Detecting compliance buying windows before the buyer starts shopping

Inbound is priced out. Audit keywords are some of the most expensive in paid search, and the buyer cycle is annual. You can’t run ads against a customer who buys once every twelve months and doesn’t know they need you until two weeks before they do.

Outbound is dressed-up guessing. Apollo, Clay, and ZoomInfo sell contact databases enriched with signals that sound useful but aren’t.

For three years I ran the full TrustNet sales cycle solo. I needed a third option.

A renewing SOC 2 audit leaves traces in specific places, weeks before the buyer starts shopping. So does a HITRUST renewal, an ISO 27001 surveillance audit, a PCI re-attestation. The traces differ per vertical, per framework, per company size.

This is industry knowledge, not a scraping problem. Anyone can write the scraper. Almost no one knows where to point it.

So I built a one-shot, per-vertical signal harvester instead of a continuous monitoring pipeline. Compliance audits are annual; buying windows open on a calendar a quarter wide. There’s no value in running 24/7 to catch a signal that updates once a year per company.

The system runs as expeditions: open a vertical, harvest the signal, score the list, work the list, close the harvest. System cadence matches buyer cadence, not the other way around.

TypeScript on Node. Firecrawl for scraping, OpenAI for scoring, Trigger.dev to run harvests as discrete async jobs, n8n to route outputs. None of those choices are interesting on their own, and that’s the point. The decision that matters isn’t the stack. It’s running the whole thing as expeditions instead of a cron-and-dashboard that would have matched my tools instead of the buyer’s behavior.

I built a pipeline where forking the repo gets you nothing without the per-vertical playbook that feeds it. The hard-won asset is the answer to “where does a buying window leak for this kind of company?” It is not the orchestration that processes the answer.

Most builders would hide this; they want the code to be the impressive thing, because code is the part you can show. I’m calling it out on purpose. If you’re hiring me or buying my time, the build isn’t what you’re paying for. The build is reproducible in a weekend. The playbook is what makes the build matter.

Bought lists give you “possible interest”—low-confidence intent inferred from hiring patterns or funding events. This system infers high-confidence buying signals from public compliance disclosures: a company that just updated its trust center and posted a compliance-lead role isn’t a guess, it’s a window. That difference in signal quality is what changes the starting position of every outbound conversation.

The current system needs me in the loop on every vertical setup. Fine for one or two industries, untenable past five. The next version turns the per-vertical playbook itself into a guided intake: walk through “what does a buying window look like here, what frameworks apply, where do the signals leak,” and produce a configured harvester at the end.

The build was always going to be easy. The intake is the work.