Startup Deep Dive : Sprinto — the compliance nightmare its founders turned into a business

Before Sprinto existed, its two founders spent six months and tens of thousands of dollars trying to get their own previous company through a security audit, and still could not find a clean way to prove they were compliant. That failure, dated to the run-up to GDPR in 2018, is the entire reason a Bengaluru-and-San-Francisco company now automates SOC 2 and ISO 27001 paperwork for more than 3,000 businesses in 75 countries, as of March 2026.

Yet for a company that size, Sprinto discloses almost nothing about its own numbers. It has not confirmed a funding round since April 2024. Third-party trackers cannot even agree on whether its annual recurring revenue is closer to $20 million or $38 million for overlapping periods, and its reported valuation swings from roughly $91 million to $114 million depending on who is counting. This piece works through what is actually verifiable, and flags what is not.

Quick facts

What they do

Sprinto sells software that automates the grinding, evidence-heavy work of getting and keeping a security certification. A SaaS company that wants to sell to enterprise customers usually has to prove it meets a framework such as SOC 2 or ISO 27001, which traditionally meant weeks of screenshotting access logs, chasing engineers for proof of multi-factor authentication and assembling spreadsheets for an external auditor. Sprinto connects directly to a company’s cloud infrastructure, identity provider and HR system, pulls the required evidence automatically, flags gaps such as a terminated employee who still has system access, and hands auditors a live view instead of a folder of screenshots. Its buyers are mostly cloud-native, venture-backed technology companies in the United States and Europe that need a certification to win their own enterprise deals, plus a smaller base of Indian and other international SaaS firms.

The origin

Redekar and Kancherla had already built and sold one company together. They bootstrapped Recruiterbox, a hiring and applicant-tracking platform, from 2011 and scaled it to more than 2,500 customers before it was acquired by the San Francisco private equity firm Turn/River Capital in an undisclosed, all-cash deal at the end of 2017, according to Sprinto’s own account of its history and multiple founder interviews. Recruiterbox sold to enterprise customers, and enterprise customers asked for security questionnaires. As GDPR came into force in 2018, Kancherla found himself repeatedly answering the same questions: what data do you store, who can access it, how do you prove it. Getting properly certified took Recruiterbox roughly six months of effort and tens of thousands of dollars, and the founders concluded the problem was not unique to their company, it was universal to every cloud software business. In 2020, backed by a $1.5 million seed round from Blume Ventures, they set out to build what they called “compliance-as-code”: a product that treated a security certificate as something continuously monitored by software rather than assembled once a year by hand.

The struggle years

Sprinto did not have the head start its founding story suggests. By the time it launched in 2020, Vanta — the category’s best-known name, founded in 2018 by former Dropbox Paper lead Christina Cacioppo and backed early by Sequoia Capital and Y Combinator — had already been selling automated SOC 2 compliance for two years. Sprinto also launched the same year as Drata, a Los Angeles rival founded in 2020 that has since scaled to more than 8,000 global customers, according to Drata’s own site as of September 2026, roughly two-and-a-half times Sprinto’s reported 3,000-plus. Sprinto entered a market someone else had already started building, against a rival with a stronger investor brand from day one, and had to win the same buyers with no category awareness of its own.

The slower, less-told part of the story is funding pace. Sprinto raised its $1.5 million seed in January 2020 and did not close a Series A until February 2022 — 25 months later, a comparatively long gap for a security-software startup through the peak of the 2021 venture funding boom, when many peers raised follow-on rounds within twelve to eighteen months. And since its $20 million Series B closed in April 2024, Sprinto has not announced a further institutional round in the roughly two and a half years to September 2026, even as GetLatka and other trackers estimate its revenue kept climbing. In a category where well-capitalised rivals keep raising and re-raising, a long fundraising silence is itself a data point, whether it reflects capital discipline, an unannounced raise, or difficulty pricing the next round.

The turning point

The clearest inflection is the Series B. Before it, in the roughly 26 months since its Series A, Sprinto had raised a combined $11.5 million and was still a relatively unknown challenger. On 9 April 2024, Accel led a $20 million round — more than the seed and Series A combined — with existing backers Elevation Capital and Blume Ventures returning, taking total funding to $31.8 million (about ₹305 crore), as reported by TechCrunch, Entrackr and Inc42. Announcing the round, Sprinto said it had grown revenue threefold in 2023, more than twenty-fold since its 2022 Series A, and planned to scale its automation stack fourfold within twelve months; it disclosed, for the first time publicly, that it had crossed 1,000 customers across 75 countries with about 200 employees. A top-tier investor writing a round larger than everything the company had raised before it, on the back of those growth claims, marked the point where Sprinto stopped being a scrappy also-ran in a two-incumbent market and started being treated as a serious number three.

