Selling SaaS to enterprises security, data and contracts

What a large customer asks of a company selling software by subscription, what you really need before signing, what gets built into the product and what the contract must say.

Updated 14 minutes readThemes: Development, Compliance

What does a large company ask before buying your SaaS?

It asks you to show that its data is safe with you: first with a security questionnaire, then with documents and evidence. In an ISC2 survey of 1,062 security professionals, 77% put compliance with standards such as ISO 27001, NIST or SOC 2 first among their requirements for a supplier; then come audits and attestations (71%), multi-factor authentication and secure access (62%), incident response and breach notification procedures (61%). Only 5% require no controls at all (ISC2, November 2025).

What they ask for What the customer wants to know Where it gets solved
Security questionnaire how you protect data, access and systems with true answers and documents
Data processing agreement (DPA) how you process personal data on its behalf in the contract, under the GDPR
ISO 27001 certification or SOC 2 report whether a third party has checked how you work in your organisation, with an auditor
Sign-in with company credentials (SSO) whether people who leave the company lose access at once in the product
Data kept apart from other customers whether another customer can see its data in the product
Activity log who did what, and when in the product
Where the data lives and who else processes it countries, cloud and suppliers involved in the contract and the infrastructure
Exit and return of the data how it gets its data back if it stops using you in the contract and the product

Google and the AI assistants answer these questions almost only on certification. Among the 135 pages we read, from Google results and from the sources of AI answers, ISO 27001 appears in 74, separation of data between customers in 21, the activity log in 29. The certificate opens the negotiation; the evidence the customer checks in the product closes it.

Do you need ISO 27001 before signing?

Not always. To the founder's question, in Italian and in English, all the AI answers say the same thing: you sign with the data processing agreement, an honestly completed questionnaire and a clause promising ISO 27001 or SOC 2 by a date, usually within 6 to 12 months. The data agreement is the one item no answer suggests postponing, and rightly so: the GDPR requires it for any processing you do on the customer's behalf (article 28).

Two warnings. ISO 27001 certifies the system your organisation uses to manage information security, not the software: it says you have a method to find and treat risks, not that every risk in the product is already solved. And the clause with the date becomes a contractual obligation. Promise only a date you can keep, after talking to a certification body.

On cost, the AI answers give figures far apart and almost never measured: for a small SaaS, ISO 27001 costs 5,000-15,000 € according to Google's AI Mode, 20,000-55,000 € in the first year according to Perplexity. ChatGPT, when we asked for its sources, admitted its figures were estimates. Among the pages we read, only two explain where the number comes from: the certification body's fee depends on the audit days, which ISO/IEC 27006-1 sets by the number of people in scope, multiplied by the day rate.

Item Figure Where it comes from
Certification audit, up to 10 people 5 days, 6,000-10,000 € StandardOS, from the ISO/IEC 27006-1 chart
Certification audit, 25 people 7 days, 8,400-14,000 € StandardOS, same chart
Surveillance audit in the second and third year, 25 people 2,800-4,700 € a year StandardOS
Certification body day rate 1,200-2,000 € StandardOS, from published European sources
First year, with consultancy and tools 5,000-15,000 € or 20,000-55,000 € Google's AI Mode and Perplexity, with no basis of measurement

The StandardOS figures, from a company that sells compliance software, cover only the certification body's fee. The largest cost is another one, and Perplexity says so too in one of its answers: the time you and your team spend on access control, logs, data separation and incident handling. On timing, the answers talk of 3 to 6 months to reach ISO 27001 and 6 to 12 months of observation for a SOC 2 Type II.

ISO 27001 or SOC 2?

It depends on where your customers are: ISO 27001 for Europe, SOC 2 for the United States. On this the answers all agree. If you sell in Italy and Europe, start from ISO 27001, and add SOC 2 when a US customer insists on it.

