Product & Features
What compliance frameworks does Vylint Shield support?
Vylint Shield currently supports SOC 2, ISO 27001, and HIPAA compliance documentation in the portal. Additional frameworks — including PCI-DSS, CMMC, and others — are available via our guided assessment forms, with full portal support coming soon. We continuously map your infrastructure, policies, and security controls to the requirements of each framework and automatically collect evidence from your existing tools (AWS, GitHub, Google Workspace, Jira, and many other integrations).
How long does it take to set up Vylint Shield?
Most startups complete initial setup in under 2 hours. You'll:
- Connect your cloud providers (AWS, GCP, Azure)
- Integrate your SaaS tools (GitHub, Slack, Google Workspace)
- Review auto-generated policy templates and customize them for your organization
- Assign roles and responsibilities
Once connected, Vylint Shield begins continuously collecting evidence. You can be audit-ready in weeks, not months.
What integrations does Vylint Shield offer?
Vylint Shield integrates with a growing list of platforms including:
- Cloud providers: AWS, Google Cloud Platform, Microsoft Azure
- Development tools: GitHub, GitLab, Bitbucket, Jira, Linear
- Identity & access: Okta, Google Workspace, Microsoft 365, Auth0
- Monitoring & logging: Datadog, Splunk, AWS CloudTrail, PagerDuty
- HR & training: BambooHR, Gusto, Rippling, KnowBe4
- Ticketing & support: Zendesk, Intercom, Front
Don't see your tool? Email support@vylintshield.com – we add new integrations based on customer requests.
Do I need to change my existing tools or workflows?
No. Vylint Shield works with your existing tech stack. We pull data from your current systems via read-only API integrations. You don't need to switch cloud providers, adopt new development tools, or change how your team works.
Can Vylint Shield help if I've already started compliance work?
Yes. Vylint Shield accelerates compliance documentation no matter where you are in the process:
- Just starting: We provide policy templates, control mapping, and a step-by-step implementation roadmap
- Mid-implementation: We centralize evidence you've already collected and automate the rest
- Audit-ready: We organize evidence into auditor-friendly packages and monitor for control drift
How much does Vylint Shield cost?
Plans are billed annually, and every plan includes all 9 compliance frameworks. Plans differ by the number of user seats and the level of support – not by framework count. For current pricing, visit vylintshield.com/pricing.
What is your refund policy?
All subscriptions are billed through Stripe, our payment processor. Once you have paid your subscription and completed the compliance questionnaire in the platform, the service is considered fully delivered – no refunds will be issued from that point forward.
If you cancel before your compliance documentation has been delivered, you may choose either to keep your access for the rest of the term you paid for, or to end your access and receive a pro-rata refund of your prepaid fee; to choose the refund, email support@vylintshield.com within 30 days after you cancel.
If VylintShield's platform experiences a confirmed technical failure that prevents your completed questionnaire from generating documentation, contact support@vylintshield.com and we will re-generate your documents. If we are unable to re-generate them within a reasonable time because of a platform defect, we may issue a pro-rata refund for the affected subscription period. See our Terms of Service for full details.
Compliance & Certification
Does Vylint Shield certify my organization?
No. Vylint Shield is a compliance documentation and audit-readiness platform. We do not perform compliance audits, issue certifications, or act as a certification body of any kind.
Achieving formal certification under ISO 27001, SOC 2, HIPAA, PCI-DSS, or any other regulatory framework requires you to engage an independent, accredited third-party certification body or audit firm – separate from Vylint Shield. Vylint Shield is not itself certified under any of these frameworks at this time.
What we do is create and organize the documentation and evidence you'll need to bring to that third-party assessor. Getting certified is your responsibility and depends on engaging the right assessor and implementing your compliance plan.
What's the difference between SOC 2 and ISO 27001?
Both frameworks validate your security posture, but they differ in scope and audience:
| Feature | SOC 2 Type II | ISO 27001 |
|---|---|---|
| Origin | US-based (AICPA standard) | International (ISO/IEC standard) |
| Focus | Trust service criteria: Security, Availability, Confidentiality, Processing Integrity, Privacy | Information Security Management System (ISMS) |
| Audit frequency | Annual (Type II requires 6–12 months of evidence) | 3-year certification with annual surveillance audits |
| Who requires it? | US enterprise customers, SaaS buyers | Global enterprise customers, EU/UK buyers, regulated industries |
| Certification vs. report | Produces an audit report (not a certification) | Produces a formal ISO 27001 certificate |
Recommendation for startups: If your customers are primarily in the US, start with SOC 2. If you're selling globally (especially in Europe), pursue ISO 27001. Many companies eventually complete both.
Do I need HIPAA compliance if I handle health data?
Yes, if you're a covered entity (healthcare provider, health plan, or clearinghouse) or a business associate (vendor that processes health data on behalf of a covered entity).
Examples of startups that need HIPAA compliance:
- Telemedicine platforms
- Health data analytics tools
- Medical billing software
- Wearable health device platforms that store PHI (Protected Health Information)
If you're unsure whether HIPAA applies to your business, consult with a healthcare compliance attorney. Non-compliance can result in fines ranging from $100 to $50,000 per violation.
What is PCI-DSS and do I need it?
PCI-DSS (Payment Card Industry Data Security Standard) is required if you store, process, or transmit credit card data. However, most SaaS startups do not need PCI-DSS because they use payment processors (Stripe, PayPal, Braintree) that handle cardholder data on their behalf.