The money behind it

Sprinto has raised money in three confirmed rounds. It started with a $1.5 million seed in January 2020 led by Blume Ventures, which put an early, India-focused fund behind an unproven “compliance-as-code” idea before the category had a name locally. Elevation Capital then led a $10 million Series A in February 2022, with Accel and Blume Ventures both participating — a valuation of $40.5 million post-money at that point, according to CB Insights, citing Crunchbase deal data. Accel came back to lead the $20 million Series B in April 2024, again alongside Elevation Capital and Blume Ventures, taking total disclosed funding to $31.8 million. No named backer has publicly detailed what operational help it provided beyond capital, though Accel’s and Elevation’s continued participation across rounds — rather than a change of lead investor each time — suggests both were satisfied enough with progress to keep writing checks. Sprinto has not confirmed any funding since April 2024. The $90.7 million to $113.9 million valuation range reported by Tracxn and GetLatka respectively for 2024–2025 has not been confirmed by the company or by either lead investor.

How it makes money

Sprinto is a subscription business, not a per-audit service. According to a 2026 review by compliance-tooling site ComplyJet, pricing runs in four broad tiers: roughly $7,000–$9,000 a year for a single-framework starter plan suited to a smaller company doing its first SOC 2, up to $15,000 or more a year for enterprise customers running multiple frameworks across multiple business entities. There is no per-seat charge; price scales with company size, the number of frameworks a customer needs, and the complexity of its infrastructure. The mechanics: Sprinto connects to more than 200 systems — cloud providers such as AWS, Azure and Google Cloud, identity tools like Okta, code repositories such as GitHub, and HR platforms such as Rippling — and continuously pulls evidence rather than asking a customer to upload it once a year. Because the product is software monitoring cloud APIs rather than consultants doing manual audit prep, its estimated gross margin is high, put at roughly 85% by dossier site Clay.com, though that figure is a third-party estimate rather than a disclosed one. The part buyers often get wrong: Sprinto does not replace the external auditor. Customers still pay a separate accredited auditor to issue the actual SOC 2 or ISO 27001 report; Sprinto’s job is to make that audit faster and cheaper by keeping evidence continuously ready, with ComplyJet’s review citing customer claims of cutting audit preparation time by around 70% and reaching SOC 2 Type I readiness in 25 to 30 days.

The numbers

Sprinto is privately held and does not publish audited revenue or profit-and-loss figures. What follows are the closest verifiable figures, all attributed, unit-labelled in ₹ crore where a dollar figure is being converted.

The conflict between the two most recent ARR estimates is worth sitting with rather than smoothing over: one third-party tracker puts Sprinto’s annualised revenue near $38 million in September 2025, another puts it at “over $20 million” six months later, in March 2026. Both are outside estimates; Sprinto has not confirmed either number, and no audited filing was found to adjudicate between them.

Where the money comes from

By Sprinto’s own framing in its April 2024 funding announcement, the large majority of its customer base sits in the United States and Europe, even though the company was built and is still substantially run out of Bengaluru. Of the 75 countries it says it serves as of March 2026, the customers named in its own press materials skew toward venture-backed technology companies: Emergent, CodeRabbit, Anaconda and Whatfix were named in its March 2026 Autonomous Trust Platform announcement, while earlier coverage named Zipy, Giift, Shipsy and DataPlant. The surprise for a company with an Indian founding team and an Indian primary shareholder register is how little of its disclosed customer story runs through the Indian market: it reads far more like a global, cloud-native SaaS vendor that happens to be headquartered partly in India than like an “Indian compliance company” selling to Indian enterprises.

