A compliance audit begins with a civilized request and ends, rather often, in an uncivilized number of screenshots. Meiran Galis learned this from the unglamorous end. Fresh from an information-systems degree, he joined EY's technology risk practice and collected evidence: logs, tickets, controls, reports. The junior work gave him an unusually clear view of a recurring corporate ritual. Growing software companies wanted to sell. Their prospective customers wanted proof that data would be handled properly. Between desire and deal sat SOC 2, looking like homework designed by a committee.
Six months into the job, Galis traveled to the United States for his first independent audit. He handled the gap analysis, meetings, documentation and final report. Two years later he was managing four auditors and work across more than 100 technology companies. The promotion mattered less than the repetition. Every company had its own systems and eccentricities, yet the scramble was familiar: chase evidence, translate standards, repair controls, promise that next year would be smoother.
Some founders encounter a startup idea as a flash. Galis met his as accumulated irritation. The official audit, he came to believe, should feel like an ordinary day at work. If it caused panic, the company had treated compliance as a ceremony instead of a system.
“The official audit should seem like any other day at work.”Meiran Galis
First came the explanation
Galis did not begin by announcing a platform. He began by writing a blog. On weekends, he translated security-compliance concepts for startup operators who had sales targets, small teams and no wish to become amateur auditors. The blog lived at SOC2.co.il, a narrow address for a narrow problem. Narrowness proved useful. It put his knowledge in public and made the audience visible.
An investor found the writing and wanted to talk. One meeting became another. Galis had spent years watching startups lose time to the same work; now someone outside the audit room saw a market in the pattern. He later described the evolution plainly: he had not set out to form a startup. He had set out to make the knowledge accessible. The company grew from the response.
The idea did not arrive alone
This is an appealing founder story because it contains no market-sizing theatre. The blog performed three jobs at once. It taught potential customers. It demonstrated that Galis understood their embarrassment without mocking it. And it tested whether the problem was painful enough for strangers to seek help. Writing was not decoration around the business. It was the first working version of the business.
A customer before a CTO
Scytale launched in 2021. Galis started alone, sitting in an empty office and thinking about how to recruit people capable of turning audit logic into software. Roughly six weeks in, he signed a customer in the United States. The good news came with a practical defect: there was still no chief technology officer.
So the domain expert played product architect. His information-systems education helped him sketch logic, entity relationships and mockups. He knew enough to describe the machinery, though not to build the entire machine. When a CTO joined around three and a half months later, Galis presented a sequence of features running from A through G and a schedule of about two months. The request was ambitious. The CTO's response, as Galis remembers it, was essentially: all right.
The episode captures Galis's favored operating mood: optimistic, under-instructed and moving. He advises would-be founders to accept that conditions will never be perfect. Experience can become a respectable excuse for delay. Timing can always improve in theory. Responsibility begins when someone stops treating uncertainty as a verdict.
In a reflection at the end of 2025, he returned to the importance of momentum. At Scytale's beginning there was no product, team or customer, only one problem after another. Curiosity mattered more than being the cleverest person available. The next move was to find people with complementary skill and keep crossing items from the list.
The scholar in the operator
Galis kept studying the subject while building the company. His formal education began with a B.Sc. in information systems at the Academic College of Tel Aviv-Yaffo, where he served in student representation and joined an EU program at Kingston University. An MBA followed at Bar-Ilan University. In 2023, he completed a doctoral dissertation at Singidunum University on continuous information-security auditing in cloud-native environments.
His research credits include work on an automated compliance system for service organizations, protocols for symmetric secret-key establishment and an experiment involving authenticated key agreement using asynchronous EEG signals. The subjects may sound distant from a founder's calendar, but the connection is tidy. Scytale's commercial premise is continuous evidence and control monitoring. Galis's academic premise asked how continuous external auditing might work in cloud systems. Product and paper were examining neighboring rooms.
There is also a less scholarly Galis. As a child, he pictured professional basketball. He still follows the NBA and has joked about owning a team one day. The fantasy fits a founder who talks about surrounding himself with smart people and helping them individually. His description of leadership begins with listening rather than command. A roster, after all, is not improved by pretending everyone plays the same position.
“You really need to dive deep, ask the right questions, and surround yourself with smart, experienced people.”Meiran Galis
From proof to platform
Scytale's first pitch was aimed at a startup moment: an enterprise prospect asks for SOC 2, the seller blinks, and suddenly trust has become the last gate before revenue. Galis has been candid that many startups approach compliance because they need the deal. His answer is to accept the commercial trigger, then build controls that have operational value rather than merely satisfying a checklist.
That distinction shaped the platform. Automated evidence collection reduces the screenshot chase. Cross-mapped controls let work serve more than one framework. Continuous monitoring makes readiness less episodic. Human compliance experts remain part of the offer because a standard can be digitized without becoming self-explanatory. The promise is not to make regulation charming. It is to remove enough manual effort that people can treat it seriously.
By 2025, Scytale was operating across New York, Tel Aviv, Johannesburg, Cape Town, Berlin, Portugal and Prague. Its customer references ranged from growth companies to names such as Intel, Deel and Guesty. Then it made the move that changes how a young company is described: it acquired another company.
AudITech specialized in automating SOX IT General Controls, including user access and change management. Scytale announced the acquisition in June 2025 for a reported $15 million, bringing AudITech's ten-person team into the company and extending Scytale further into enterprise compliance. The founder who once had a customer but no CTO was now integrating another product and team.
The shift did not abandon the original observation. Startups and public companies face different standards, budgets and consequences, but both can drown in repeated evidence work. Scytale's enterprise expansion widened the set of controls while keeping the old thesis: trust should be maintained in the flow of work, not reconstructed during a frantic season.
The lively part of a dull problem
Compliance is easy to underestimate because its vocabulary has the charisma of office furniture. SOC 2. ISO 27001. ITGC. The acronyms seem built to repel curiosity. Galis did the opposite. He became curious enough to see the systems, commercial stakes and human behavior inside them. Founders wanted customers. Customers wanted assurance. Auditors wanted evidence. Engineers wanted fewer interruptions. A useful company could align those desires.
His route offers a practical pattern worth borrowing. Work close enough to a problem to notice what repeats. Explain it in language the buyer uses. Let public teaching reveal who cares. Find one customer early enough to make the product real. Then keep studying, because expertise calcifies when it becomes merely a credential.
Galis likes the instruction to “just do it,” but his story adds necessary texture. Action without attention is noise. His momentum was built on hundreds of audits, weekend explanations, awkward mockups and conversations with people who knew what he did not. The company started moving because he loved the problem long enough to make the boring parts legible.
Five years after the empty office, Scytale had employees around the world, a wider enterprise product and an acquisition to absorb. The pile of screenshots had not vanished from corporate life. It had, however, acquired an adversary with software, researchers, compliance experts and a founder who still reads about the subject in his spare time. Every industry deserves at least one person delighted by its paperwork.