Zencastr
00:00:00
00:00:01
Speed1x
Format
Share
Embed
Report

From Manual Spreadsheets to AI-Powered Compliance: How Konfirmity Built a Profitable Bootstrapped Startup

Scaling With Purpose
Scaling With Purpose

21 plays · Aug 31, 2026

Tanmay Naik, co-founder of Konfirmity, joins Scaling With Purpose to share how a frustrated fintech CTO's compliance headache turned into a security-first, managed-service compliance platform. Tanmay talks through starting profitable from day one, running audits by hand before building any software, the real cost of vibe coding without doing the manual research first, why they moved marketing automation off Paperclip after inconsistent output, hiring for attitude over experience, and building a no-hierarchy team culture. A candid look at bootstrapped SaaS growth across APAC, Australia, the US, and now Europe.

Transcript

Speaker: Welcome to Scaling with Purpose, the show where we explore what it takes to build companies that aim for commercial success and meaningful impact.

Speaker: I'm joined today by Tamey Naik, the co-founder of con Confirmity. It's a pleasure to have you here. Welcome. Good to be here.

Speaker: Thanks. Before we get into the story of Confirmity and what it is about and how you started, I always ask one single question to start to all our guests on this podcast.

Speaker: So the question is about the single most important lesson you have learned on your journey. So what would that be for Temei?

Speaker: So for me, it would be that I have learned over time that you cannot do things by yourself, even if you can, even if you wanted to, because it takes a village to build a man and a company is not built by one person alone.

Speaker: Even if you did, you will not go very far. So, yeah, I think a lot of founders, they find this ceiling where they are not able to push through on their own and suddenly they come to the understanding that, oh wait, I do need other people to get there. Yeah. I went through that multiple times myself.

Speaker: We have a saying in the Netherlands, um alone you can go fast and together you can come further. Yeah, very true. very true yeah I like that ah learning from you. Thanks for sharing that.

Speaker: So just to understand because you're the co-founder of Confirmity, what does Confirmity do exactly? So when we started out, my co-founder was the CTO of another fintech platform in Singapore.

Speaker: So the idea was his. right So he faced a lot of issues answering vendor security questionnaires, which he felt like this was not the job of a CTO, considering that you are a technologist, doing something manually when the technology exists is an insult to your ability to be able to code.

Speaker: yeah So he set out wanting to solve this via software. And initially, our mission was to simplify compliance so that we can make the job easier of doing this stuff.

Speaker: Over time we start. So in the beginning, the mission was help our help our clients get certified into ISO, SOC 2, certifications like that. But over time we discovered that the compliance industry relies too much on certifications and in the race to get certified fast, security is mostly ignored.

Speaker: yeah So we eventually pivoted towards security driven compliance. yeah So that we focus on security and compliance actually has something to back. Yeah, exactly. and Because there are quite some competitors you do have. Yeah. What makes you special?

Speaker: So without trying to downplay our competitors, I'm sure they are very good at what they do. What we have discovered is that when you throw a platform at your customer, you put the onus of learning how the platform works and how compliance works and how security works in general to the customer.

Speaker: And more often than not, they do not have that expertise that you have developed over years. yeah So what we have come up with for this is managed service kind of arrangement.

Speaker: where we kind of onboard them, help them, educate them on how to use the platform. And once they are capable of doing it themselves, we let them do it. Or if they want us to manage it for them throughout the entire course of the things, we do it for them.

Speaker: So that is, I think, the core differentiator for us. Yeah, exactly. So you also provide managed services, right? Yeah. Yeah. And ah let's say if we would want to become customers, how would that look like?

Speaker: So we usually book a demo call. We give give you an overview of the platform. We ask you what what are your requirements specifically because Depending on the type of company that you are, your security requirements will vary.

Speaker: For example, a product company will have different requirements compared to a services company. and So we tailor your requirements. We tailor the platform according to what you need.

Speaker: Like not all features are useful to everyone. Because at the end of the day, we also want our platform to actually be used. So we are also very open about telling someone, don't use our platform if it's not useful to you.

Speaker: Because yeah i we also don't learn. Yeah, exactly. And I think that dilutes also your mission and the the feature set you want to provide to people that ah do align with the target audience, I think.

