How Clara Improved Risk Response by 60% With Sprinto

70% faster Security questionnaire responses

60% increase In risk responsiveness

4 weeks To go live with Sprinto after onboarding

Before Sprinto

After Sprinto

Clara wanted to unify audit management: with its first PCI-DSS certification underway, the required documentation was built manually across multiple documents and spreadsheets, with a ton of back-and-forth.

Clara automated evidence collection through Sprinto’s extensive integrations with its cloud stack (AWS, Github, BambooHR, Incident.io, and more), and cleared its PCI-DSS and ISO 27001 audits with zero findings.

There was no centralized system for monitoring, which made compliance reactive rather than proactive.

Clara now works from a real-time, consolidated view of risks, vendors, assets, controls, and evidence on Sprinto’s dashboard, making compliance proactive and risk responsiveness up to 60% faster.

Security questionnaires from prospects had to be answered manually every time, with documentation scattered.

Clara consolidated all of its vendor and security documentation in Sprinto’s knowledge bank, making questionnaire responses about 70% faster.

– Raquel Hernandez
VP of Engineering, Clara

“We’re actively monitoring our frameworks and working on what needs to be done to maintain our posture–whether that involves creating control and risk owners, keeping our risk register up to date, or regularly assessing our vendors. With Sprinto running automated checks we’re able to understand the state of our compliance in real-time.”

– Raquel Hernandez
VP of Engineering, Clara

Introduction

Clara operates in a tightly regulated business landscape, where compliance accelerates enterprise deals and builds trust with customers. To streamline audits, vendor assessments, and trust demonstration, Clara needed a platform that supported multiple frameworks, centralized documentation and evidence collection, and enabled real-time visibility and compliance monitoring through seamless integrations.

Raquel Hernandez, VP of Engineering at Clara, says, “Sprinto stood out for a few reasons–support for multiple frameworks out of the box, strong automation and integrations, and the team’s responsive, risk-first approach. Overall, the platform aligned well with our engineering culture.”

The Problem

When Raquel joined Clara, the company was in the process of getting its first PCI-DSS certification. Given the novelty of this mandate, evidence collection was manually driven and managed over multiple documents and spreadsheets.

“We were pretty much managing audits manually, so there was a ton of back-and-forth to build all the documentation we needed. We didn’t have a centralized system for monitoring, which made compliance reactive rather than proactive,” explains Raquel. Keen on unifying audit management, Clara set about scouting for a compliance platform that could centralize control monitoring, take over busywork by integrating with the company’s cloud stack, and bring visibility to Clara’s posture for enterprise prospects.

With Sprinto meeting these criteria and beating out other platforms on framework coverage, Clara decided to integrate with the Sprinto platform to pursue ISO 27001 and manage its PCI-DSS audits.

The Solution

Clara went live with the Sprinto platform in 4 weeks after onboarding. Starting from Sprinto’s policy templates, Clara customized and built out its own policy set and linked those policies to controls, set up the pre-built risk register, and leaned on the platform’s extensive integrations with its cloud stack (AWS, Github, BambooHR, Incident.io, and more) to start monitoring controls and auto-collecting evidence. Sprinto’s Common Controls Framework (CCF) let Clara identify overlaps between the ISO 27001 and PCI-DSS frameworks and reuse controls, minimizing duplicative work and shortening the path to audit readiness.

Clara additionally leveraged Sprinto’s BYOC (Bring Your Own Controls) to add custom controls for Brazil’s data protection regulation (LGPD), implementing those controls and mapping them to pre-built, automated evidence collection workflows wherever possible. With Sprinto’s dashboard producing a real-time, consolidated view of risks, vendors, assets, controls, and evidence, Clara could actively monitor posture, reduce compliance workloads, and make compliance management a shared responsibility across the company. Comparing audit prep on Sprinto with a manual approach, Raquel recalls that PCI audits at a previous company were pretty disruptive, with engineers pulled off the roadmap and an all hands on deck effort just to get through it.

“At Clara, we’ve been more proactive, the engineering team was able to move smoothly without having to pause day-to-day activities, even during pre-work for PCI audits,” she says. After monitoring PCI-DSS and ISO 27001 controls for 3 months and steadily moving to audit readiness, Clara took on both audits and cleared them with zero findings.

Impact

As Clara continues to manage PCI-DSS and ISO 27001 compliance on Sprinto, the platform’s purpose has expanded from a tool to organize audit readiness efforts to a core part of how Clara approaches risk, security, and compliance.

“Sprinto is part of our compliance backbone. Outside of helping us maintain continuous audit readiness we use the platform to manage third-party risks, align with evolving regulatory expectations, and as a driver of efficiency in compliance management,” says Raquel. Clara has made its vendor due diligence process more organized and centralized by bringing vendor documentation, breach monitoring, and risk tracking under Sprinto’s vendor risk management (VRM) module.

Clara has also made risk responsiveness up to 60% faster by connecting risks to controls on Sprinto, which accelerates risk identification.

“On Sprinto we get real-time information about risks, so we can stay one step ahead. We address risks as soon as they pop up,” Raquel adds. Efficient trust demonstration has been the cherry on top, in no small part due to Clara consolidating all of its vendor and security documentation in Sprinto’s knowledge bank.

“All the information’s centralized making it easy to respond when prospects send us questionnaires. We typically receive multiple requests, so it’s really nice to be able to scale trust instead of having to respond manually every time. I’d say we’re about 70% faster at responding per questionnaire,” explains Raquel.

Clara has now set its sights on bringing further degrees of automation to how it manages vendors and increasing its compliance footprint in Latin America and beyond as the company continues to scale.

“Sprinto has helped us shift the mindset around security compliance and embed it into our culture. As we continue to scale securely, we’re turning compliance into a strategic asset and not just a box to tick. Compliance is about trust building and operational excellence, and Sprinto has allowed us to leverage these for growth,” says Raquel.