White dove with outstretched wings against a black background.

STARTUP COMPLIANCE TIMELINE • FREE GUIDE

The trust work that fits
each stage of your startup

Move to the next stage when you hit its milestone, not a calendar date.

The timing bands are typical, not deadlines.

Get your free Snapshot
Find your stage

FIND YOUR STAGE

Eight stages, each triggered by a milestone

Select your stage and focus on what matters now.

0. Formation

Pre-seed • Months 0 to 1
+
Do now:
  • Put IP and confidentiality agreements in writing
  • Choose a data region
  • Start a data map
  • Create an evidence folder
  • Check that key vendors offer DPAs
Advance when: Company is formed, intellectual property assigned, and a one‑page Data Map exists.

1. Pre-MVP

Recruiting design partners • Months 1 to 3
+
Do now:
  • Set rules for data you won't collect yet
  • Confirm vendors and where data lives
  • Choose retention defaults
  • Draft a privacy notice and terms
  • Plan consent for email and SMS
Advance when: "No‑go" data rules are set, vendors identified, retention chosen, and policy drafts exist.

2. MVP build

Demo-ready • Months 3 to 6
+
Do now:
  • Build in basic security
  • Capture consent with timestamps
  • Inventory cookies and plan a banner for EU and UK users
  • Write a one‑page incident plan
Advance when: Security basics work, policies are ready to publish, and you know how consent/cookies will work.

3. Private alpha or beta

Paid pilot or LOI • Months 6 to 9
+
Do now:
  • Sign DPAs and track subprocessors
  • Set up an inbox for data subject requests
  • Run a 30‑minute tabletop drill
  • If targeting EU/UK, do a quick risk check
  • Limit real data in tests
Advance when: DPAs are signed, DSAR intake works, incident drill is done, and (if relevant) EU/UK risk check is recorded.

4. Public launch

Marketing go‑live • Months 9 to 12
+
Do now:
  • Publish your Privacy Notice and policies
  • Turn on regional cookie consent
  • Log consent and unsubscribes
  • Review marketing claims with your counsel
  • Add a privacy request page
  • Tighten security: central logs, backup tests, MFA or SSO
Advance when: Policies are live, consent/cookies work by region, and you can produce DSAR/consent logs on request.

5. Early traction

10 to 50 customers · $100k to $500k ARR • Years 1 to 1.5
+
Do now:
  • Build a Trust Pack for buyers
  • Complete vendor due diligence
  • Start SOC 2 readiness
  • Set a retention schedule
  • Run staff training
Advance when: Trust Pack is ready to send, SOC 2 plan exists with owners/dates, and retention/training are running.

6. Enterprise ready

First enterprise logo · Seed to Series A • Years 1.5 to 2
+
Do now:
  • Run a penetration test
  • Finalize customer DPAs
  • Put transfer agreements and a transfer risk assessment in place for cross‑border data
  • Prepare standard questionnaire responses
  • Add specialty addenda if you need them
Advance when: First enterprise security review passes and cross‑border paperwork is in place.

7. Scale and international expansion

$1M to $3M+ ARR · EU or UK entry • Years 2 to 3
+
Do now:
  • Keep processing records current
  • Review access every quarter
  • Refresh risk assessments and policies
  • Ask your counsel whether you need an EU or UK representative or a DPO
  • Move from SOC 2 Type 1 to Type 2
  • Formalize vendor risk checks
Advance when: You have a steady governance rhythm and outside audits don't require a scramble.
Quick Jargon Decoder (Click to View)
Privacy Notice: A public page that says what data you collect, why, and people's choices.
DPA: Contract with a vendor who handles your customer data.
DSAR: A way for people to ask for, correct, or delete their data.
Cookie Consent: The pop‑up/controls for tracking on your site.
SOC 2: A security audit framework many bigger customers expect.
SCCs/UK IDTA: Standard forms allowing data transfer to other countries (like the US).
✓ Versioned policies
✓ Privacy request tracker
✓ Penetration test summary
✓ Support for marketing claims

Keep this evidence as you go

Reviewers ask for records, not intentions. A short list covers most requests.

✓ Data map and subprocessor list
✓ Incident playbook and drill notes
✓ Transfer agreements
✓ Consent and cookie logs
✓ Security controls summary
✓ Training logs

Each stage has a matching next step