Question ISO 27001 SOC 2
What it is a certification of the information security management system an auditor's report on the controls of the service
Who issues it an accredited certification body a US certified public accountant (CPA), under AICPA rules
What it covers the organisation, within the scope you choose controls relevant to security, availability, processing integrity, confidentiality or privacy
Who asks for it mostly European customers mostly US customers

Two answers state that the controls of the two standards overlap by 70-80%; the figure comes from pages by sellers of compliance tools, with no measurement behind it. The SOC 2 categories are those of the AICPA, the association of US accountants.

Would you rather talk it through?

Book a call with people who work on these topics every day: we will look at your case together.

Book a call

What gets built into the product?

Everything the customer can test with one of its own test users. The certificate describes how your company works; SSO, data separation and the activity log live in the code, and no document replaces them.

Request What the product needs How the customer checks it
SSO sign-in through the customer's identity provider, such as Microsoft Entra ID, Okta or Google, via SAML or OpenID Connect signs in with one of its company accounts
Users managed by the customer users created and deactivated automatically from its system, with SCIM deactivates an employee and tests that they can no longer get in
Multi-factor authentication a second factor for anyone not coming through SSO, including with a TOTP app turns it on for accounts without SSO
Separated data every read and write filtered by customer, with tests that prove it; a dedicated database for whoever asks asks for the architecture, sometimes a penetration test
Roles and permissions customer administrators who manage their own users, each user with only the permissions needed creates a user with few permissions and tests the limits
Activity log who did what, when and from where, in a log the application cannot change and that exports to its systems asks for an extract
Data export all its data in an open format, whenever it asks tests a full export
Backup and restore recovery time (RTO) and acceptable data loss (RPO) in writing, and a tested restore asks for the latest restore test
Where the data lives declared cloud region, list of the suppliers that process the data attaches the list to the contract

The AI answers went into the product only when we asked what changes for a banking customer: a database per customer, an activity log that not even the vendor can change, Entra ID with SCIM, dedicated encryption keys. In the other questions data separation almost disappears. The most repeated advice actually goes the other way: answer the questionnaire with your cloud provider's security, which according to Google's AI Mode covers "90%" of physical and infrastructure security, with no source. But the data centre's certificate covers the data centre: who gets into the application, how the data is separated and who sees it remain your job.

In the SaaS products we develop, these controls enter the project from day one, because adding them when the first large customer arrives costs more. We design multi-tenant platforms: each organisation has its own space, with data, users and settings kept apart from other customers', as in the AI agent auditing platform. We connect to the company identity provider for SSO, turn on multi-factor authentication, and set RTO and RPO with you before going live. The certification, though, stays yours: you obtain it, with a certification body, for your organisation. We are not ISO 27001 certified, and we say so in our Trust Center.

If the product started as a prototype built with AI, before all this read the guide on taking a prototype built with AI into your company.

What must the contract say?

What the GDPR requires and, depending on the customer, what NIS2, DORA and the Data Act require. The customer usually writes the contract, but the law dictates many of its clauses, and it pays to have them in your standard contract already.

Law When it applies What goes into the contract
GDPR, article 28 if you process personal data on the customer's behalf the processing agreement: instructions, confidentiality, security measures, authorised sub-processors, deletion or return of data at the end of the service, audits and inspections
NIS2, Italian Legislative Decree 138/2024, article 24 if the customer is an essential or important entity the security measures the customer must check in its suppliers, secure development included
DORA, Regulation (EU) 2022/2554, article 30 if the customer is a bank, an insurer or another financial entity mandatory clauses on data locations, service levels, return of data, incidents and termination
Data Act, Regulation (EU) 2023/2854, articles 25-29 if you provide the service in the cloud, since 12 September 2025 the terms for switching to another provider, with maximum periods; from 12 January 2027 no switching charges

The suppliers that process data for you, from the cloud to the email service to the AI model, are sub-processors under the GDPR. You can use them only with the customer's written authorisation; if the authorisation is general, you must tell the customer before adding or replacing one, so that it can object. Keeping data in Europe is not a general GDPR obligation: outside the European Economic Area, data can go to countries with a Commission adequacy decision or with appropriate safeguards (articles 45 and 46). But it is a questionnaire question, and where the data lives is decided at the start, not during the negotiation.

