Show HN: Lumoar – Free SOC 2 tool for SaaS startups
71 asdxrfx 28 5/12/2025, 7:05:03 PM lumoar.com ↗
We built Lumoar to help small SaaS teams get SOC 2-ready without paying thousands for Big 4 consultants or dealing with bloated compliance platforms.
As a startup ourselves, we faced the usual issues: long security questionnaires, confusing audit requirements, and expensive tools that felt overkill.
Lumoar is a simpler alternative: - Generate compliant SOC 2 policies automatically - Track your controls and progress in a clean dashboard - Upload evidence and get plain-language recommendations - Designed for engineers and founders, not compliance pros
It's free to start — you can generate policies and explore the dashboard without a sales call or demo.
Would love to hear what blockers you’ve faced with SOC 2 and what other frameworks you’re thinking about (e.g., ISO 27001, GDPR). All feedback is welcome.
As someone who don't know anything about SOC2, but still aware that if I want to signal 'data privacy' that I need to get it: I don't know what I'm supposed to do on your site.
Some sort of onboarding can help, like what are my steps from knowing nothing to actually getting the SOC2. Maybe some educational contents or resources can also help.
Is Lumoar SOC2 compliant?
Free in your case is not free, it's pretty expensive. If I can't comply in time, that might mean losing potential business, being late to the market, etc.
Good luck though, you made the first step.
Tis a great way to engender trust in the team. Bravo for bravely answering honestly. Wishing you folks best of success.
The compliance pros still want all their ceremony - it's most of what they sell.
[1] https://www.lumoar.com/terms-of-service.html
Access to fetch at 'https://api.lumoar.com/v1/auth/register' from origin 'https://www.lumoar.com' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
> Error: Failed to fetch
Not a good way to debut
https://news.ycombinator.com/shownew
I see nothing wrong with this post. They're sharing something they've made and getting valuable, constructive feedback. I appreciate HN being one of few places that still happens at.
If I was building a HTTP Inspector tool, you wouldn't call it a Hypertext Transfer Protocol (HTTP) Inspector tool.