The Auditor Behind the Audit: Why CometChat Rebuilt Its Compliance Ecosystem

CONTEXT 

Beyond certification and toward confidence

CometChat powers real-time communication experiences for software companies around the world. With enterprise buyers evaluating security posture before signing contracts, compliance had become deeply embedded in the company's growth strategy.

The company had maintained SOC 2 while preparing for additional regulatory requirements. Yet compliance ownership remained concentrated within a small cross-functional team led by Harsh, Head of IT & Admin, alongside engineering, DevOps, and people operations.

As compliance requirements multiplied, the challenge was no longer achieving an attestation. It was keeping compliance efficient, relevant to the teams responsible for maintaining it, and defensible in front of enterprise customers.

CHALLENGES 

The breaking points that made a platform switch inevitable

• As compliance responsibilities expanded across teams, engineers were frequently exposed to controls and framework requirements that were not relevant to their role. DevOps teams focused on infrastructure and vulnerabilities found themselves navigating unrelated compliance tasks, creating unnecessary noise and reducing operational efficiency.
• CometChat discovered that the auditor assigned through its existing compliance platform's audit network for its SOC 2 attestation could not be verified through the AICPA CPA firm registry. For a company whose audit reports are routinely reviewed by enterprise security teams, auditor credibility became just as important as the attestation itself.
• Compliance activities were spread across multiple vendors, including the platform provider, auditor, and penetration testing partner. Each relationship required separate management, communication, contracts, and timelines, adding coordination overhead to an already demanding process.
• Strategic compliance guidance was hard to access when it mattered most. Technical support was responsive, but audit preparation and certification decisions required a level of hands-on expertise the existing setup could not reliably provide.

SOLUTION

Rebuilding trust in the compliance program

A compliance team beyond the platform

The relationship itself became another differentiator. CometChat worked directly with a named Scrut CSM, Infosec analyst, and VAPT specialist through a shared Slack channel with rapid response times. Rather than opening support tickets and waiting for answers, the team had direct access to specialists who understood their environment, certification requirements, and audit timelines. For CometChat, the value extended beyond software. It felt like having an extension of the team available when needed.

Supporting customer trust at scale

As enterprise opportunities increased, customer security reviews became more frequent. Scrut's Trust Portal and compliance workflows helped centralize certifications, reports, policies, and security documentation, making it easier to respond to customer requests without repeatedly assembling information from multiple systems.

Strengthening confidence in the compliance ecosystem

CometChat selected Scrut to consolidate its compliance engagements under a single partner and transition to a more established, independently verifiable audit provider. The team wanted assurance that every component of its compliance program, from controls and evidence to audits and attestations, could withstand enterprise scrutiny.

By bringing audit, compliance management, and security assessments into one ecosystem, CometChat reduced coordination overhead while strengthening trust in the certifications it shared with customers.

Making evidence collection part of everyday operations

CometChat connected GitHub, Google Workspace, Slack, Jira, and AWS to automate evidence collection and recurring compliance activities.

Access reviews that were previously tracked manually across systems could now be completed through a centralized workflow. Using Scrut's Task Center, teams could manage compliance activities from a single place, while employee populations synced automatically from Google Workspace, making training assignments, access management, and compliance tracking easier to maintain as the organization grew.

IMPACT 

Compliance runs quietly and stands up to scrutiny

Compliance stopped competing with operational priorities. It runs in the background, supports customer trust, and gives the team confidence that every part of the program can withstand the scrutiny of the organizations they serve.

Today, CometChat manages SOC 2, ISO 27001, GDPR, and HIPAA through a compliance program built around trust, visibility, and operational simplicity.

The team met its ISO recertification deadline despite a compressed migration timeline, reduced vendor coordination overhead, and gave teams a clearer, more structured way to manage compliance responsibilities. The company also strengthened confidence in its audit ecosystem by transitioning to an independently verifiable audit provider – a detail that now holds up in enterprise security reviews.