Security Basics Every B2B SaaS Needs Before Its First Enterprise Deal

The pattern is familiar. The demo goes well, the champion is enthusiastic, and then a 180-row security questionnaire arrives from someone you have never spoken to. Two weeks later the deal is "on hold pending review", which usually means dead.

Most of what an enterprise buyer asks for is not exotic. It is a set of controls that are cheap to build early and expensive to retrofit. Here is the list worth having before you need it.

Single sign-on, and it cannot be an enterprise upsell

Any company with an IT department wants to manage accounts centrally. SAML or OIDC support is the most common hard requirement, and increasingly SCIM provisioning too, so that removing someone from the corporate directory removes them from your product.

Build it before you need it — bolting SSO onto an authentication system that assumed email-and-password touches sessions, invitations, roles and account recovery. And think hard before pricing it as a premium add-on: charging extra for the feature that makes a customer safer is increasingly seen as a red flag rather than a pricing strategy.

Audit logs the customer can read

Who did what, to what, when, and from where. Immutable, retained for a defined period, and — this is the part teams miss — visible to the customer's own administrators, not just to your support team.

Retrofitting audit logging is genuinely painful because it has to be woven through every state change. Adding it while you build is close to free. Log authentication events, permission changes, data exports and deletions at minimum.

Roles that map to how companies actually work

"Admin and user" fails the first enterprise review. You need at least: an owner, administrators, regular users, and read-only or auditor access. Plus the ability to scope permissions to a team or department, because a 400-person customer does not want everyone seeing everything.

This interacts directly with your tenancy model — multi-tenancy patterns that survive real customers covers the structural side.

Encryption, and the ability to describe it

TLS 1.2 or better in transit, encryption at rest on databases and backups, and a clear answer about where keys are managed. Most cloud providers give you all of this with a checkbox; what buyers actually test is whether you can describe your own setup accurately.

The related question is data residency. "Where is our data stored?" has a real answer, and for EU and increasingly Middle East buyers, the answer determines whether they can sign at all.

Data lifecycle: export and deletion

Two capabilities, both contractual for most enterprise buyers: the customer can export their data in a usable format, and you can delete it completely on request within a stated window — including from backups, which is where the honest answer gets complicated.

Write down what your deletion actually does and how long backup copies persist. A precise, slightly awkward answer beats a confident, wrong one; the person reviewing it has read a hundred of these and can tell.

Vendor management, because you are someone else's supply chain

Buyers will ask which sub-processors touch their data. Keep a list: hosting, email, analytics, error tracking, support tooling, AI providers. For each, what data it sees and where it runs.

The AI one is newly load-bearing. If you send customer data to a model provider, that is a sub-processor, and it needs to be disclosed with its retention terms — see RAG in production.

The paperwork that unblocks deals

• A security page on your website describing your controls in plain language.
• A completed standard questionnaire (CAIQ or SIG Lite) you can send immediately.
• A sub-processor list with a change-notification commitment.
• A written incident response plan with notification timelines.
• A recent penetration test report, with the findings and what you fixed.

A pre-filled questionnaire turns a three-week stall into a same-day reply, and that alone closes deals that would otherwise drift.

When to bother with SOC 2

When buyers start asking for it, not before. It takes six to twelve months and real money, and it certifies that you do what you say you do — so the controls have to exist first. Build the list above, get through deals on the strength of it, and start the audit when the deals you are losing justify the cost.

Where to go next

The uptime budget covers the availability commitments that arrive in the same questionnaire. The handover checklist covers secrets and access hygiene.

We do readiness reviews as a fixed-scope engagement — the output is the questionnaire, the gaps, and a sequenced plan. See cybersecurity and data protection, or tell us which deal is stuck.