Raymond Cheng, Decrypt Compliance — When to Launch a Startup
Watch on YouTube, or listen on Spotify and Apple Podcasts.
Raymond Cheng is the founder and CEO of Decrypt Compliance, a Silicon Valley firm that provides independent compliance audits and certifications for startups and small and medium-sized businesses — the proof of trust a customer asks for when it’s a government agency, a university, a healthcare organization or anyone else in a highly regulated industry. Before starting it about two and a half years ago, Raymond spent about six years at Ernst & Young, two at Salesforce and one at Tencent. Mash asked him why he walked away from what a lot of people consider a dream job, what it’s like to build a firm on your own, how he’s putting AI to work for clients, and what a young company should do when the compliance questions show up in a deal.
This conversation has been edited and condensed.
“Different positions around the table”
You told me you’re a new founder. It’s not usual for somebody to go from a really cushy job to saying, “I’m going to risk it all.” How did you get here?
I did my undergrad at Santa Clara University, in the business school. When I left with my bachelor’s, I got into the Big Four accounting and consulting firms and was working at Ernst & Young. The stuff I was doing at EY is pretty much what our business does today, just on a slightly smaller scale and in a more specialized, personalized way.
EY is a dream job for a lot of people. I teach at San Jose State, and students tell me, “Mash, I’m trying everything to get an internship at EY. I’ll work for free.” So how did this evolve into “I’ve got to do my own business”?
When I look back, everything has a place within my career journey. I see those first years at Ernst & Young as so foundational. I joined the teams in Silicon Valley, working with a lot of Fortune 100 technology companies on IT audit and consulting — security, privacy. I found really great mentors and great career growth opportunities. I did the work, I told my mentors, “This is where I want my career to go,” and I made it happen.
The only reason I jumped out wasn’t that I wasn’t growing. There were a lot of other opportunities in Silicon Valley calling to me. After Ernst & Young I was at Salesforce, and then Tencent. All huge, global companies with a lot of people and really robust processes, and I loved each of those experiences for different reasons.
At Ernst & Young I learned the craft of audit and consulting — what it looks like to be client-serving — and a strong sense of professionalism: self-accountability for how you carry yourself, and putting other people’s needs front and center. Salesforce was the first time I worked internally. How do we take that security and privacy compliance knowledge and apply it to help the business grow? That helped me see how security plays a role within a company — working with your own team, other teams, leadership, and with the consultants from EY who come in. The tables turned. I had the chance to sit in different positions around the table.
So for an early-career professional thinking about starting a company, there’s value in staying on a career path for a while — mentors, direct business experience. Have you always been in IT security?
Governance, risk and compliance, specialized in security and privacy, and most recently AI matters. I thought I might spend five, ten, fifteen years at Ernst & Young, because they actually showed a path for growth there. I was there about six years, as my first job, and then Salesforce for about two.
The move to Salesforce was compensation — the macroeconomic factors at the time, the Silicon Valley technology sector; the comp was amazing. It was also personal. I got engaged to my now-wife — we have a one-year-old — and I thought I was ready for my career to take a backseat to other parts of my life. I didn’t think career played a big part in my life at that point, but I realized it does. There was an energy I got from Ernst & Young, such a dynamic work environment, and I wanted more of that.
“The plan does not always have to be the plan”
And then Tencent.
I joined Tencent’s global IT team. Tencent has a really strong presence in China, and the global team’s goal was to expand and get their arms around all the offices, subsidiaries and teams outside China, on every continent. I was working in security and privacy compliance.
The common trope in IT is that it’s always chasing after the business. The business is out there building products and services, and IT is trying to keep up. Security and privacy is a subset within IT. So we were chasing IT, who was chasing the business. Our CIO was giving us new objectives every couple of weeks, and that opened my mind to the idea that the plan does not always have to be the plan. You set it, you see how it goes, and once you get new information, you adjust as quickly as you can.