Speaker: Yeah, exactly. It's very valuable. Yeah, so it's, of course, a very big subject, right? like I myself have not covered it yet over five years.

Speaker: Yeah, because I also have seen how many compliancy frameworks you support and it's like, okay, cool. It's a very big subject. So how did you start?

Speaker: So in the beginning, I'll only honestly tell you, i did not know that such a field existed. so Over time, I basically learned while building the platform.

Speaker: So where my co-founder used to get us the clients, it was through his network. ah And ah initially, when the platform was not up, we used to almost completely work through spreadsheets.

Speaker: So initially, like, mostly all audits happened through Excel sheets, screenshots, evidences like that. So to be able to build the software, we decided to manually do the things ourselves first so that we can understand where the gaps are, what we can automate and what we should do manually till we can automate it at the end.

Speaker: So in the beginning, we were mostly doing things manually. The product mostly was just a front. And over time, when we started figuring out what was needed, we started building the features out so that it was actually useful to always using it.

Speaker: Yeah, that's a brilliant way to start, right? So you can test, you can validate the market first yeah before you go and spend a lot of money building a certain software ah application. i mean, yeah now with VibeCoding,

Speaker: It's a little bit different story, right? But ah I think even with vibe coding, you would spend a lot of time, a lot of thinking, a lot of brainstorming, trying to to figure out things upfront before you really have the experience ah of of what it looks like when you really do the thing.

Speaker: I think the problem with vibe coding has gotten to the point where vibe coding makes you think that you have done the research. Yeah. Which is not true. Yeah, exactly. You need to do the manual work.

Speaker: Yeah. And you need to know the process. You need to but know every step before you can even prompt. Right. Yeah, exactly. Because it is so easy to prompt.

Speaker: ah We think that we don't need to do the learning. We skip the learning process. This is the thing that happened with me as well. When I discovered Cursor, I was the first in my team to adopt AI, like be an AI native.

Speaker: So I downloaded cursor and I was very happy because ah I personally have not enjoyed the act of coding. Like I enjoy the thinking part, the architecting part, the systems thinking part, but the actual manual work of coding, I'm not a fan of.

Speaker: So I was very happy when I could get an AI to do it for me. But ah I think two, three days in, I i introduced a bug in the code base and a junior engineer caught it.

Speaker: and he was wondering so the function was there but it did not do anything so the engineer was like why would Tanmay write something like this and he asked me and that is when I told him that I have been using this thing called cursor and that is how I introduced it that is when I started being a bit more cautious with AI that it's not a silver bullet for everything Yeah, exactly. So we weren't the first adopters of AI, I must be honest. And I was the last one to but adopt it, actually.

Speaker: But the thing is, when we started, we saw that certain people produced a lot of bugs. And it is as if they didn't read the specs.

Speaker: And we're like, what happened with this person? And we tried to dig deeper. And you know, there was a little bit of shame that the person was using AI. Okay, what would my boss think of it? Yeah, this was a lot in the beginning.

Speaker: Yeah. felt like you were avoiding your own work. Yeah, exactly. It's like cheating, right? Yeah. And at the end, this person, he told us that he was using AI to do it. And and we were very happy because in the end, you want a business value.

Speaker: And we want business value for our customers. So when he used AI, it would be a very nice way to provide business value to our customers. But we had a very bad experience with it.

Speaker: So... We try to understand how to make AI work for you in the right way. And it took us quite a while to get that working. Yeah.

Speaker: Now I can say we develop a lot leveraging AI, but it took us quite a while to understand, okay, what do you need to give the AI? What input, how to prompt it?

Speaker: and What context do you need to create for it to really understand your project? And all these stuff things that we were not aware of in the beginning, and now we are aware of. But to go back to the point,

Speaker: It's a great way to first understand the process of what you need to do. Yeah. By selling actually the service without leveraging too much, the software side too much.

Speaker: And also it prevents you from ah the need of investing a lot upfront to make an application and then test the application. And then also marketing validation, right?

Speaker: Yeah, for a long time, I was a bit embarrassed about the product because I was not being given enough time to actually polish it. yeah Because I have a little bit of a but perfectionist tendency to completely do something and only then move on to the next thing.

Speaker: But I was not given that time to actually polish. But I think it turned out great because a lot of the features that we thought about in the beginning, we did do them. But how they built up over time has changed a lot.