NIS2 does not make you a NIS2 entity because your customer is one. It obliges the customer to secure its supply chain and to assess, for each direct supplier, the quality of its products and security practices, secure development procedures included (article 24, in Italian). That is where the questionnaire comes from: the customer must be able to show it has assessed you. In the bank question all four AI answers explain this; in the founder's question NIS2 does not appear.

The Data Act is the law nobody names: none of the 22 answers and none of the 135 pages mentions it. Yet it also applies to those who offer software as a service (recital 81), and it asks for this:

What the Data Act asks of the service provider Article
the contract with the switching terms, made available before signing 25
a maximum notice period of two months to start switching 25
at most 30 days of transition, during which the service continues and you assist the customer 25
the list of data the customer can take away 25
at least 30 days to retrieve the data 25
full erasure of the data after the switch 25
on your website, the jurisdiction of the infrastructure and the measures against foreign government access to non-personal data 28
from 12 January 2027 no switching charges; until then, at most the direct costs 29

The ban on charges does not apply to a service mostly custom-built for a single customer and not offered from a catalogue (article 31); for a catalogue SaaS it applies. A full data export is not an Enterprise plan feature: it is an obligation, and it has to be built. The buyer's side is in the guide on how to switch software house.

What if the customer is a bank?

Then DORA applies as well, the European regulation on digital resilience in the financial sector, in application since 17 January 2025. Its article 30 lists the clauses a contract with an ICT service provider must contain. We asked Google and the AI assistants what changes in the product if a banking group adopts it: none of the four answers names DORA. Among the 135 pages we read, 17 name it and only one explains article 30.

What article 30 asks for For which services
a written contract, with the service levels all (paragraph 1)
whether and on what terms you can subcontract all (paragraph 2)
countries or regions where the service is provided and data processed, with notice if they change all (paragraph 2)
availability, authenticity, integrity and confidentiality of data all (paragraph 2)
access, recovery and return of data in an easily accessible format, even if the provider goes under or the contract ends all (paragraph 2)
assistance during incidents, at no extra cost or at a cost set in advance all (paragraph 2)
full cooperation with the competent authorities all (paragraph 2)
termination rights and minimum notice periods all (paragraph 2)
participation in the bank's security awareness and training programmes all (paragraph 2)
service levels with measurable targets, tested contingency plans, participation in threat-led penetration testing critical or important functions (paragraph 3)
unrestricted rights of access, inspection and audit, on site too critical or important functions (paragraph 3)
an exit strategy, with a mandatory transition period critical or important functions (paragraph 3)

If you sell to banks and insurers, design the customer's exit before its entry: full export, declared data locations, activity log and access for auditors.

How do you answer the security questionnaire?

With what you already do, and with evidence. The customer can attach the questionnaire to the contract, and then every answer becomes a commitment: for what you do not have yet, write a date, not a yes.

It pays to prepare, once, a pack to send to every customer:

  • a public security page, with what you do and what you do not have;
  • the list of suppliers that process the data, with each one's country;
  • an architecture diagram showing how customers are kept apart;
  • the backup, restore and incident handling procedures;
  • the outcome of the latest penetration test, with the fixes made;
  • the template data processing agreement.

There are standard questionnaires, such as the Cloud Security Alliance's CAIQ and the Shared Assessments SIG: having one filled in saves time, but many customers send their own. In our Trust Center we do the same for our own customers: the assessment questions with a short answer, and what we do not claim.

Where do you start?

From the questionnaire of the customer you want to close.

  1. Ask for the questionnaire before the final negotiation, and mark what you do not have.
  2. Prepare the data processing agreement and the list of suppliers that process the data: it is the one thing you cannot postpone.
  3. Put into the product what the customer asks for, starting from data separation proven by tests, then SSO, the activity log and a full export.
  4. Write into your standard contract the switching terms the Data Act requires.
  5. Choose between ISO 27001 and SOC 2 based on where you sell, ask a certification body for a quote, and only then promise a date.