Just because there’s ambiguity in what you’re doing doesn’t mean you’re not headed in the right direction. When I took that job, I thought I’d be really stressed out by the ambiguity and wouldn’t be able to handle it. But I realized I’m capable of taking on more challenges than I give myself credit for. After about a year there, I asked, “What else can I do to keep growing, so I can get more and more comfortable with ambiguity?” That’s where Decrypt Compliance came from.
I have to pause on ambiguity, because that’s a hidden skill startup founders really need — they have to live in ambiguity and iterate all the time. I’ve talked with people about founder skills like flexibility, agility and leadership, but this is the first time someone’s put it as not being afraid of ambiguity.
That was the will: this is a challenge I’ll grow from, and I want to take it on. The question was the way. What combination of experiences and skills could I really put to good use? From working in governance, risk and compliance as a consultant, an external service provider and an auditor, plus working internally at Fortune 100 companies, I saw I had a very unique blend of skills. If I started a professional services firm in this field, I’d have a distinct competitive advantage.
A lot of competitors in this field have been on the consultant side for years and years. At Ernst & Young, folks start out of college and stay 20-some years. They have a lot of institutional knowledge, but they may not have the outsider’s perspective. That’s what I bring with Decrypt Compliance. We understand our clients because we were literally there, internally and externally.
A lot of founders put the cart before the horse: “I’m going to build this thing, and then I’ll go try to get people to buy it.” It’s a deadly trap. It sounds like you already knew who the customers were and what they needed. Is that true, or did you still have to find product-market fit?
It’s more knowns than unknowns. Because I know the field from a few different angles, I have a pretty good sense of where the client challenges are. But it’s one thing to know the solution and another to get it to the customer. Distribution is something I’ve spent a lot of time thinking through. How do we get our message out? How do we find our clients and make sure they know who we are? Because once they work with us, they see right away that it’s the right choice.
Did you raise money from anyone, or is this bootstrapped?
We needed to get a loan to get started. But we didn’t seek private equity or VC funding, and that was a personal decision: what is the business idea, and how do you want to run the business? One thing that’s been a breath of fresh air for me is making all the decisions without that external influence. With VC funding, you’ve got to make sure the visions are aligned — that where you’re trying to go is where your partners want to go — so you don’t feel pulled in different directions. For me it’s been careful, methodical growth. And I had confidence that with that finite amount of runway, we could be successful.
You’re a solo founder. You can take the business anywhere you want, but it’s got to be a heavy load. Do you ever feel like you’ve got the whole thing on your back?
There’s a lot of that. But I have support systems, and I think every founder needs to know where their support system is and how to tap into it. There are a couple of CEO groups I’ve joined so we can bounce ideas off each other. And I find ways to recharge without thinking about the business all the time — family and friends.
Being a sole founder was partly a choice and partly not. My field is highly regulated. It requires a certain level of credentials and experience. When I looked around at who I knew with the same vision and those credentials, I didn’t want to go into that search and procrastinate from getting started. I knew I wanted to get started first.
That’s not to say I don’t have outside help — advisors, and agencies who provide input in certain areas. But a lot of it has been trial and error. The biggest thing I’ve learned is keeping the most important things the most important things. I tend to be a perfectionist. When I got started, it was, “Marketing has to be like this. Sales has to be like this. Operations needs to look like this.” I gave myself permission not to be perfect in all those areas — to say right now sales is the number one thing, or right now operations and customer service are the most important thing.
“Just because there’s ambiguity in what you’re doing doesn’t mean that you’re not headed in the right direction.”
— Raymond Cheng · Inspiring Founders Podcast, Ep. 04
“I got oversold”
What’s one of the worst decisions you made early on? I’ve talked to thousands of founders, and so often they fall for somebody’s personality, and that person says, “Give me 20% equity and $250,000 and I’ll solve all your problems.” It is Silicon Valley — they’re called sharks for a reason.
