SaaS
APAC

VergeWorks

Singapore-headquartered dev tooling company with 60 employees and enterprise customers in JP, AU, and SG.

Systems
  • GitHub Enterprise Cloud
  • AWS (Singapore + Sydney)
  • Customer auth via SAML
Regulatory exposure
  • PDPA (SG)
  • Privacy Act (AU)
  • APPI (JP)
Relevant frameworks
  • SOC 2
  • ISO 27001
  • MAS TRM (in progress)
Top risks
  • Cross-border data transfer into US
  • GitHub org compromise
  • Customer SSO misconfiguration
Control priorities
  • SAML enforcement
  • Cross-border data flow documentation
  • GitHub branch protection
Audit concerns
  • SAML evidence across the customer base
  • Cross-border DPA evidence
Your task
You are the first GRC hire. Write the first 90 days for a one-person program: what do you build, what do you defer, and what gets you the most audit mileage first?
Vendor risk
Single-region AWS dependency; GitHub Cloud concentration.
BCP/DR
Cross-region hot-standby; quarterly failover only.