AlignHQ tracks your controls, evidence, and cloud checks, so a customer’s security questionnaire stops costing you a week. OrbitHQ shows what hiring, cloud spend, AI bills, and expiring credits do to runway before you commit.
Control health
SOC 2Runway w/o credits
−3.6Reported runway says 10.8. Credits are not cash.
Cloud credits expire in 73 days
Monthly cloud spend of $8,400 is currently partly offset. Cash runway drops from 10.8 to 7.2 months after expiry.
One comes from a customer. One comes from your own numbers. Most teams answer both late.
A buyer sends one mid-deal. They want control status, current evidence, named owners, and policies people actually signed. Your evidence sits across four clouds, three drives, and someone's inbox, and a third of it is out of date.
Answer it from one screen, with evidence dates attached.
Credits hide the real cloud bill. Inference spend grows faster than revenue. Two hires start next quarter. Each of those moves runway, and the spreadsheet gets rebuilt by hand once a quarter, after the decision is made.
Answer it before the decision, not after the quarter.
Compliance readiness · align.buildhq.io
One workspace for controls, evidence, cloud checks, policies, training, risk, remediation, and the trust page you send customers. Connect your systems and AlignHQ maps what it finds to the requirements that apply to you, then shows what is failing, what is out of date, and who owns it.
Every artefact carries its control mapping, owner, and collection date. Evidence that has gone out of date shows up before an auditor asks for it.
Continuous technical checks across 17 live connectors. Results arrive as findings, tasks, and control status rather than another alert feed.
A public page for your security posture, with gated private documents, access requests, and security report intake. Answer diligence once.
An inventory of the AI systems you build and use, with EU AI Act role classification, obligation assessments, and ISO 42001 evidence.
AlignHQ
Northwind AI
Compliance
Readiness overview
SOC 2 · observation period starts in 21 days
68
Controls passing
7
Open findings
12
Stale evidence
Open readiness gaps
Runway planning · orbit.buildhq.io
OrbitHQ
Northwind AI
Planning
Compare: baseline vs hire two engineers
Recomputed 2 seconds ago · marked “hire plan”
Baseline
7.2 mo
Runway w/o credits
Hire plan
5.1 mo
Breaches 6-month floor in Nov
Burn composition
Stagger the second hire by one quarter. Runway holds above the 6-month floor through March and the margin trend stays flat.
Model what hiring, cloud spend, AI costs, revenue changes, and credit expiry do to runway before you commit. OrbitHQ keeps the financial model and the technical cost drivers in one place, then ranks what is most likely to cut runway first.
The number to watch
Runway without credits, recalculated on every input change and shown next to the reported number. The gap between the two stops being a surprise.
Traffic doubles. Credits expire on schedule. AI cost spike. Hire two engineers. Enterprise customer added. Revenue slows 20%. Reduce software and tooling spend. And your own.
Every risk comes from a rule you can read. Each one shows its severity, the inputs behind it, and the actions that buy back the most runway.
Update inputs, read what changed, run one scenario, record the decision. The founder review export is built from that history.
Management-grade statements and a DCF exploration with a sensitivity table, generated from the same operating model as the dashboard.
Each product answers its own set. Nothing here needs the other one running.
Can we answer this security questionnaire without a fire drill?
Which controls are failing right now, and who owns the fix?
Which AI systems do we run, and what obligations attach to them?
What is our runway once the credits are gone?
If we hire two engineers next quarter, when do we breach target runway?
Are AI costs compressing gross margin faster than revenue is growing?
You start from a seeded program with the controls, policies, and monitors already written.
5
Framework packs
SOC 2, ISO 27001, ISO 42001, EU AI Act readiness, NIST AI RMF + GenAI Profile
95
Seeded controls
Across 26 categories and 59 requirements, cross-mapped between frameworks
55
Policy templates
Two variants each, versioned, with acknowledgement tracking
17
Live connectors
AWS, GCP, Azure, Cloudflare, GitHub, Google Workspace, JumpCloud, Tailscale, Bitwarden, OpenAI, Anthropic, Slack, Linear, Jira, Brex and more
71
Automated monitors
Running against those connectors and writing straight into control status
8
Scenario templates
Plus your own, each recomputed in under two seconds
The operating scenarios founders actually worry about, seeded and ready to run.
The account is shared. Which product someone opens depends on the job.
Where runway is going, which action buys back the most time, and whether a security review is holding up a deal.
Which cloud checks are failing, and whether the current architecture is what is driving variable cost up.
An operating model the board can follow, with statements and plan-vs-actual built from the same inputs.
Control status, evidence age, named owners, the gap list, and a trust page that answers most diligence without you.
One repeatable review workflow across every company you support, with export-ready operating summaries.
Both products read from accounts you connect. Here is what happens to the access you grant, and what each one asks for.
Read-only, to collect evidence and run monitors. It writes nothing back to your accounts.
Xero and AWS Cost Explorer on the Growth plan. Everything else can be entered by hand.
Each connector credential is encrypted with a per-workspace AES-256-GCM data key. That key is itself wrapped by an account key held in Cloudflare Secrets Store.
Rotation runs on a schedule, automatically. You can also force a rekey on demand from the workspace.
Credential access and rekey events are written to the audit log in your own workspace, where you can read them.
AWS connects through a read-only AssumeRole with an external ID. GitHub uses short-lived installation tokens, never long-lived user tokens.
Every row is scoped to a workspace and enforced in the API layer, with owner and member roles on top.
Full workspace export in JSON and CSV at any time. Deleting a person anonymises their records rather than leaving them behind.
The two products are priced separately, and you can run either one on its own. We size the plan around your team, your frameworks, and your cost base, then send a quote. Every engagement starts with a 30-day guided pilot on your own data.
One framework pack, the seeded control set, evidence vault, policy library, and a starting set of connectors.
First audit, one standard in scope.
All 5 framework packs, all 17 connectors and 71 monitors, Trust Center, AI system governance, and audit packages.
Multiple standards, enterprise buyers in the pipeline.
Multi-client management for fractional compliance advisors, with a repeatable implementation workflow.
Priced per client book.
One workspace, manual entry across every module, burn-risk dashboard, runway without credits, scenario planner, founder review export.
Pre-seed teams building a first baseline.
Adds Xero and AWS Cost Explorer imports, scenario history, decision logging, sharper alerts, and the shared founder/CTO workflow.
Seed and Series A with real cloud or AI cost exposure.
Multi-company visibility and repeatable founder review workflows for fractional CFOs and platform teams.
Priced per portfolio.
Running both? We quote them together.
You keep every export you generate during the pilot.
Compliance and startup finance both attract overclaiming. Here is our boundary, written down.
AlignHQ does not guarantee a SOC 2 attestation or an ISO certification, and it does not replace your auditor, assessor, certification body, or counsel. It gets you ready, and keeps you ready.
OrbitHQ does not forecast with a model. Every risk and recommendation comes from a rule you can read, with its inputs shown next to it.
Neither product replaces a SIEM, an EDR, a vulnerability scanner, a bookkeeping ledger, or an ERP. Keep the tools that do those jobs.
Cloud credits are never counted as cash. That one rule is why the runway number here comes out lower than the one in your spreadsheet, and closer to right.
Thirty days, guided, on your own data. Pick the product that matches the question in front of you. You do not have to take both.
Connect one cloud account and see your control status by the end of the first session.
Start an AlignHQ pilotEnter last month's numbers and read your runway without credits in the same sitting.
Start an OrbitHQ pilot