“Vanta's founding hypothesis was that to build a security company for startups, one should first build a compliance company because compliance is the primary buying trigger.”