Speaker: If we had stuck to that one way of doing it, we would have been very badly prepared for the AI, like when AI came up. Yeah, so you're lucky that ah you already was father in the process yeah before AI. And now how do you leverage AI nowadays?

Speaker: I mean, besides coding.

Speaker: It's mostly around coding only. a So we started leveraging AI around December. where we started using it a lot more for internal tooling to make our work faster in CI, CD, for code review, don getting PRs raised and stuff.

Speaker: Now it has advanced a bit more where we have a GitHub action completely planned where if there are some smaller issues or specs to be built for some feature,

Speaker: We have an internal kind of like a chat bot you could say, where we just tag it and it builds a spec for you. It does the planning and it gives you the code as well. It's ah basically through PRs.

Speaker: So you can review the code and if it's working, then you can. Yeah, exactly. And on the other side, I'm also working on a, I'm not sure if you have heard of it, paperclip. Yeah, Paperclip, yes.

Speaker: Yeah. So I discovered Paperclip, I think in March and I was playing with it. And ah then we decided to start doing marketing via Paperclip where we decided to start automating marketing engagement on LinkedIn and Twitter through Paperclip.

Speaker: where we started getting leads. Like we would develop a lead list brand guidelines, stuff like that. So that agents can work autonomously 24 seven for it. That has been working well, but yeah.

Speaker: Yeah. So that's works for you. It works, but now we are hitting limits on that as well. Like paperclip, the software itself is getting, becoming a limitation. So now we have the the requirements established in what we need from paperclip.

Speaker: So we are building our own internal tool for it, which will specifically do what we want it to do. Yeah, exactly. So you outgrow actually the tool you're using. Yeah, it's etc a very interesting subject. There are ah people that are very opposing to using AI for marketing. And there are people that are like, yeah, this is the greatest thing that ever happened, right? So I'm always curious to hear the success stories and the failure stories because we haven't been very successful in automating marketing, honestly.

Speaker: What we have learned is that it's not easy for starters because in the beginning without proper prompting and skills it makes mistakes very often and the reason we are moving out from paperclip is also the same that the output is not deterministic like in the beginning when we set it up the output was acceptable and we made skills and prompts and everything It worked for like three weeks and by the fourth week, it was again back to producing bad outputs. So we have also added image generation to it via Gemini.

Speaker: okay Sometimes it creates very great images and sometimes it creates very bad images in spite of the same prompt. So

Speaker: we want to be able to create deterministic outcomes for everything that we do. So yeah that is the reason. Consistent output. Yeah. And are you running it without the human in in the middle?

Speaker: So, yeah. So right now what we do is it drafts post for LinkedIn and Twitter and ah we plan it for one to two weeks and then let it go.

Speaker: Yeah, yeah, So every two weeks we have to see, but mostly it's automated. Yeah. So you create batches and then... Yeah, actually I'm doing the same, but in a manual process, right?

Speaker: of batching for two weeks and then after two weeks we in need to refill the pipeline and that's how it works. or we need to know mean that It can go fully automated but since the output is not deterministic, we we are being cautious basically Yeah, exactly. And I think sometimes, you know, ah what I do myself is when I have a batch for two weeks, then some event happens and then I'm like, okay, I need to write about that.

Speaker: right yeah you change plans as you go and uh yeah this is life yeah yeah true yeah so that's ah also the question um so you started from word of mouth yeah and at a certain moment that probably wasn't enough to scale the business and then you needed to have some consistent flow is that directly when you started using paperclip or Yeah, so the goal of Paperclip was that only to get more demo bookings.

Speaker: So far, we are getting leads. We are just at the very start of GTM. and So most of our strategies are around getting SEO right and leveraging that traffic to get more bookings that is working now. So side by side, we are also doing social media where we are exploring different content formats and things like that.

Speaker: But yeah, so most of the AI things and paperclip is for getting focused on marketing now. Yeah, exactly. about your leadership team? Because I believe you suddenly had the need to do the marketing more consistently. Did you hire a person specially for that? Or how do you decide for what to hire for and what to not hire for?

Speaker: We usually what we have learned is that it's better to have some idea about what you want to be doing, what function you are doing. then So the overall trend that we have had over the last five years is that when something goes beyond your skill level, you ask for help, basically someone to consult with.