The risks

Three risks stand out, each with a specific mechanism rather than a vague warning. First, commoditisation from better-funded rivals: Vanta and Drata both compete for the identical buyer — a venture-backed company that needs SOC 2 fast — and both are, by their own published customer counts, larger than Sprinto; as all three vendors converge on similar “AI agent” positioning (Sprinto’s own March 2026 platform is explicitly branded “autonomous”), the risk is that compliance automation becomes a feature buyers expect from any vendor rather than a reason to choose Sprinto specifically, at a contract renewal cycle ComplyJet’s review describes as short — 30 to 45 days to close in the first place. Second, platform dependency: Sprinto’s core value depends on deep, continuously working API integrations with hyperscalers and identity providers (AWS, Azure, Google Cloud, Okta, GitHub and 200-plus others per ComplyJet, 300-plus per Sprinto’s own March 2026 release); if any of those platforms restricts API access, changes authentication models, or — more directly threatening — builds native compliance-evidence tooling of its own, Sprinto has to re-engineer around it or lose functionality that customers pay for. Third, disclosure risk: because Sprinto publishes no audited financial statements, every outside estimate of its scale disagrees, sometimes by a factor of nearly two, as this piece’s own numbers section shows; that opacity does not by itself indicate trouble, but it means employees, smaller investors and customers betting on Sprinto’s staying power have no independently verified way to check whether reported growth is translating into a sustainable, profitable business.

The takeaway

The transferable lesson is not “build compliance software.” It is that Sprinto’s founders did not go looking for a large addressable market on a slide; they went back to the single, specific, hourly-billed annoyance they had personally paid to fix at their first company, years earlier, and rebuilt it in software once they had the capital and time to do it properly. That origin gave the product an unusually literal design brief — replace the exact manual steps a compliance-hungry founder actually goes through — rather than a generic one. The risk in that approach is visible in Sprinto’s own numbers: a founder’s personal pain point can validate that a problem is real without guaranteeing the company solving it will out-fund or out-scale rivals who spot the same opportunity at the same time, as Vanta and Drata did within two years of each other.

Frequently asked questions

What does Sprinto do?

It sells software that automates the evidence-collection and monitoring work behind security certifications such as SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, connecting to a customer’s cloud, identity and HR systems to keep audit evidence continuously ready rather than assembled once a year by hand.

Who founded Sprinto, and when?

Girish Redekar and Raghuveer Kancherla founded Sprinto in 2020 in Bengaluru, after previously building and selling the hiring platform Recruiterbox to Turn/River Capital at the end of 2017.

How much funding has Sprinto raised, and who backs it?

Sprinto has raised $31.8 million (about ₹305 crore) across three disclosed rounds: a $1.5 million seed in January 2020 led by Blume Ventures, a $10 million Series A in February 2022 led by Elevation Capital, and a $20 million Series B in April 2024 led by Accel, with Elevation Capital and Blume Ventures participating throughout. No round has been confirmed since April 2024.

Is Sprinto profitable, and what is it worth?

Sprinto does not disclose profit or loss figures. Reported valuations for 2024–2025 range from about $90.7 million (per a Tracxn shareholding filing) to $113.9 million (a GetLatka estimate); neither has been confirmed by the company.

How is Sprinto different from Vanta and Drata?

All three automate similar compliance evidence-collection work, but Vanta (founded 2018) and Drata (founded 2020) have each disclosed larger customer bases and stronger-known investor backing than Sprinto’s reported 3,000-plus customers as of March 2026; industry comparisons, including one published by Drata itself, position Sprinto as more oriented to small and mid-sized businesses wanting multi-framework coverage at a lower price than Drata’s enterprise-leaning offering.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• TechCrunch, “Sprinto raises $20M to bring automation to security compliance management,” April 2024
• Entrackr, “Compliance automation startup Sprinto raises $20 Mn led by Accel,” April 2024
• Entrackr, “Sprinto raises $10 Mn in Series A round,” February 2022
• Inc42, “Sprinto Raises $20 Mn From Accel, Others,” April 2024
• CB Insights, Sprinto company financials profile (citing Crunchbase deal data, including January 2022 Series A valuation), accessed September 2026
• Tracxn, Sprinto company and shareholding profile (valuation as of an August 2024 filing), accessed September 2026
• GetLatka, “Sprinto Revenue 2025: $38M Est. ARR, $113.9M Valuation,” accessed September 2026
• Clay.com, Sprinto funding dossier, accessed September 2026
• ComplyJet, “Sprinto Review 2026,” accessed September 2026
• ValueForStartups, “Sprinto Investor Report 2026,” accessed September 2026
• Drata, “Sprinto vs. Vanta vs. Drata: An In-Depth Comparison,” accessed September 2026
• Vanta, company About page (founding year and background), accessed September 2026
• Drata, company About page (founding year and customer count), accessed September 2026
• PR Newswire, “Sprinto Launches Autonomous Trust Platform,” March 2026
• Sprinto, company blog and About Us page, and founder interviews (Authority Magazine; YourStory, December 2025) for founding history and the Recruiterbox background, accessed September 2026

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.