A year ago this month we officially started GoodStream. This week the auditors handed us a clean SOC 2 Type 2 report. This is my seventh startup, and it has not been like the others. Let me count the ways.
The report first
An independent CPA firm tested our security controls over a three-month period and found no exceptions. A Type 2 is not a badge you buy; it is an auditor's opinion that the controls you describe were in place and operating for the whole period. We got there in year one because we built for it from the first commit. Every document a customer hands us is somebody's confidential IP: a cap table, a side letter, a financing that has not been announced yet. We are never casual about that, so we built from the ground up to be secure. The details, the auditor, the period and the questionnaire block are on our security page, and the report itself is available under NDA.
That's just the beginning of what is different about building an AI-native startup. Here are seven more that have surprised me.
1) Momentum
Over the year we averaged about 30 pull requests a week. The last three months ran at 45. Last week we merged 70. At my prior companies velocity peaked early and sagged as the codebase grew, because every new feature added weight and every fix was a one-off. Here it climbs, because every fix gets folded back into the tools that do the next one. The factory gets better at building the factory.
2) Everyone builds
We have 14 people and every day all 14 contribute directly to building the product. Ops writes a ticket in the morning and an agent has a draft PR up by lunch. Product runs its own QA sweeps. Finance ships. Nobody here is non-technical anymore, and I've stopped hiring as if some people are.
3) Autonomous AI developers
AI agents pick tickets off the board, build them, open PRs and report how much they spent. Humans move from being the builders to being the approval gates. That changes what a good engineer does all day: less typing, more judgment about what should exist and whether what came back is right.
4) The feedback loop
Early on, seven venture firms connected their portfolio documents to us as design partners and told us what they wanted us to build every single week. What a design partner asks for on Monday is often live by Friday, and that has changed what a product roadmap means. A roadmap used to be a promise about next quarter. Now it is a queue that the customers reorder.
5) Security
The same agents that build the product collect the evidence, run the access reviews and flag the drift. Compliance stopped being a separate project with its own headcount and its own quarter. This is what allows for SOC 2 Type 2 in month twelve, on a pre-seed budget.
6) Tokens instead of headcount
When I want more done, the lever I reach for is a token budget, not a job req. It resets my instincts about hiring, about how much one person can own, and about how ambitious a quarter is allowed to be.
7) Superpowers make people more valuable
The productivity, scope and impact from each member of our team dwarfs the global average. The fear was that agents would make people cheaper. What I see is the opposite: the person who knows what to ask for, and can tell when the answer is wrong, has never been worth more.
What year one taught me
None of this was possible even a year ago. We can do this thanks to AI, a rigorously designed software factory, and an incredibly smart and ambitious team. Most of the prior founder playbook stops applying when a small team is armed with superpowers, trust and a token budget.
I don't know what a company built this way looks like in year five. I know what year one looked like, and I'm proud of it. Thank you to our team, to our design partners, and to our investors who bet early.
Year two started this morning the way every day here starts, with a customer telling us what they want us to build. Let's go.