Speaker: yeah And so we don't hire until it's a proper job for someone. So right now, I shifted from coding to marketing, because coding is mostly solved for our team.

Speaker: one person can maintain the front and one person can maintain a backend so now i can do marketing fully and i there is enough time to learn so what we need is more of a freelancer kind of person which we had hired for a week or two to understand what what is basically needed to strategize basically once we got that then we were able to run through it ourselves so the preference is usually independence so Yeah, exactly. So you are first building the job for someone to hire him. and Yeah, because one more thing we have noticed is that if someone is work, like there's a very different culture in startups and bigger companies.

Speaker: In bigger companies, the person needs to have have a proper job function that this is yeah these are the things that I will do day to day. And this is how you measure the output. But in startups, this is not really defined.

Speaker: So okay for you to be able to hire someone and give them the job, you need to understand what the job is and how to measure it. That is what we try to do in the beginning.

Speaker: Yeah, exactly. And you know, and I come from corporate and I'm very used to thinking, in okay, this is the process. This needs to be done and someone needs to be the owner, right? yeah and These are his tasks and this is the output I need to get. so I need to place a person there and it will be solved, right?

Speaker: But ah especially if you're a startup, that doesn't work. So I also run, yeah, um yeah I guess that same ah challenge, let's say.

Speaker: ah When we were a startup, I tried to hire the corporate way. And I'm like, okay, this is the list of tasks you have. And this is what we expect from you and go.

Speaker: But the budget was like, A lot lower than the seniority level needed for the person to do it autonomously. yeah Yeah, they usually ask for more budget and you there's no way to justify it when you're a startup.

Speaker: You need to find creative ways to do the same thing. Exactly. So if you want to hire someone who runs it completely for you, then you need to have a big budget because that person would be normally working for a bigger company because he's in a leadership position there. So yeah, you need to have a little bit more knowledge to be able to hire a more junior person that you can pay as a startup in a normal situation. Junior people who are very, what do you call it?

Speaker: Proactive. Proactive. to find things, find solutions to things, find their own way to doing something. Like in startups, it's just this is what I want. This is the output I expect. You find a way to get there.

Speaker: That is not an environment in which most people thrive. no So it's rare to find people like that. Yeah, it's ah quite challenging, especially as they have not run this type of operation before.

Speaker: They need to find out how to solve this issue for the first time. Yeah, so that's definitely interesting. So how do you, ah let's say, assess the people you hire?

Speaker: you have a framework for that? Do you hire for experience? We mostly hire for attitude, like, because most of the people we have hired are early career people who know what they want. Maybe I've had a job, one job in the past, but mostly fresh.

Speaker: We give them everything they need to learn. But because we have noticed that when you hire skilled people, they come with their own ego, with their own requirements, their own very specific needs which you may or may not be able to fulfill and if they are talented and they don't know how to present that talent it also affects the morale of the rest of the team a so if the person is good you can teach the skills like in general if they are hard working sincere that's the quality is basically that you cannot measure but make them a good person you have on the team

Speaker: these kinds of things yeah So you're saying you're ah hiring for personality, even though they don't have experience.

Speaker: Yeah. yeah like They need to have a little bit, not like completely zero, but yeah. Yeah, because let's say I've seen people with a great personality, but it was very hard for them. They didn't have the capacity to learn something, right? yeah i mean, if you're only looking at capacity, that's also misleading. There's middle ground where you have to figure out because we have also had people like that who are very talented, but could not.

Speaker: like There's a sort of team culture that also develops, right? You have to make sure that They fit into the the team culture as well. definitely Definitely. And talking about team culture, what kind of team culture are you trying to create?

Speaker: So our team culture is basically where we take care of each other. We pick up each other's work wherever someone is finding it hard. We help each other basically.

Speaker: There is no hierarchy as such. Everyone does everything. Everyone helps everyone.

Speaker: Yeah, beautiful. But at the same time, accountability, isn't that tough in such a culture? ah We have had problems with accountability, but the entire team is a bunch of nice people, honestly.

Speaker: account ah Most of these people are accountable by nature. They feel ownership of whatever they are given. So, there's no need to actually enforce the need for accountability on our end.

