DevTools · Cloud & Infrastructure · 11–50 · Europe #b016_04

Our access reviews across offices and tools still live in spreadsheets, and proving them to auditors is painful. We need something that pulls entitlements from our cloud and internal apps, schedules recurring reviews, records reviewer sign-off, and exports evidence auditors accept. Single sign-on support is mandatory. Not urgent, but it should fit a small security team's budget.

We let our clients build AI health apps on our regulated platform, so guardrails cannot be one-size-fits-all. Each client needs its own configurable limits, and every setting must hold up in front of a regulator. A good solution gives per-tenant policy controls, audit evidence mapped to medical device standards, and proof it has worked in life sciences.

We test our controls by hand: sample reviews, walkthroughs, office documents, once a year. By the time evidence is gathered, it is already stale. We want evidence collected continuously, mapped to the several regulatory frameworks we answer to, and pulled from our ticketing and cloud tooling. It must not need a dedicated admin or a generic checklist.

Flaky tests are quietly taxing every release for us. A pipeline goes red, someone reruns it, and nobody fully trusts the signal anymore. Our codebase is mature and our tests have piled up over years. A good solution must work with our existing language and container stack, surface and quarantine unreliable tests, and show measurable gains in build reliability without a rewrite.

We wish a tool existed that flags compliance risks at project kickoff and tracks them through delivery, instead of catching issues late. We would judge it by per-project workflow tracking, a full audit trail, and whether it fits government accreditation reviews. Named enterprise support matters too. Consumer-grade tools without audit logs are a non-starter for us.

We are formalising our compliance programme ahead of a bank charter, and regulatory reporting is the gap. Today it is scattered and manual. A good solution must track regulatory changes, map them to our controls, keep exam-ready evidence in one place, and feed our existing ticketing. Bank partners will scrutinise any vendor, so credibility matters.

We run access across many segmented cloud accounts with single sign-on and role-based permissions, but periodic access reviews are still manual and slow. Drift between reviews goes unnoticed too long. A good solution must automate reviews across all accounts, flag drift quickly, and export audit trails for every admin action, because bank partners and examiners ask for proof constantly.

We run heavy performance and correctness testing on our engine and its connectors, and much of it is still slow and partly manual. We need automation that handles large JVM codebases, runs well for remote engineers, and includes benchmark tooling we can repeat. Budget is modest, so pricing must stay small-team friendly. Tools built only for small codebases won't work for us.

We run shared research workspaces where specialists in many countries analyse sensitive health records. Each new jurisdiction adds data protection duties we must prove, not just claim. We need a solution that maps obligations per region, produces audit-ready evidence on demand, fits inside customer-controlled cloud tenancies, and stays aligned with European health data space rules.