You start from the questionnaire of the customer you want to close, not from the ISO 27001 manual.

An example: a SaaS with 20 small customers and one large company

A B2B SaaS with about twenty small customers and 8 people gets an offer from an industrial group. The group sends a 200-question questionnaire and asks for ISO 27001, sign-in with Microsoft Entra ID, the data processing agreement and where the data lives. It is the case we put to Google and to the AI assistants; the details that follow are made up, to be replaced with yours.

The first step is the questionnaire. Of the 200 questions, most cover things the SaaS already does and has never written down; about thirty cover things it does not have. The answers are written once, and become the pack for the next customer.

The second is the product. Customer data sits in a single database, separated by a filter in the code but with no test that proves it; sign-in is email and password only; the log records technical errors, not user actions. It needs tests on separation, SSO with Entra ID and automatic user management, an activity log and a full export.

The third is the contract: the data processing agreement with the list of suppliers (cloud, email, payments), the Data Act switching terms and the ISO 27001 clause. With 8 people in scope, according to the StandardOS chart, the initial audit takes 5 days, 6,000-10,000 € in certification body fees. The date in the clause is written on that quote, not on a hope.

Sources and further reading

In practice

Frequently asked questions

All frequently asked questions
Can you get us ISO 27001 certified?

No: an accredited body certifies your organisation, not whoever develops the software. We build into the product the controls the customer and the auditor check, such as data separation, SSO, multi-factor authentication and tested backups. And we are not ISO 27001 certified ourselves, and we say so.

Does the GDPR require data to stay in Europe?

No. Personal data can leave the European Economic Area for countries with a Commission adequacy decision or with appropriate safeguards, such as standard contractual clauses. Many large customers, though, ask for data in Europe by contract, and it is a choice to make at the start, together with the cloud provider.

My customer is subject to NIS2. Does that make me subject too?

Not for that reason. Whether you are subject depends mainly on your sector and your size (article 3 of Italian Legislative Decree 138/2024), not on the customer. The customer, though, must assess its suppliers' security, and will ask you in the contract for measures such as multi-factor authentication and secure development.

Can I charge customers who leave for exporting their data?

For a catalogue SaaS, from 12 January 2027 no: the Data Act bans charges for switching to another provider. Until then you can charge at most the direct costs of the switch, and you must say so before signing.

What is the difference between SSO and SCIM?

With SSO the customer's users sign in to your SaaS with their company account. With SCIM the customer's system creates, updates and deactivates users in your SaaS on its own, so people who leave the company lose access even if nobody remembers to remove them. Large customers usually ask for both.

Does each customer need its own database?

Not always. You can keep a shared database, with every record tied to its customer and tests that prove a customer cannot see another's data. A dedicated database goes to whoever asks for it by contract, and costs more to run. It pays to design the product so the second can be added without rewriting it.

Has a large customer sent you its questionnaire?

Tell us what it asked for, in an introductory call, free and with no commitment: we tell you what a document solves and what has to be built into the product.

Let's talk about your project
  • You won't talk to a salesperson
  • NDA before we get into the details
  • The code stays yours
Keep reading

Articles on the same topics.

The entrance of a building with a ramp and a flight of stairs, and the words «Invisible by design»
Development, Compliance

Digital accessibility is not a badge

Discover why accessibility overlays fail WCAG 2.2 AA compliance and why building native accessibility is crucial for legal and commercial success.

Read
Plausible Analytics logo on modern graphics, GDPR compliant web analytics solution volcanicminds.com
Development, Compliance

Google Analytics, GDPR and the Plausible alternative

Italy's data protection authority found one specific use of Google Analytics, with data sent to the US, non-compliant. We chose Plausible: open source, EU servers, no cookies, no banner.

Read
A laptop on a desk in half-light, with violet and red light on the wall: the screen shows a website split between a light and a dark theme, with the Volcanic Minds logo and the words "Humans and agents".
Development

This website for people and agents

Static pages with Astro, content in Git, publication on Cloudflare Pages: the choices behind the site we have published since October 2026, and the checks that hold them up.

Read