The area I continuously struggle in is marketing. It’s the thing I’ve spent so much time and energy learning and practicing. Early on there were a couple of agencies I worked with, and they sold me everything: “You have a good idea. All we’ve got to do is a couple of these things and we’re off to the races.”
For me it was understanding how much homework, clear strategy and planning I should have before working with an agency. I worked with one too soon. I didn’t have as much of a plan as I could have to make sure they were successful in making me successful. I got oversold, and it was a learning lesson.
There’s a set of milestones you need to reach that make the people you bring in more effective. Bring in a marketing agency too early and they spend all their time figuring out your strategy and your brand, instead of making people aware of you and landing leads. So if marketing is your weak point, what’s your superpower?
Having empathy for clients, for customers, for others. And I’m a huge techie — injecting technology, automation and AI into the right areas of the business is what I’m passionate about. Part of why I started the firm is that I love helping people solve their challenges, and I love doing it in the most modern way possible. I looked around and saw many ways technology could improve how this business runs, to provide better outcomes for clients. And if I don’t know who’s doing that, can I do it?
“Where does the data live?”
When we met, it was at an AI event here in town. What have you figured out about using AI to help your customers?
With AI — and any technology we’re thinking about today — the first thing is data. Where does the data live? And if you don’t have it, how do you capture it? For us, one part is bringing all the different signals and data points we have about our clients into a single location. Maybe it’s a CRM, maybe it’s something else, but the point is to get the data you need into one place. Then get a little more creative: what would you do for your clients if there were no limits, and what data points do you need to do that?
Traditionally you’d stick all that data in a data lake or a SQL server, and someone would have to write SQL every time somebody wanted something out of it.
Exactly. The way large language models work, they can take all sorts of data types. It doesn’t have to sit cleanly in a database. Maybe it’s a meeting transcript, or notes, or images, or video. That unlocks a lot of opportunities, because reviewing and pulling information out of those files is so much faster.
New companies are in such a good position to do this. A company that’s been around 10, 15, 20 years has processes, tools and systems that aren’t designed for it, and people trained to follow processes a different way. There’s a lot of unlearning companies have to do to get the full value out of AI. When you’re starting out, you can change. It’s so much easier to say, “Let’s just put it all in one place.”
“We broker that trust”
Who is your customer?
Today we work with a lot of startups and small and medium businesses — ones looking to build trust with their end customers, whether those customers have concerns around security, privacy or the usage of AI. A great fit is a company with software it sells to other businesses. Eventually their customers will ask, “How do I know your software is secure?” And if you’re in a regulated industry that handles personally identifiable information: “What confidence do I have that my data is protected?” In Silicon Valley, healthcare is a huge one. Edtech is another.
They may not even know they need you yet. They’re onboarding a million new users, and all of a sudden they’re like, “Oh my god, I could get in so much trouble.”
When is a good time to work with a company like Decrypt Compliance? It depends on your customers. Smaller businesses quite often see your product, say, “This is great, let me try it,” and they’re instantly in. Larger companies do more due diligence before they start using your stuff in production, and it’s quite common that at the security check they’ll ask, “Do you have any independent reporting or certifications I can really hang my hat on, besides whatever the sales guy is going to say?” That’s where we come in. We’re an authorized, accredited, independent body. We broker that trust between you and the customer.
I’ve mentored startups out of the university that wanted to partner with San Jose State, the Cal States or the UCs. As soon as they knocked on that door, the first thing that came up was certification. When they did the research, it got incredibly complicated just to be approved as a vendor. Is that what you’re talking about?
One hundred percent. It’s essentially the handshake between you and your customer when it comes to security concerns. Everybody has their own process. Maybe they send you a questionnaire. Maybe they’re looking for independent auditors, assurance reports or certifications. Anytime it would be useful to build trust with your customer around technology matters, you can work with a company like Decrypt Compliance to bring in that confidence. You don’t have to take my word for it — here’s an independent party we trust, reputable, with integrity.
Do people just hire internal compliance people?
