# How Bluejay unlocked enterprise growth with SOC 2, HIPAA and GDPR **The Challenge:** Enterprise customers were evaluating Bluejay on risk, not just performance, and a six-figure contract depended on a SOC 2 Type 2 report within a three-month POC window. **The Solution:** Probo worked alongside the team to take Bluejay to be audit-ready for SOC 2 Type 1, then to Type 2, then extended the same controls to HIPAA and GDPR as the company moved into healthcare and Europe. **The Results:** - SOC 2 Type 1 and Type 2 reports issued, with the next Type 2 audit period already underway - HIPAA compliant, safeguards in place for healthcare deployments - GDPR program in place for European enterprise prospects - Security posture published on a public [trust center](https://compliance.getbluejay.ai/en) ## About Bluejay [**Bluejay**](https://getbluejay.ai/) is building testing and observability for voice AI agents. Teams use it to simulate real-world conversations, test edge cases, and monitor voice agents in production, so failures get caught before they reach users. Its customers deploy voice agents in healthcare, finance and other regulated industries. The calls carry health data, payment details and regulated workflows. Bluejay already works with enterprise customers like Google, DoorDash and Navan. In that market, performance gets you in the room. Trust is what closes the deal. ## Enterprise deals don't wait for compliance As Bluejay started selling to larger companies, compliance quickly became the gate. Enterprise buyers weren't only testing the product. They were assessing risk. The requirements kept stacking up: - SOC 2 Type 2 for production deployments - HIPAA for healthcare use cases - PCI DSS questions for agents that take payments over the phone - SSO and identity management - SLAs on response and resolution times - Mandatory cyber insurance In one case, a six-figure enterprise contract depended on completing SOC 2 Type 2 within a three-month POC window. Meanwhile, Bluejay kept shipping. The team grew from 3 to around 10 people, hired across engineering and go-to-market, and moved upmarket toward larger, more regulated customers. They needed compliance. They couldn't let it stall the roadmap. ## Why voice AI makes compliance harder Bluejay sits at a difficult intersection. Voice data often contains sensitive information. AI agents process and generate that data in real time. The infrastructure spans AWS, databases, APIs and logging tools. Customers expect enterprise-grade guarantees from day one, and they want continuous monitoring, not a point-in-time audit. And all of this was happening while Bluejay shipped new features and handled custom requests from enterprise customers. Security had to keep pace with the product, not trail behind it. ## Working with Probo: compliance built into how Bluejay ships Bluejay partnered with Probo to run compliance as an ongoing engineering practice instead of a one-time audit. ### SOC 2 Type 2 inside a three-month window The first milestone was [SOC 2](/blog/2025-10-28-what-is-soc2). Bluejay completed its Type 1, then ran a three-month [Type 2 observation period](/blog/2025-10-09-how-long-for-soc2) and received its Type 2 report in late 2025. That report carried the enterprise security reviews required for production deployments. Bluejay is now in its second Type 2 audit period, so the report stays current. ### HIPAA for healthcare deployments To support healthcare customers, Bluejay put in place: - HIPAA policies covering how health data is handled - Access controls and audit logging across production systems - Business Associate Agreements with customers and vendors - Infrastructure and log retention aligned with HIPAA expectations That lets them deploy voice AI in regulated healthcare environments with confidence. ### GDPR for European enterprise As European enterprise prospects came in, GDPR became the next requirement. Rather than starting a separate project, Probo extended the controls Bluejay already had, with DPAs in place for customers and vendors. ### A PCI DSS path for voice payments Some customers want voice agents that take card payments over the phone. Probo helped Bluejay scope what that means under PCI DSS: which systems would touch card data, and which controls apply, from quarterly network scans to supporting policies. > We had real enterprise pressure: tight timelines, high expectations. Probo helped us move fast on SOC 2 and HIPAA while making sure everything was done properly. — **Rohan Vasishth, Co-Founder of Bluejay** ## Security as a foundation, not a checkbox Bluejay took a security-first approach from day one. When your product sits inside conversations about health and money, there is no other way to build. Compliance is how they prove it. Their SOC 2, HIPAA and GDPR posture is now public on their [trust center](https://compliance.getbluejay.ai/en), so prospects can review it before the first security questionnaire lands. Working with Probo lets Bluejay stay ahead of new requirements without losing focus on what matters most: building the product, the right way.