What Founders Get Wrong About IT Before Their Series A

Series A due diligence has a way of surfacing every shortcut taken in the first 18 months. The IT problems that felt like "we'll fix that later" decisions have a habit of landing in the data room at exactly the wrong time.

Here are the five IT mistakes I see most often in seed and pre-Series A biotech companies — and how to get ahead of them.

1. Building on personal Google Workspace accounts

It starts innocently: the founders share files through their personal Gmail, then they bring on a few scientists who do the same. By the time you're 12 people deep, your intellectual property is scattered across personal accounts you don't own and can't audit.

Investors doing due diligence will ask for an IT environment overview. "We're still on personal accounts" is not the answer they want. More practically, if a researcher leaves and you haven't separated their work from their personal Google account, you may have just lost critical data — or worse, created a confidentiality problem.

2. No documented access controls

In a 5-person company, everyone knows who has access to what because everyone has access to everything. By the time you're 20 people with an ELN, a LIMS, cloud infrastructure, and a shared network drive, "everyone has everything" is a liability.

21 CFR Part 11 explicitly requires individual user accounts, documented access levels, and the ability to produce an audit trail showing who accessed or modified regulated records. SOC 2 Type II requires the same from a security standpoint. Neither framework accepts "we trust our team" as an access control.

Investors in regulated biotech are increasingly aware of this. A lack of documented user access controls in your electronic systems will raise a flag in due diligence.

3. Using consumer cloud storage for research data

Dropbox and Box Personal are not the same as Box for Life Sciences or SharePoint with proper governance. The difference isn't just branding — it's version control, retention policies, audit logs, and whether your storage provider will sign a Business Associate Agreement (BAA) or validate their infrastructure for regulated use.

If you're running GxP studies or storing data that will go into an IND filing, your storage environment needs to be validated. Consumer tools are not validated environments.

4. No disaster recovery or backup strategy

I've seen early-stage companies lose months of research data because a laptop was stolen, a cloud account was compromised, or a researcher accidentally deleted a folder. At the seed stage, that kind of loss can be existential.

Basic 3-2-1 backup (three copies, two different media, one offsite) costs less than $50/month for most early-stage companies. There is no good reason not to have it.

5. Waiting until Series B to "get IT right"

The most common version of this mistake: "We'll deal with IT properly when we have more funding." The problem is that every month you delay, you accumulate technical and compliance debt that becomes more expensive to clean up later.

Retrofitting GxP compliance into an existing system is 3-5x more expensive than building it in correctly from the start. Re-validating systems after the fact requires full documentation of the prior state. Migrating users from personal accounts to corporate ones gets harder as the company grows.

The founders who handle IT early don't spend more — they spend less, over the life of the company, because they never have to undo anything.

The bottom line

None of these problems are hard to fix at the seed stage. They're all hard to fix at Series B when you're also managing a 40-person team, an ongoing clinical trial, and a fundraising process. The best time to do this right was when you incorporated. The second best time is now.