It’s a blend. A lot of folks have in-house compliance experts. But you can never break the boundary of having an independent party help validate. An independent party to broker that trust between two parties is just useful to have, from a design standpoint.
Common security frameworks we work with clients on: SOC 2, which is super valuable for a lot of companies doing work within the US. For companies working internationally, ISO 27001 is very common. In healthcare, we help a lot of clients with HIPAA compliance, and another framework growing in popularity there is HITRUST.
Is there growing concern because of AI?
In a lot of different ways, yes. When companies buy new software or services, they’ve been trying to figure out how AI fits into their due diligence. Some fold it into general security. Others split it out: security due diligence first, then AI due diligence. Either way, they want confidence that you’re doing the right things.
Right now, I think the language around responsible AI, and AI that people trust, is still being defined. It took a really long time for us as a society to understand what IT security really means, and to have the vocabulary around data privacy — HIPAA, GDPR. Now the question is: what does responsible AI look like? A lot of companies are still learning. ISO 42001 is one of the frameworks that’s come out — a framework for responsible AI management systems. We’ve been working with a lot of clients on it recently: helping them take a step back, ask what they’re doing with AI and what the core tenets of responsible AI are, and get on the path toward best practices, so they can show customers they’re actually thinking about these things on their behalf.
There are two basic types of clients: the ones who want to learn, and the ones who just need to get it done. Are people coming to you saying, “I don’t care how, just get me the papers I need for the government contract”? Or do they want to learn what responsible AI is? Are you an educator as much as a doer?
Absolutely. I call it two customer personas. One says, “Tell me what we need to do, and we’re going to do it.” The other says, “I’ve got this problem. Help me understand, help me get comfortable with those decisions, and then we’ll move forward.” How we deliver the work looks a little different, but the end result is the same: they have a good experience, their needs are met, and their customers trust their business more.
“What’s on paper is not always what must be there”
Let’s end with three tips for a small or medium business just starting to figure out compliance.
First, take a step back and understand the customer or prospect you’re working with. To what extent is the stuff in the contracts a deal breaker, and to what extent is it negotiable? You may not know right away unless you have a relationship — maybe someone close within the company. Are these terms set in stone? What’s the priority of each? Some requirements are nice-to-haves, although they’re listed as requirements. Some can move. At a lot of larger organizations, these contracts are more often than not boilerplate. It’s the starting point. What’s on paper is not always what must be there.
Number two: understand your positioning with the customer. You’re doing this already in your sales conversation, but think about all the leverage points. In my experience, security requirements tend to come toward the tail end of the conversation. That means it’s more likely than not that you may not have thought about that area, and your customer may not have either. Because it’s not on their radar, it could be a blocker neither of you expected. So be a little more proactive. If you see that you could need those assurances in the next 3, 6 or 12 months, work with a partner early on. The earlier you get connected, the easier it is to share context, and your adviser can help you navigate the conversation — not just get the certification, which is a whole other thing.
So don’t wait until the last minute to go, “Oh my god, I need a compliance audit.” What’s the last tip?
When I was at Ernst & Young, a lot of clients got anxious when they heard “auditor” or “certification.” What are you going to look at? What’s going to happen? My last tip: just like when you’re searching for a good lawyer, find the audit firm or consultant you feel comfortable being open and transparent with, because that’s how they’ll help you most. Lawyers need to know what’s going on to find the best solution, and it’s the same here.
We’re an independent party, but we get it. Compliance is foreign to everybody outside this field. There’s no harm in saying, “I don’t have all the answers. This is what we’re doing today. I don’t understand this.” The more open you can be with your consultant or auditor, the more they can figure out the clearest path and smoothest solution for you.
I know people who lie to their doctor because they don’t want to hear what’s wrong with them. It isn’t going to help you if you’re not honest.
First you have to be ready to be honest with yourself. I think that’s the challenge. Be honest with yourself first, and then find the person you’re comfortable being honest with.
More conversations with founders on the Inspiring Founders Podcast.