The four areas they'll probe, and typical startup gaps
Access management is where most startups bleed. Expect questions on: joiner-mover-leaver process (is deprovisioning tied to HR offboarding, or does someone "remember" to revoke access?), privileged access to production databases and the ERP, shared credentials, and periodic access reviews with evidence. Given your inter-entity Velynk flows and lending infra, segregation of duties matters — the person who can create a vendor/farmer shouldn't be able to approve payouts to them. Direct production DB access by engineers for "quick fixes" is the classic finding.
Change management — do code changes to systems touching financial data go through review, testing, and approval before deployment? Self-hosted GitLab CI/CD helps here if you can show PR reviews, protected branches, and deployment approvals as evidence. The gap auditors find: hotfixes pushed directly, or the same person authoring and approving.
IT operations — backup and restore (not just "we have backups" but "we've tested restoration"), monitoring, incident logging, job scheduling failures for things like your harvest line data pipelines.
Third parties — you likely rely heavily on SaaS (Zoho, cloud infra, payment/lending partners). Auditors will ask about vendor risk assessment and whether you've reviewed their SOC reports.
Referenced in:
All notes