Richa Kaul would like to know why you need her data

Richa Kaul is the person who stops at the cookie banner. While the rest of us surrender to the largest button and get on with our lives, she takes the trouble to refuse. It is a small act of resistance with an administrative burden attached. Privacy, apparently, requires homework.

That habit explains more about the founder of Complyance than a funding announcement does. She wants to limit what others know about her, and she understands the limits of doing that alone. Somewhere beyond the browser window, companies already hold information that an individual cannot protect by being particularly conscientious with a settings menu.

The Equifax breach made the problem personal. A close friend suffered identity theft, she has said. Her attention moved toward the organizations entrusted with everyone else’s information. The question became how to help those companies keep it secure. Eventually, that question became a business.

Complyance, founded in 2022, supplies enterprise governance, risk and compliance software. The spelling contains a little instruction: remember the why. Underneath the controls, assessments and policy documents are people whose information somebody has promised to look after. Kaul’s route to that promise runs through student government, consulting, public policy and legal technology. It is a career spent around systems and the people expected to make them function.

A practical sort of president

At Boston University, Kaul studied economics and served as Student Government president. Her 2014 campaign spoke about tangible improvements: later shuttle service, vacation housing options and better support for international students. Student politics can produce magnificent declarations about the future. A bus that arrives when someone needs it has its own persuasive force.

“Our slate is very much based on realistic, tangible changes,” she said then. Later that year, she addressed incoming students at Matriculation, recalling the unfamiliarity of arriving at university and encouraging them to find opportunities and friendships. Her public responsibilities already involved translating an institution into the terms of the people living inside it.

Her first job was strategy consulting at McKinsey. She later became a managing director at the Virginia Economic Development Partnership, leading growth in technology and professional services. The work brought her into questions about investment, talent and innovation. In her account of that period, she helped with the strategy around attracting Amazon’s HQ2 to Virginia. Large ambitions came with an accompanying list of things that had to work.

Her next move took her into legal technology. At ContractPodAi, she became chief strategy officer and also served as chief revenue officer. Contract software sits close to an old corporate problem: an organization can possess a great deal of information without having a convenient way to use it. Her writing there emphasized implementation, integration and support alongside product functionality. Buying software was only the beginning of getting value from it.

First, borrow the problem

Kaul moved to the UK in 2019 when her husband’s work took them there. Founding a company had not been a longstanding personal project. As she tells it, the idea emerged from the collision between her privacy concerns and a gap in the tools available to enterprise compliance teams.

She spent months talking to practitioners before building. She also offered inexpensive consulting to help companies with SOC 2 work, giving herself a view of the tasks from inside the process. Those conversations became early product material. She has said she still keeps the notes.

There is something revealing about choosing to do the work before trying to automate it. A person answering questions from an auditor has different priorities from a person arranging features on a product page. One is concerned with the evidence, the deadline and the colleague who has yet to reply. Software has to meet that person somewhere in the middle of an ordinary working day.

A small anecdote from Kaul’s earlier career fits here. Reading a consulting book, she recognized herself in an example about analyzing the organization of buffet lines. She has also described running hurdles, and applying the importance of a good start to preparing for meetings. A manager who helped her fix an early mistake supplied another lasting lesson: put the person at ease, then solve the problem together. The details suggest an interest in how people move through a process, with all their inconvenient humanity intact.

Selling AI to the people paid to doubt it

By March 2025, Kaul was describing a particular tension in her business. AI could help Complyance do more for clients. Those clients included security specialists whose work required them to be cautious about AI. The people she wanted to persuade were professionally obliged to ask difficult questions.

That makes trust part of product development. She has talked about learning which applications customers were willing to adopt, and placing automation where overstretched teams wanted more control and visibility. A technically possible feature still needs an organizational welcome. Otherwise it may spend its life giving excellent demonstrations to people who never switch it on.

Complyance organizes work across controls, policies, risks, third parties and customer trust. The company describes AI agents that review evidence and assess vendors, with outputs available for human review. Its privacy commitments include keeping clients’ AI environments isolated and refraining from training on their data. For a founder who objects to unnecessary data sharing, the promises made by her own software belong in the same conversation.

Her public conversations also return to vendor risk. An enterprise’s exposure extends to companies outside its own walls, making an inventory of suppliers more consequential than it might sound. In discussing the problem, she has pointed people toward a free vendor risk scoring tool. It offers a concrete entry into a subject that can otherwise dissolve into impressive nouns.

The distinction she makes between privacy and security is useful, too. Giving people control over their information includes questions about access and opting out. Keeping that information safe requires attention to the enterprise’s environment. In a September 2026 conversation, she emphasized the security side of that relationship. Clicking refuse remains a personal preference; protecting information already entrusted to a company requires a different set of tools.

The price of patience

Enterprise buyers give founders another education: things take time. Kaul has spoken about the pressure of wanting customers to arrive faster, for the team and for investors. She also recalls being urged to build a business aimed at smaller companies. Her interest remained enterprise GRC, with its more demanding product requirements and longer buying cycles.

That choice carries a familiar discomfort. A founder can believe in the destination while still wishing the next meeting would produce a decision. Conviction does not shorten a procurement process by itself. It has to coexist with the less theatrical work of building something an organization can actually adopt.

The round gave Complyance more resources for expansion and development. Its announcement set out plans to deploy more than 30 additional enterprise GRC agents during 2026. The company described an approach in which agents prepare work, flag issues and involve people in decisions. Those are stated product plans and operating principles, rather than a guarantee that every risk will politely announce itself.

When Kaul discusses fundraising, she pays attention to the investor’s incentives. She has described seed and Series A rounds that investors approached proactively, and a deliberate approach to sharing company information. Her advice includes evaluating the person across the table. She also acknowledges the privilege involved in having those choices. That qualification gives her experience its proper scale: a record of what worked for her, with conditions attached.

“You can control the supply of information out into the investor market.”

Richa Kaul, on fundraising

Give the agents somewhere to live

One of Kaul’s more interesting observations concerns the ordinary software beneath the AI. In March 2026, she argued that agents would become widely available while the platform around them would continue to matter. Organizations need somewhere to keep information, coordinate work and present findings in a form people understand.

It is an argument with a practical test. When an agent identifies a problem, someone must be able to examine it, decide what to do and follow the work through. The surrounding system has to make those steps possible. A useful observation stranded in the wrong place is simply another item awaiting attention.

Look back across Kaul’s career and that concern recurs: the institution, the workflow, the person trying to get something done. The ambition at Complyance is to relieve compliance teams of repetitive work so they can spend more time responding to risks. It is a purpose expressed in the language of ordinary responsibilities.

That brings the story back to the cookie banner. Kaul will still make her own choice about what to share. Her company asks what happens after millions of other people have made theirs, and after the information has left their hands. Somebody has to keep the promise. She is building for the people with that job.