Flourish & Thrive Labs built SOC 2 and HIPAA compliance directly into their HR, IT, and payroll platform, replacing Vanta and several other point solutions on the way to cutting out 50 hours of admin work a month.
How Flourish & Thrive Labs Replaced Vanta with Rippling Automated Compliance
50hrs/mo
Saved by consolidating tools89%
HIPAA compliant at setupEl problema
Flourish & Thrive Labs ran its HR, IT, and compliance operations across eight disconnected systems, including ADP for HR and payroll, QuickBooks for accounting, InTune for MDM, Harvest for timekeeping, Easy Llama for training, and finally, Vanta for compliance.
Every new hire meant reentering the same information multiple times, and getting SOC 2 compliant meant manually duplicating policy sign-offs between Rippling and Vanta. The team estimated roughly 65 hours a month went strictly to keeping those systems in sync.
La solución
Flourish & Thrive Labs consolidated all those tools into one platform with Rippling, including Automated Compliance to replace Vanta for SOC 2 and HIPAA, and Helpdesk to replace a manual access request process. Because compliance runs on the same HR and IT data Rippling already holds, new frameworks like HIPAA started nearly 90% complete from day one.
IndustryHealthcare
Número de empleados10-20
Sede centralGrayslake, Illinois
En esta historia
Meet Flourish & Thrive Labs
Flourish & Thrive Labs builds PH360, an AI operating system for public health, giving local, state, territorial, federal, and tribal health departments the tools to run everything from safe AI access to environmental health inspections and case management. Because the company provides healthcare services to its public health customers, it has to meet HIPAA requirements in addition to its own SOC 2 obligations.
The Challenge
Before Rippling, the team was running HR and payroll through ADP, timekeeping through Harvest, training through Easy Llama, accounting through QuickBooks, and device management through Intune, on top of running their GRC (governnace, risk, and compliance) program in Vanta. None of these systems talked to each other, so information had to be re-entered by hand every time something changed.
Policy sign-offs were the clearest example. Every employee reviewed and signed off on technology, finance, and HR policies in Rippling, then had to go into Vanta and click through the exact same sign-off a second time just to log it as evidence for the eventual audit.
It's been such a headache managing compliance with disconnected systems. We were running GRC in Vanta, duplicating the same policy sign-offs there that we'd already done in Rippling...
Now that everything's connected, I know exactly what needs to get done because it's right there in front of me. I don't have to go to a dozen different people to figure it out.
Jefferson McMillan-Wilhoit
CEO en Flourish & Thrive Labs
The Solution
Flourish & Thrive Labs consolidated their tool sprawl with Rippling, using Automated Compliance to replace Vanta -- first for SOC 2, and now for HIPAA.
Because those security frameworks rely on the HR and IT data that's stored in Rippling, adding HIPAA to the list didn't have to mean starting over from scratch. When the team turned on HIPAA, they were already 89% compliant based on the controls and monitors that the company had already set up for SOC 2. The remaining gap was almost entirely made up of new policies that needed to be written and signed off.
After setup, AI remediation actions quickly became the team's biggest time saver day to day. When Automated Compliance flags an issue, like a device missing encryption or an employee who skipped their security training, Rippling AI identifies the issue and scopes out a fix for the admin to approve. Compliance issues are flagged and resolved in the very same system, with no manual work involved.
It's not that we didn't add headcount. It's that we got to dedicate resources to building our product rather than our compliance program.
Jefferson McMillan-Wilhoit
CEO en Flourish & Thrive Labs
Access requests tell a similar story. Previously, a team member needing expanded AWS access had to submit a request, wait for someone to manually configure it, then test and confirm it worked, a process that could take four to five hours every time. With Helpdesk, the same request goes to Rippling and automatically grants or denies access according to Flourish & Thrive's policies, cutting that once-manual set of steps down to a couple of minutes.
Finally, Flourish & Thrive can now host all of its security and compliance documentation on a custom trust center hosted by Rippling, allowing their partners, prospects, and customers to see and request whatever they need. No more rush requests to track down their SOC 2 report or answer a lengthy security questionnaire.
The Impact
65 hours to 15 hours a month in system maintenance and overhead, freeing up a team member to work on product instead of managing compliance and access requests full-time.
89% of HIPAA compliance already complete at turn-on, carried over automatically from the company's existing SOC 2 controls and monitors.
Access requests cut from 4-5 hours to a couple of minutes with Rippling Helpdesk replacing a manual, email-based approval process.
My first question when I saw this come out was: why didn't you make this sooner?
Jefferson McMillan-Wilhoit
CEO en Flourish & Thrive Labs
See Rippling in action
Discover how Rippling can help you manage all of your employee data and operations in one place.