API key teardown applied to a team that now has a CI system.

4. Authorization that a customer can see. Owner / admin / member is no longer enough once a customer has a security reviewer. Start with RBAC and a documented role matrix. Do not start with Zanzibar.

5. Audit you can export. Login events, admin actions, permission changes, billing changes. Retained, queryable, not a SIEM you will not staff. This is what the questionnaire actually wants.

6. SOC 2 on a trigger. When a deal stalls on it, start the Type II Security-only path. Pass SOC 2 as a seed startup is the honest version. A Vanta or Drata class tool is worth it. A green dashboard on shared root credentials is not.

7. Vendor and laptop hygiene that will survive the first lost device. MDM light (or at least disk encryption + screen lock enforced), password manager as a condition of access, and a written list of who has production. You do not need zero trust theater. You need to know whose laptop can kubectl.

Do now vs wait

Layer	Seed default	Wait for
Managed CIAM + passkeys	Do now	Already the floor
Workforce IdP + phishing-resistant MFA for admins	Do now	Already the floor
Secrets out of repo, OIDC for CI	Do now	Already the floor
Customer RBAC (admin/member/viewer)	Do now if multi-user tenants	Fine-grained ReBAC
SSO for your customers	Architecture now, UI on a deal	Admin UI before a deal
SCIM	After SSO is live and a customer asks	Before anyone asks
SOC 2 Type II Security	When a deal requires it	Extra TSC
SIEM / SOC	Defer	A person whose job is to watch it
Dedicated security hire	Defer	~25 people or a real incident function
Full zero-trust network	Defer	A campus, not a seed

What "good enough for seed" is

A managed customer login with passkeys offered, founders and admins on hardware or platform MFA, no long-lived cloud keys in CI, a three-role RBAC a customer can understand, audit logs you can attach to a questionnaire, and a written trigger for SOC 2. That is a company a Series A security review can walk through without theater.

Doing it "right" later adds SCIM, finer authorization, a compliance program that already ran for a year, and monitoring with an owner. The solo stack is the floor you should already be above. This page is the floor for the next 18 months.

If the next constraint is capital rather than controls, go back to How to Run a Seed Round. If the next constraint is an enterprise login checkbox, go to Add SSO.

Failure modes

Hiring a CISO theater. A fractional advisor plus Vanta is the seed move. A VP of Security at 12 people is a slide.
Building auth in-house because "we have engineers now." You have engineers who should be shipping the product.
SOC 2 with no deal. You will recertify a report nobody asked for.
RBAC designed as a graph on day one. You will not be able to explain it to the customer admin.
Leaving the intern's AWS key in GitHub Actions. This is still how seed companies get breached.

Key takeaways

Do not start hashing passwords because you hired an engineer who likes auth.
Offboarding is a same-day checklist.
A green compliance dashboard on shared root credentials is theater.
Owner/admin/member is the RBAC you can explain. Do not start with Zanzibar.
A fractional advisor plus a compliance platform is the seed CISO.
The intern's AWS key in GitHub Actions is still how seed companies get breached.

Frequently asked questions

How is this different from the solo-founder stack?: The solo stack is buy auth, MFA, secrets, laptops. Seed adds workforce identity that can offboard, machine credentials for CI, customer-visible RBAC, exportable audit, and a SOC 2 trigger. Same philosophy, more principals.
When do I start SOC 2?: When a real deal stalls on it. Do the hygiene now. Buy the audit when someone will pay you for the report.
Do I need a security hire at 20 people?: Usually no. You need an owner for the checklist, a compliance platform if you are in an observation window, and a fractional advisor. A VP of Security at 12 people is a slide.
Should we build SSO now?: Architect for it now: pick a provider that already speaks SAML and SCIM. Build the admin UI when a signed deal requires it.
Is zero trust required at seed?: The posture is right. The program is not. Encrypted laptops, phishing-resistant MFA, and knowing whose laptop can reach production get you the practical benefit.