What Actually Goes Into a SaaS Security Audit
The questions enterprise buyers ask, the answers most startups aren't ready for, and how to be ready before your first big deal.
Your first enterprise deal will include a security questionnaire. It won't be optional, it won't be short, and it won't be forgiving of "we're working on it." Most startups get blindsided by this because it doesn't come up until the deal is almost closed.
This post is what actually goes into a SaaS security audit at the small-to-mid enterprise level — the artifacts buyers expect, the answers that stall deals, and how to be ready before it costs you a customer.
What "security audit" actually means
The term covers three different things buyers might ask for.
A vendor security questionnaire is a document, usually 100 to 400 questions, asking about your controls. A penetration test is a hands-on assessment of your application by security professionals. A formal certification — SOC 2, ISO 27001, HIPAA — is an audit conducted by an accredited firm and delivered as a report.
Different customers ask for different combinations. A mid-market SaaS buyer often wants a questionnaire plus a recent pentest. An enterprise buyer usually wants all three plus their own review.
The questionnaire, and what's actually in it
Almost every questionnaire covers the same categories. The wording varies, but the substance is consistent.
Access control
Who has admin access, how it's granted, how it's revoked when someone leaves. Whether MFA is enforced. Whether you have SSO, and whether it's available on the plan the buyer is considering.
The gotcha: putting SSO behind an enterprise-only paywall is common, and increasingly ridiculed. Buyers notice. Consider offering SSO on all paid tiers if you want smoother enterprise deals.
Data handling
Where customer data lives, how it's encrypted in transit and at rest, how long it's retained, and how it's deleted. Whether you have data residency options for EU customers.
The AI wrinkle: buyers now ask whether their data is sent to third-party model providers, what those providers do with it, and how you've verified they don't train on it. Our post on PII in AI apps covers this in more depth.
Change management
How code gets from a developer's laptop to production. Whether there's code review, automated testing, and a documented deployment process. Whether emergency changes have their own path.
The answer is more forgiving than founders think — "PRs require review and CI passes before merge" is enough for most SMB questionnaires. Enterprise wants more: separation of duties, audit logs, controlled release windows.
Incident response
What happens when something goes wrong. Who gets notified, in what order, within what timeframe. Whether customers are notified, and when. Whether you have a written runbook.
The bar for a small startup: a two-page runbook, an on-call rotation (even if it's one person), and a written commitment to notify affected customers within a defined window. Most startups don't have this. Most enterprise buyers require it.
Business continuity
What happens if your primary region goes down, if a key employee leaves, if your payment processor drops you. Whether you have backups, whether they're tested, whether you can restore from them.
Untested backups aren't backups. This is the single most common gap in early-stage SaaS security posture.
Third-party dependencies
Every vendor you use — cloud provider, database host, model provider, monitoring, email — is part of the buyer's supply chain. Buyers want the list, the certifications each vendor holds, and a data processing agreement with each one that touches customer data.
Keep this list current. It's a small pain to maintain and a big pain to reconstruct under deal pressure.
What SOC 2 actually gives you
SOC 2 is the certification US enterprise buyers ask for most. It's not a magic pass — it's a standardized audit that produces a report. Buyers still read the report.
The distinction between Type I and Type II matters. Type I certifies that controls exist at a point in time. Type II certifies that they operated correctly over three to twelve months. Enterprise buyers usually want Type II. SMB is often fine with Type I.
Cost: SOC 2 Type I typically runs $10k-$25k plus internal effort. Type II is $20k-$50k plus a monitoring platform like Vanta or Drata for $10k-$30k a year. Realistic timeline from starting to first report: three to six months for Type I, six to twelve for Type II.
The buyer's actual question is usually "do you have SOC 2?" — meaning Type II. If you only have Type I, disclose that early. Some deals proceed, some don't.
The gap between "we do this" and "we can prove we do this"
Most startups do most of the right things. The gap is proof.
MFA on your infrastructure is table stakes. But can you produce a report showing MFA is enforced on every admin account? Encryption at rest is standard on any modern database. But can you point to the configuration that enforces it?