Speaker: yeah Since we as founders also work just as hard, there is no need to enforce this kind of feeling that we need to be accountable.

Speaker: Yeah, exactly. So you have well motivated people already. This issue of accountability doesn't play a role at the current moment in time.

Speaker: Yeah. and Do you see that as a risk? Regarding the accountability? Yeah. That later when the team grows very big.

Speaker: um I'm not really sure. But I don't think we would have a problem with accountability. I think we should be fine.

Speaker: yeah Because i feel like the culture trickles down from the top. So Whoever does not fit, it's very clear by month two or three.

Speaker: Yeah, exactly. We don't need to do anything extra to find it out. Yeah, exactly. So you're close enough to the team to really spread the alignment to the team. So you don't need to ah check for accountability in a structured way.

Speaker: But you are there, so you feel when someone's work is lacking or it's not enough. Yeah. So anyway, when if someone is lacking, we come together to help them out.

Speaker: Usually the reasons are something solvable. There's nothing like we don't assume malicious intent. Yeah, beautiful. beautiful So, Tamay, can you tell me what are your ah dreams? Where do you want to scale?

Speaker: So, conformity, we want to be like, we want to be deliberate about growth. We don't want to spread ourselves too thin and not be able to service our customers.

Speaker: yeah So, we are taking it slow. But we'll see where it goes. There's no rush to be big because we have been profitable from day one. Even when we did not have a product, we had a customer.

Speaker: So yeah we are not worried about not being able to find customers. Yeah, beautiful. So your profitability is good. yeah That is very important.

Speaker: And you are doing it with ah quite a small team. You are serving yeah enough customers ah to survive and you can grow deliberately step by step. It's a privilege to have, honestly.

Speaker: and and And just thinking about geography, is it that you want to stay where where we are? Because what is the geography you're serving at the moment? oh APAC, Australia and US.

Speaker: oh Mostly APAC side. but we are also moving towards Europe and US. We have a couple of US, Europe lands. Yeah, there's a lot of compliance in Europe.

Speaker: yeah I can say that.

Speaker: ah Very interesting. But ah you're based in India yourself? Yeah. ah Do you also have a client base there? We have a few clients in India as well, but they are also multinational companies where they also open US, Australia.

Speaker: yeah So they need compliance there. And is the compliance market different in ah India?

Speaker: It's not taken as seriously as what I would tell you, but it's there, it's present. Okay, but it's different. that's yeah stuff So your product is actually validated in Australia and America, the US? Yeah.

Speaker: And ah you see an opportunity in Europe. Yes. Yeah, beautiful. yeah Lovely to see that. How can the audience help you? Is there something that you're thinking about that you say, okay, this is something people could could help me with?

Speaker: oh I would love to grow my network. Basically, i would love to meet more founders, people like you. Yeah, then yeah, let's say ah before i tell you how I enjoyed our conversation, because I really enjoyed it.

Speaker: I want ah to ask you how we can follow you or get in touch with you. I'm active on Twitter. Twitter. Okay. Yeah, Twitter and LinkedIn.

Speaker: And the handle is? The handle is blazephoenix2. Blazephoenix2. Yeah. All right. So we will ah also ah write that down in the in the podcast so people can find you on Twitter.

Speaker: And on LinkedIn, it's always easy. It's your first name and last name, right? Yeah. I found you at the end.

Speaker: Yeah, wonderful. Then... I want to thank you a lot, Tame, for all these insights you have given us and ah the transparent view into your company.

Speaker: I really enjoyed talking to you. And there were certain points that... ah view differently but it's also refreshing to hear from your side how you view them so you can you can test out different ideas in your brain just to see okay do other people think about this and and uh we can only improve our way of working by hearing ah how things work for other people so thanks a lot for this insight

Speaker: and the past five years i have been keeping my head down and working so i've not been able to grow my network as much yeah so i but i believe that discussing and debating about things is where ideas are born so i would love to chat just like that if you're free anytime Yeah, like ah let's catch up later. And yeah, a lovely to have you on the podcast. Thanks a lot for the episode. And of course, we'll chat afterwards. saha Have a good day.

Speaker: Thank you. You too.

Speaker

Speaker

Speaker

Speaker

Speaker

Speaker

Speaker

Speaker

Speaker

Speaker

Recommended