Tag
SaaS
43 articles
Trust and sales
The security page buyers check first
What a public security page needs on its first screen, the sections that follow, how to write claims a reviewer believes, and the red flags they notice.
6 min read
AI governance
Shadow AI: finding the tools your teams already use
Where to look for unapproved AI tools: identity grants, expenses, browser extensions, network logs, features in existing SaaS, code. Then how to triage.
6 min read
Privacy
Managing sub-processors and the notice customers expect
What GDPR Article 28 requires for sub-processors, who counts as one, how to run the list and change notices, and what to do when a customer objects to a change.
6 min read
Compliance frameworks
What a SOC 3 report is for
A SOC 3 is the public summary of a SOC 2 examination. What it contains, what it deliberately leaves out, where it helps sales, and where buyers still want more.
6 min read
Compliance frameworks
Computer system validation for SaaS
Who validates a SaaS system under FDA rules, which documents each side owns, and how to keep validation current when the vendor ships changes every month.
6 min read
Trust and sales
Security addendums and what to negotiate
A clause-by-clause guide to a customer's security addendum: incident notice, audit rights, prescribed controls, subprocessors, deletion, and liability.
6 min read
Privacy
Controller vs processor: which one are you?
How to tell whether you are a GDPR controller or processor for each activity, why most SaaS companies are both, and what each role obliges you to do.
6 min read
Compliance frameworks
Part 11 audit trails and electronic signatures
What 21 CFR 11.10(e), 11.50, 11.70 and Subpart C ask of audit trails and e-signatures, how they meet SSO and MFA, and the design errors that fail review.
7 min read
Trust and sales
Security commitments in customer contracts
Where security commitments hide in customer contracts, the types you will find, why your SOC 2 report depends on them, and how to keep a register that works.
6 min read
Compliance frameworks
ISO 27001 for startups: a realistic first certification
What a small team needs for a first ISO 27001 certificate: a defensible scope, a working ISMS, the records auditors check, and the order to build it.
6 min read
Compliance frameworks
21 CFR Part 11 explained
What FDA's Part 11 covers, how predicate rules decide whether it applies to your records, and which controls the FDA's 2003 scope guidance still enforces.
7 min read
Privacy
Data minimization in product design
How to apply data minimization while a feature is being designed: field-level purpose checks, logs, analytics, test data, and the evidence it happened.
6 min read
Risk and vendors
Managing SaaS sprawl
How to find the SaaS apps your teams already use, triage them into an owned inventory, retire the extras, and stop new sprawl without blocking the business.
6 min read
Privacy
Cookie consent under GDPR and ePrivacy
Why cookie consent rests on the ePrivacy Directive, what the GDPR adds, how narrow the strictly necessary exemption is, and how to test your banner.
6 min read
Compliance frameworks
FERPA vs COPPA for EdTech companies
FERPA regulates schools and COPPA regulates operators. How the two laws differ, when both apply to one product, and how school authorization fits between them.
6 min read
Compliance frameworks
HIPAA for SaaS companies selling to healthcare
How a SaaS company works out whether it is a HIPAA business associate, what that role obligates it to do, and what healthcare buyers expect to see first.
6 min read
Compliance frameworks
Writing an ISO 27001 scope statement
How to set ISO 27001 scope boundaries, write a scope statement your auditor and buyers can read, handle interfaces and dependencies, and avoid weak scopes.
6 min read
Compliance frameworks
DORA vs NIS2: which applies to you
How to tell whether DORA, NIS2 or both apply to your organization, how the EU resolves the overlap for financial entities, and where ICT providers sit.
6 min read
Privacy
GDPR for US SaaS companies
When the GDPR reaches a US SaaS company, the controller and processor roles you hold, and the obligations to put in place first, in a practical order.
6 min read
Trust and sales
Explaining shared responsibility to customers
How a SaaS provider explains which security controls it runs, which its cloud provider runs, and which customers own, in a matrix and in questionnaire answers.
6 min read
Compliance frameworks
Student data privacy agreements, explained
What a student data privacy agreement contains, why districts require one, how standardized agreements work, and which clauses need operational work first.
6 min read
AI governance
The AI questions now in security questionnaires
The AI questions customers add to security questionnaires, what each one is testing, the facts to gather before answering, and the answers that go wrong.
6 min read
Privacy
Privacy by design under GDPR Article 25
What GDPR Article 25 requires of data protection by design and by default, how the EDPB reads it, and how to build evidence of it into your development work.
6 min read
Trust and sales
Sharing penetration test results with buyers
What buyers want from your penetration test, what a summary letter should contain, how to discuss open findings honestly, and when to share more detail.
6 min read