Compliance platforms — Vanta, Drata, Secureframe — exist because they close this gap. They plug into your cloud provider, code repositories, and HR system, and produce continuous evidence that controls are in effect. Worth the money once your first enterprise deal is in sight.
When to start preparing
The wrong time is when a deal comes in. The right time is roughly six months before your target ACV crosses $30k.
Below $30k ACV, buyers usually accept a questionnaire and no certification. Between $30k and $100k, they often want SOC 2 Type I. Above $100k, they want Type II or equivalent. These are rough bands — the actual buyer determines it.
Starting six months early means the paperwork is ready when the deal starts, not scrambled during the deal. Deals stall over security. Every week of stall increases the chance the deal dies.
Common misconceptions
"We can skip this until we're bigger." If your ACV is above $10k, some buyers will ask. If it's above $30k, most will. Skipping means losing deals to competitors who prepared earlier.
"SOC 2 is the same as being secure." It isn't. SOC 2 verifies that the controls you claim to have are actually operating. A poorly-designed product with SOC 2 is still a poorly-designed product.
"AI features don't change our security profile." They do. Every model provider you touch is a new subprocessor. Every prompt is data flowing to a third party. Enterprise buyers ask specifically about this now.
What to build now, before anyone asks
Five artifacts every SaaS founder should have before a real enterprise conversation.
- A one-page security overview describing how you handle data, access, and incidents.
- A subprocessor list — every vendor that touches customer data.
- A written incident response runbook, even if it's two pages.
- A backup and restore procedure that's been tested at least once.
- A basic access review process — who has what access, checked quarterly.
All five are hours of work, not months. All five will show up in the first questionnaire you get.
Working with a real audit firm
When you're ready for SOC 2 or similar, you'll pick an audit firm. A few things to know.
Audit firms differ in quality and responsiveness. Ask other founders. The Big Four is overkill for a startup; a specialized firm is usually better and cheaper.
Get on a compliance platform first — Vanta, Drata, Secureframe. It cuts audit prep time by half or more. Auditors know how to work with them and will trust the evidence.
Budget six weeks of internal engineering time during a Type I audit. It's rarely full-time, but it's steady. Type II is less spiky but longer.
Frequently asked questions
Final take
Enterprise security is not the fun part of SaaS. It's also not optional past a certain deal size. The founders we've seen do this well treat it like any other product surface: start early, keep it maintained, and don't wait until a deal is on the line to figure out what's missing.
If you're preparing for your first enterprise conversation and want a review of your current security posture, book a call. We'll walk through what a buyer will ask and what's missing from your answer.
FAQ
Frequently asked questions
What does a SaaS security audit include?+
Most cover access control, data handling and encryption, change management, incident response, business continuity, and third-party vendor management. Depending on the buyer, it may also include a penetration test and a formal certification like SOC 2. The specifics vary, but the categories are consistent across most questionnaires.
When should a startup start on SOC 2?+
Roughly six months before your target ACV crosses $30k. Below that, buyers usually accept a questionnaire alone. Between $30k and $100k, Type I is often enough. Above $100k, buyers expect Type II. Starting six months early means the paperwork is ready when the deal starts.
What is the difference between SOC 2 Type I and Type II?+
Type I certifies that controls exist at a specific point in time. Type II certifies that they operated correctly over a three-to-twelve-month observation window. Type II is what most enterprise buyers actually want. Type I is usually a stepping stone rather than a final destination.
Do I need a compliance platform like Vanta or Drata?+
Not required, but they cut audit prep time significantly by continuously collecting evidence from your cloud, code, and HR systems. For a first SOC 2, most startups find the $10k-$30k annual cost easily worth it. Doing the same work manually eats months of engineering time.
How do AI features change a security audit?+
Every model provider you use is a new subprocessor that customer data flows to. Buyers now ask specifically what data reaches which provider, how it's protected, and whether it's used for training. Your subprocessor list, DPAs, and PII handling need to include AI providers, not just your traditional infrastructure vendors.
Building something similar?
Let's talk in 30 minutes.