GitClear helps development teams understand engineering bottlenecks through code-level metrics. Because customers often grant GitClear access to code repositories, the company needed SOC 2 and ISO 27001 certifications to strengthen trust and streamline security reviews.
Matthew Kloster, Director of Engineering at GitClear, was spending more time responding to lengthy customer security questionnaires. GitClear had some security policies in place and had completed a NIST Cyber Health Check, but customers were increasingly asking for SOC 2 and ISO 27001.
The team wanted to pursue certification, but they needed a partner that could provide a prescriptive process and understand their environment. Other options were too dependent on automated AWS integrations, which did not fit GitClear’s business because the company was not primarily AWS-based.
“Compliance is such a heavyweight thing to learn, so we wanted to make sure that we were doing it right. The idea of spending all the time and effort and not having a successful certification was horrifying.”
Matthew Kloster, Director of Engineering, GitClear
Thoropass helped GitClear move forward with SOC 2, ISO 27001, and penetration testing. The Thoropass team helped GitClear seamlessly transfer evidence from its previous GRC into the audit process while upgrading to the latest ISO 27001 version, saving the team time during implementation.
As GitClear prepared for the audit, Thoropass helped its team document existing processes, respond to evidence requests, and stay aligned to both frameworks. Regular check-ins and quick responses helped keep the work manageable for a small team.
“I’d ping our CSM on Slack or email her, and most of the time got a response within an hour. The consistent turnaround time was very impressive and instrumental to our success.”
Matthew Kloster, GitClear
During the SOC 2 observation period, Thoropass helped GitClear keep necessary evidence organized and accessible for audit review. GitClear also used Thoropass penetration testing services, with a test designed around the company’s web application and user flow.
GitClear achieved SOC 2 and ISO 27001 certifications within its four-to-six-month target. The certifications helped customers feel more confident in GitClear’s security practices and supported stronger lead generation.
The first thing we do with our customers is request access to their code repositories. Having these certifications definitely helps them to feel confident in making that step.
Matthew Kloster, GitClear
