Welcome back to The Security Signal, our biweekly dispatch on what actually matters in security and compliance.

Let's get into it.

"Secure by default" isn't the same as secure. Security firm UpGuard found around 16,000 databases hosted on Supabase with personal data exposed, including names, addresses, phone numbers, and passwords. This wasn't a hack of Supabase. It was thousands of teams shipping without checking their settings. Your vendor can hand you safe defaults. Only you can keep them that way.

A real email domain isn't a real request. Revolut handed sensitive customer information to a scammer who sent requests from a legitimate government agency email domain. That included copies of passports and driver's licenses. Nothing was hacked. Nobody picked up the phone to double-check.

Nine months, zero alerts. The Pentagon is notifying about 3 million people that their records were accessed by unauthorized users. The intruders went unnoticed for about nine months, and the data was stored entirely unencrypted.

Every ID scan you keep is a liability. Japanese car-sharing service Times Car confirmed that about 6.6 million accounts were compromised, including images of identity documents. If you don't need it anymore, don't keep it.

Takeaway: Attackers rarely need to be clever. They just need one basic you meant to get around to.

A misconfigured database. An unverified request. Unencrypted records. Data kept too long. None of these are new, and every one is already covered by frameworks like SOC 2 and ISO 27001.

That's their real value: not paperwork, but a list of gaps that have already hurt others, checked continuously instead of once a year.

Our Co-Founder & CEO, Varun Jain, also joined the Predictable B2B Success podcast to talk about growing B2B SaaS predictably without a big ad budget, including the two channels driving ComplyJet's growth and why support gets easier as you scale.

🎧 Listen to the full episode →

Takeaway: The best time to learn from a breach is when it happens to someone else.

Fragment Data Technologies builds AI data infrastructure for the enterprise. Their team already had strong security habits: locked-down AWS, enforced MFA, tight access controls. But enterprise buyers don’t buy habits. They buy evidence. Every new prospect meant another round of “walk us through your security” calls.

With ComplyJet, their AWS and GitHub environments were mapped to a structured control framework, evidence collection was automated, and the audit was coordinated end-to-end, with no compliance hire or consultants needed.

The result? A SOC 2 Type I report with zero findings within weeks of kickoff, and a live Trust Center that replaced security calls with a shared link. SOC 2 Type II and ISO 27001 are now both underway on the same foundation. When their CTO asked in Slack whether they had Type II yet, the order form was signed the same day.

Takeaway: Good security habits are a start. Proof is what closes the deal.

Breaches don't start with attackers. They start with a missing basic.

Supabase, Revolut, the Pentagon, Times Car: same pattern every time. The question is whether your compliance runs every day, or only when an auditor is watching.

For more breakdowns like this on security, AI & compliance insights,