Much like how 95% of brewing beer involves cleaning, 95% of compliance involves paperwork and audits. A ton of it. In a world where setting up a VPC (or its equivalent) is the table stakes for compliance, achieving the rest of your compliance takes a lot more work than setting up a private VPC. That&#x27;s true on Amazon or any other service.<p>The biggest thing to consider when adding another layer onto your compliant stack is how easily you can prove compliance when your customers ask. Whether it&#x27;s BAAs, SSAE 16 documentation or access to HIPAA or HITRUST audits, you need your partners to be able to provide you with not only the documentation but the expertise to discern what that documentation needs. When your partner decides to build something as an add-on to a stack like `Your product &gt; Heroku &gt; AWS`, you need to guarantee that the middle man can either answer all of your questions or can find the person downstream who can when it&#x27;s relevant. As we&#x27;ve needed to work with partners and considered doing add ons with compliance, this has been the #1 question we&#x27;ve needed to answer first. In a world where your customers should be willing to pay for compliance, the person you call on the phone with questions about what it takes to achieve compliance on their stack should be able to tell you from experience what it&#x27;s like going through a HIPAA, HITRUST or PCI audit.<p>Most of the documentation we&#x27;ve provided where I work on the subject is free online: <a href="http:&#x2F;&#x2F;catalyzeio.github.io&#x2F;policies" rel="nofollow">http:&#x2F;&#x2F;catalyzeio.github.io&#x2F;policies</a>. You can see through the forks that folks have used the documentation to prove compliance not only on our platform at Catalyze but also on other stacks like AWS.