Comp AI Raises $34M to Keep Compliance Continuous Between Audits

A clean audit report starts aging with the next production deploy. Comp AI is financing the gap between periodic assurance and a software environment that keeps changing, using AI agents to gather evidence, monitor controls, and perform more of the work that once waited for a human checklist. The Miami-based company announced a $34M Series A on September 17, 2026, co-led by Roo Capital and Grand Ventures. Comp AI says it serves more than 1,000 companies and achieved 15x year-over-year ARR growth. Those figures are company-reported, but they explain why the round is funding a move beyond audit preparation and into continuous cybersecurity.

Comp AI now has to prove that automation can carry more operational weight without making responsibility harder to find. Independent auditors still perform the examination, humans still approve consequential work, and customers still need to understand what changed after the software acted.

What Comp AI Announced

Comp AI was founded in January 2025 by Lewis Carhart, Claudio Fuentes, and Mariano Fuentes. Lewis Carhart leads the company as CEO, Claudio Fuentes as COO, and Mariano Fuentes as CTO. The company is headquartered in Miami/Aventura and maintains a team and office in New York.

The Series A will support product and engineering development, continuous-security capabilities, and hiring across product, engineering, operations, sales, customer success, and marketing. The announcement names Corgi, Dub, OpenCode, Inference, and Primer among its customers, while leaving the round's valuation, terms, ownership changes, board changes, additional investors, and exact capital allocation undisclosed.

Grand Ventures is a returning investor. It co-led Comp AI's $2.6M pre-seed with OSS Capital in July 2025, with Sentry founder David Cramer and Ben Tossell participating. The two official round announcements add to $36.6M. TechCrunch reports $37.5M in total funding, leaving a $900K difference that the public record reviewed here does not explain.

The Founders Chose a More Durable Problem

Comp AI grew out of a product the founders decided to stop building. TechCrunch reports that Claudio Fuentes and Mariano Fuentes had spent years creating startups together before joining Lewis Carhart at LeapAI, a workflow platform that reached more than 1 million users. They shut it down after failing to find a use case sticky enough to warrant continued investment.

The experience left a useful scar. The founders had spent months completing SOC 2 work by hand while trying to move the previous company toward larger customers. Compliance was not an abstract market map. It was work competing directly with product development for the same limited attention.

Comp AI started with that operating problem. Its agents support onboarding, generate policies and risk records from organizational context, collect evidence, monitor controls, and help manage vendor assessments. The public core repository is licensed under AGPL-3.0, while the repository describes a limited commercial enterprise layer. That makes open core more precise than repeating the company's broader 100% open source marketing claim without qualification.

Why Continuous Security Is the Larger Bet

Traditional compliance software made spreadsheets, screenshots, document requests, and audit preparation easier to manage. The remaining weakness is time. A company can finish an audit and then change its code, cloud permissions, vendors, data flows, and AI agents before the next formal review begins.

NIST's continuous-monitoring guidance describes the goal as ongoing visibility into assets, vulnerabilities, threats, and the effectiveness of controls so organizations can make timely risk decisions. Comp AI is moving toward that territory with real-time monitoring, control validation, and security testing across applications and infrastructure.

The product boundary matters. AICPA describes SOC 2 as an assurance examination performed by CPAs, and TechCrunch reports that Comp AI does not replace the independent audit. Lewis Carhart said an agent may draft a policy, but a person still reviews and approves it. The commercial opportunity is not to erase human accountability; it is to stop spending human judgment on every repetitive movement of evidence.

Customer Growth Creates a Harder Product Test

Comp AI reports more than 1,000 customers and 15x year-over-year ARR growth. Its website presents case studies in which customers reached audit readiness quickly or recovered employee time, but those are selected company-reported outcomes rather than an independent performance audit. Customer count and growth show demand; they do not settle whether the same quality holds across larger and more complex organizations.

That distinction becomes more important as Comp AI moves into security testing and continuous control work. A policy draft can be reviewed before approval. An automated system that tests code, validates a control, or monitors permissions may influence decisions earlier and more often. The company will need traceability, safeguards, customer-specific context, and escalation paths that become stronger as the agent's actions become more consequential.

The company's security page says customer data is not used to train AI models and describes encryption, role-based access, tenant isolation, backups, and vulnerability-management controls. Those statements help define the design promise. Enterprise buyers will still evaluate how the controls operate in practice, especially when the platform connects to the systems it is supposed to assess.

What the $34M Has to Make Repeatable

Roo Capital principal Varun Sridhar framed the investment around the shift from periodic compliance toward continuous security. Grand Ventures general partner Nathan Owen pointed to portfolio companies that moved from other compliance platforms to Comp AI and praised the team's execution. Their comments tie the financing to customer behavior, but the next proof must come from product performance rather than investor enthusiasm.

Comp AI is hiring in Miami and New York as it expands into larger organizations with more complex requirements. The capital gives the company room to add engineers, product depth, customer support, and security capability. It also expands the surface on which the company itself must remain secure, available, accurate, and reviewable.

The founders already learned that user growth can exist without a durable enough reason to keep building. Comp AI begins from a stronger commercial obligation: companies selling into enterprises cannot treat security evidence as optional. The Series A now asks the company to keep that evidence current while the underlying software continues to change, one permission, integration, control, and deployment at a time.