Company formation and banking for global founders
Infrastructure chores out of the sprint, and environments that stay audit-ready.
A small product team was losing days each sprint to infrastructure chores and compliance drift. Banking partners wanted SOC 2. The founders were the on-call rotation.
- Company
- StartGlobal, Inc.
- Stage
- Venture-backed, US
- Stack
- AWS, Terraform, RDS PostgreSQL, CloudWatch, Datadog
- Engagement
- Managed DevSecOps
- Agents
- Sage AI, Finly AI, Iris AI
The situation
StartGlobal helps founders outside the US form and run a US company: incorporation, banking, tax and compliance in one product. The platform handles identity documents and financial data, so partners expect audit evidence, not promises.
Engineering was a small team shipping product. Every sprint gave up days to infrastructure: Terraform changes, environment drift, certificate renewals, access reviews. Compliance evidence was collected by hand before each audit, and incidents landed on whoever was awake.
The trigger was a banking partner asking for SOC 2 evidence, in the same quarter that two founders spent more evenings on infrastructure than on the product. Hiring a DevOps engineer was the obvious answer and the wrong one for a team that size: one person, no cover, and a year before they knew the system as well as the people who built it.
What the audit found
4 things that were costing money or time.
Terraform drift
Changes made in the console during incidents never made it back into code. Plans showed dozens of diffs, so applying anything became a risk and the code stopped being the source of truth. Two environments had quietly diverged in their security group rules.
InfrastructureCompliance evidence gathered once a year
Access reviews, change approvals and backup tests were real, but the evidence lived in screenshots and chat threads assembled the week before an audit. The controls existed; the proof did not, and reconstructing it cost the team a sprint each time.
ComplianceDatabases and environments sized for a future that had not arrived
RDS instances and non-production environments ran at production size around the clock, with utilization that never justified it. A read replica added during an incident a year earlier was still running.
AWSNo real on-call
Alerts went to a shared channel. Response depended on who saw it first, and post-incident fixes were made by hand under pressure, which is where the drift came from. There was no record of who changed what, or when.
OperationsWhat changed
Agents did the work. Engineers approved it.
Code becomes the source of truth again
Existing infrastructure reconciled into Terraform, drift detected and reverted automatically, and changes requested in plain language turned into reviewed pull requests instead of console edits. The first reconciliation took two weeks. Keeping it clean now takes nobody's time.
Controls enforced on every deploy
Policy checks on each plan, approvals recorded, backups tested on a schedule, and the evidence exported continuously, so audit-readiness is a property of the pipeline rather than a project. When the partner asked again, the answer was a link.
Rightsizing with approvals
RDS and compute resized on real utilization, non-production environments scheduled, and each change approved by a DevLift engineer before it lands. The forgotten replica was the first thing to go.
Alerts that mean something
Monitors tuned so a page reflects customer impact, routed to a rotation that DevLift engineers join around the clock. Incident fixes now arrive as pull requests, so the code and the running system stay the same thing.
Results
What the next invoices showed.
Within the first sprint the team stopped touching infrastructure by hand. Changes that used to mean an evening in the console became a sentence in a pull request, reviewed and applied with a record attached. Terraform plans went back to showing only what someone intended to change.
Compliance stopped being a season. The controls the partners asked about are enforced on every deploy and the evidence is exported as it happens, so SOC 2 readiness became a matter of weeks rather than a project with a deadline. The bill came down as a side effect: the oversized databases, the idle replica and the always-on staging environment were the first rightsizing pull requests.
The founders are no longer the on-call rotation. DevLift engineers hold the pager, incidents are handled by people who know the stack, and the fixes land in code. The quote on this page is the version of that story the CEO of StartGlobal, Inc. tells.
“DevLift completely removed the ops toil from our sprint cycles. Instead of manually wrestling with IaC and chasing compliance drift, we rely on their platform to keep our environments stable and audit-ready. It's like having a senior SRE on staff 24/7.”
What we learned
Three things we'd tell a peer.
- Reconcile before you optimise. Rightsizing an environment that has drifted from its code only creates more drift.
- Evidence collected continuously is cheaper than evidence collected annually, and it is the only kind an auditor believes without a follow-up question.
- For a team under ten engineers, a rotation you can join beats a hire you have to train.
Timeline
How the engagement ran.
- Week 1
Audit and reconciliation plan
Read-only access, drift inventory, and a list of every control the audit would ask about.
- Weeks 2 to 6
Reconcile, enforce, resize
Infrastructure back under Terraform, policy checks in the pipeline, evidence export, and the first rightsizing changes.
- Ongoing
Managed DevSecOps
DevLift engineers on the rotation, monthly cost reconciliation, and audit evidence that is always current.