The first thing a security engineer does when told to get SOC 2 ready is sigh. The second is to start a spreadsheet. Comp AI, a startup founded in 2025, is betting that both reactions can be replaced by an AI agent that has already mapped your infrastructure. Its platform connects to over 580 tools and cloud services, using those integrations to autonomously gather evidence, generate policies, and monitor for compliance drift across frameworks like SOC 2, ISO 27001, and GDPR [How does Comp AI automatically collect evidence, and which tools and cloud platforms does it integrate with? · Comp AI, 2026]. The company’s wedge is straightforward: replace the manual, spreadsheet-heavy grind of audit preparation with a continuous, automated system that treats compliance as a software problem.
The Agentic Architecture
At its core, Comp AI is not just another checklist manager with an AI chatbot bolted on. The platform is built on what it calls an open-core, agent-driven architecture. Instead of requiring teams to manually upload screenshots or run scripts, the system deploys AI agents that run continuously against live infrastructure. These agents pull data from connected services, map controls across multiple compliance frameworks to eliminate redundant work, and auto-generate audit-ready documentation [Comp AI Compliance Platform Review 2026: Open-Source Agentic Compliance | RockB, 2026]. The technical premise is that compliance evidence should be a byproduct of normal operations, not a quarterly fire drill.
The founders, Lewis Carhart, Claudio Fuentes, and Mariano Fuentes, come from backgrounds where scaling software and dealing with enterprise buyers was the core challenge. Carhart was previously Head of IT & Security at FutureOn and Head of Growth at Leap AI. Claudio Fuentes co-founded Leap AI, which reached $1 million in annual recurring revenue serving customers like Heineken, and also co-founded Noonshot, which was acquired [Perplexity Sonar Pro Brief, Unknown]. This collective experience in building and selling to technical teams informs the product’s developer-centric positioning.
Traction and the Open-Core Bet
Comp AI’s growth metrics, while self-reported, point to rapid early adoption. The company claims to serve more than 950 companies and have surpassed $7.5 million in ARR [Claudio Fuentes personal bio, August 2026]. A third-party revenue verification service using Stripe’s API reported the company generated $489,221 in the 30 days leading up to June 2026 [trustmrr.com, June 2026]. The team has scaled from 23 employees globally in July 2026 to a planned headcount of about 50 by the end of the year [Refresh Miami, July 2026]. This execution allowed them to secure a $2.6 million pre-seed round in August 2025, led by OSS Capital with participation from Grand Ventures and angels including the founders of Sentry and Supabase [PRNewswire, August 2025].
A key differentiator in a market dominated by closed SaaS is Comp AI’s open-core model. The platform offers a self-hostable option, which is a significant appeal for security-conscious enterprises and developers who want to inspect and control their compliance tooling. This approach also facilitates deeper, more automated integrations, as the system can be deployed closer to the data sources it needs to monitor.
| Metric | Value |
|---|---|
| Pre-seed Round (Aug 2025) | 2.6 M USD |
| Monthly Revenue (Jun 2026) | 0.49 M USD |
| Reported Customer Count (Aug 2026) | 950 companies |
| Global Headcount (Jul 2026) | 23 employees |
The Incumbent Challenge
Comp AI is entering a space defined by well-funded, established players. Drata and Vanta have become synonymous with compliance automation for startups, having raised hundreds of millions in venture capital and built large customer bases. Their playbooks are proven. For Comp AI to displace them, its technical differentiation must translate into tangible customer outcomes that are difficult to replicate.
The company’s answer rests on three pillars:
- Integration depth. With over 580 supported integrations, the platform aims for a level of automated evidence collection that reduces manual work to near zero [How does Comp AI automatically collect evidence, and which tools and cloud platforms does it integrate with? · Comp AI, 2026].
- Cross-framework efficiency. The AI-driven control mapping across SOC 2, ISO 27001, HIPAA, and GDPR is designed to eliminate the redundant work of pursuing multiple certifications separately [Comp AI Review 2026: Open-Source AI Compliance Software, 2026].
- Architectural openness. The open-core, self-hostable model offers a level of control and customization that closed SaaS platforms cannot, appealing to a segment of the market that prioritizes this flexibility.
The risk is that the incumbents are not static. They have the resources to rapidly add AI features and expand their own integration catalogs. Comp AI’s bet is that its native, agentic architecture and open-core approach create a structural advantage that is harder to copy than a feature set.
Technical Breakdown and Scale Risks
From an infrastructure perspective, Comp AI’s model introduces interesting tradeoffs. The promise of continuous, automated evidence collection shifts the compliance workload from periodic human effort to constant computational load. The system must not only query APIs but also understand context, correlate events, and generate coherent narratives for auditors. This is a non-trivial machine learning problem, especially when ensuring the AI’s outputs are consistently accurate and audit-ready.
The platform’s reliance on a vast integration network is both a strength and a potential point of failure. Each connected service represents a dependency; an API change or outage could break an evidence collection workflow at a critical moment. At scale, maintaining the reliability and security of over 580 distinct data pipelines will require significant engineering investment. Furthermore, the more automated the system becomes, the greater the "blast radius" if a logic error in an AI agent leads to incorrect or missing evidence across hundreds of customers simultaneously.
The next twelve months will be about proving that the architecture holds under the pressure of enterprise deployments and more complex audit scenarios. The planned hiring push, focusing on product, engineering, and growth roles, suggests the team is preparing for this scaling phase [Refresh Miami, July 2026]. The milestone to watch is whether Comp AI can convert its early traction with startups into validated case studies with larger, more regulated enterprises, where the stakes for compliance automation are highest and the willingness to try a new architectural approach will be truly tested.
Sources
- [PRNewswire, August 2025] Comp AI secures $2.6M pre-seed to disrupt SOC 2 market | https://www.prnewswire.com/news-releases/comp-ai-secures-2-6m-pre-seed-to-disrupt-soc-2-market-302519788.html
- [Refresh Miami, July 2026] AI compliance startup plants its HQ here, plans to hire 20 to start | https://www.refreshmiami.com/ai-compliance-startup-plants-its-hq-here-plans-to-hire-20-to-start/
- [Claudio Fuentes personal bio, August 2026] Personal bio page
- [trustmrr.com, June 2026] Revenue verification via Stripe API | https://trustmrr.com
- [How does Comp AI automatically collect evidence, and which tools and cloud platforms does it integrate with? · Comp AI, 2026] Product documentation | https://www.trycomp.ai/
- [Comp AI Compliance Platform Review 2026: Open-Source Agentic Compliance | RockB, 2026] Platform review | https://rockb.com/
- [Comp AI Review 2026: Open-Source AI Compliance Software, 2026] Product review
- [Perplexity Sonar Pro Brief, Unknown] Founders and company background
- [Grand Ventures, August 2025] Why We Invested in Comp AI | https://grandvcp.com/why-we-invested-in-comp-ai/