You do need PCI-DSS if:
- You store credit card numbers in your own database
- You process payments directly (not through a PCI-compliant gateway)
- Your application transmits cardholder data across your network
Recommendation: Use a PCI-compliant payment processor and avoid storing card data. This eliminates PCI-DSS requirements and reduces your security liability.
How long does ISO 27001 certification take?
Most startups complete ISO 27001 certification in 6–12 months, depending on:
- Current security maturity
- Resources dedicated to compliance
- Use of automation tools
Vylint Shield can help reduce preparation time by automating evidence collection, pre-populating policy templates, and maintaining an always-audit-ready evidence repository. Your actual certification timeline will depend on when you engage a third-party assessor and how quickly your organization implements the required controls.
Read our full guide on ISO 27001 timelines
Can I use Vylint Shield for multiple compliance frameworks at once?
Yes. Most controls overlap across frameworks – access management, encryption, incident response, and logging are required for SOC 2, ISO 27001, and HIPAA. Vylint Shield maps shared controls so you satisfy multiple frameworks simultaneously without duplicating work.
What happens if I fail an audit?
If an auditor identifies non-conformities (gaps in your controls), you'll have a remediation period (typically 2–6 weeks) to address the findings before the audit can proceed.
Vylint Shield helps you minimize audit risks by:
- Running pre-audit readiness checks that identify gaps before the auditor reviews your ISMS
- Tracking control drift and alerting you when evidence is missing or out-of-date
- Providing auditor-friendly evidence packages organized by framework and control
If issues arise during your audit, Vylint Shield's support team can help you update your documentation for the remediation period.
Can Vylint Shield help me find a certification body (auditor)?
We can provide general guidance on what to look for in an auditor. Certification bodies for ISO 27001 must be accredited by a recognized accreditation body (e.g., UKAS, DAkkS, ANAB). For SOC 2, you need a licensed CPA firm. We recommend researching accredited bodies in your region and reaching out to several for quotes.
Onboarding & Support
What does the onboarding process look like?
There is no implementation project. Vylint Shield is fully self-serve — you sign up, complete a short assessment, and receive your compliance documentation the same day.
- Create your account and choose a plan
- Complete the guided compliance assessment
- Review your auto-generated policies and customize them for your organization
- Download audit-ready documentation whenever you need it
No kickoff calls, no consultants, no waiting — if you get stuck, the in-app AI assistant can answer compliance and platform questions on the spot.
What level of support do you offer?
Every Vylint Shield plan includes:
- Email support at support@vylintshield.com — response within 2 business days on Basic, 1 business day on Standard and Pro
- In-app AI assistant for immediate answers to compliance and platform questions
- Help centre in the portal with video guides and step-by-step walkthroughs
Do I need to hire a compliance consultant if I use Vylint Shield?
Many startups use Vylint Shield alongside their internal teams without external consultants. The platform provides:
- Policy templates tailored to your industry
- Control mapping and implementation guides
- Evidence collection automation
- Pre-audit readiness checks
However, Vylint Shield is a documentation and tooling platform, not a compliance consultancy. If you need legal review of contracts and policies, regulatory advice specific to your jurisdiction or industry, or hands-on implementation support, you may benefit from engaging an independent compliance consultant or attorney.
What happens after I achieve certification?
Compliance is continuous, not a one-time event. After certification:
- ISO 27001: Annual surveillance audits + full recertification every 3 years
- SOC 2: Annual audits covering a new 6–12 month period
- HIPAA: Ongoing compliance monitoring and risk assessments
Vylint Shield reduces post-certification workload by:
- Continuously collecting evidence for surveillance audits
- Alerting you when controls drift or evidence gaps emerge
- Tracking policy review cycles and control updates
- Maintaining an audit trail for all changes to your ISMS
Security & Trust
How does Vylint Shield protect my data?
Vylint Shield implements industry-standard security measures:
- Encrypted at rest (AES-256) and in transit (TLS 1.3)
- Hosted on Vercel, with customer data in a Neon managed PostgreSQL database in the United States
- Audited regularly by third-party security firms
- Principle of least privilege access controls
All integrations use read-only API access with scoped permissions. We never modify your infrastructure or access data beyond what's required for evidence collection.
Where is my data stored?
Vylint Shield data is stored in the United States, in a Neon managed PostgreSQL database. We do not currently offer a choice of data residency region, and we do not store customer data in the EU. See our Privacy Policy §3 and §5 for the full provider list and how we handle transfers from the EEA, UK, and Switzerland.
All data is encrypted at rest and in transit using TLS 1.3.
Can I delete my data?
Yes. You can delete your Vylint Shield account and all associated data at any time. We comply with GDPR "right to erasure" requests within 30 days.
Do you have a Business Associate Agreement (BAA) for HIPAA customers?
Yes. Vylint Shield signs Business Associate Agreements (BAAs) with HIPAA-covered entities and business associates. Email support@vylintshield.com to request one.
How are payments processed?
All payments are processed by Stripe, a PCI-DSS-compliant payment processor. VylintShield does not store your raw payment card numbers. Your billing information is handled by Stripe in accordance with its own terms and privacy policy.
Ready to Get Started?
Vylint Shield helps startups create the documentation and evidence needed to pursue SOC 2, ISO 27001, and HIPAA certification. Start a free assessment and see your results in minutes – no sales call required.
Start a free assessment | See pricing | Email support
Still have questions? Email us at support@vylintshield.com or use the chat widget in the bottom-right corner of this page.