SaaS and start-up trust readiness

Two quick questions so we only show what's relevant to your product. These aren't scored.

1. Does your product include AI features, such as a chatbot, generated content, recommendations or automated decisions, or use a third-party AI model?
2. Do you sell, or plan to sell, to banks, insurers, payment firms or other financial entities?

The controls every serious buyer asks about, whatever framework they use.

1. Where are you with a recognised security framework? Security lead
2. Is two-step login or SSO enforced for all staff on email, code repositories, cloud consoles and production access, and do you offer SSO or MFA to customers? Security lead
3. Is production and customer data access limited by role, granted on request, removed promptly when people leave and reviewed at least quarterly? Security lead
4. Is customer data encrypted in transit (TLS 1.2 or higher) and at rest, including databases, backups and laptops? CTO or Engineering lead
5. Are security-relevant events (logins, admin actions, data exports) logged centrally, retained for an agreed period and monitored for alerts? Security lead
6. When did you last test restoring production data from backup? CTO or Engineering lead
7. Do you use code review, dependency and secret scanning, and separate environments, with no real customer data in development or test? CTO or Engineering lead
8. When did an independent tester last carry out a penetration test of your product? Security lead

From the help text

ISO/IEC 27001 certification or a SOC 2 report short-circuits many questionnaires. Without one, a documented control set aligned to ISO 27001 still helps.

How you behave on your worst day is what customers remember.

1. Do you have a written incident response plan, tested in the last year, that covers security incidents and personal data breaches? Knock-out Security lead
2. How quickly do your contracts commit you to notify customers of a personal data breach affecting their data? Legal / DPO
3. Do you publish a way for researchers to report vulnerabilities (for example a security.txt file or disclosure policy), and track fixes against target times by severity? Security lead
4. Have you checked whether the Cyber Resilience Act applies to anything you ship? CTO or Engineering lead
5. Have you documented recovery time and recovery point objectives, and do you publish service status to customers? CTO or Engineering lead

From the help text

'Yes' means named roles, severity levels, communication templates and a test or tabletop exercise in the last 12 months.

Make it easy for buyers to say yes, and keep their data safe once they have.

1. Do you have a trust or security page covering certifications, security measures, sub-processors, data location and how to report issues? Sales / Account manager
2. Do you keep a maintained answer bank for security questionnaires, with an owner and supporting evidence? Security lead / Sales
3. Can you meet the supply-chain asks that NIS2 customers now pass to suppliers: security clauses, incident notification, cooperation with audits and evidence of your measures? Legal / Security lead
4. Do new features go through a privacy and security review before launch, with privacy-protective defaults? Product / Legal
5. When a customer leaves, can they export their data, and do you delete it (including from backups, within a stated period) and confirm in writing? CTO or Engineering lead
6. I confirm these answers reflect our current security and privacy position, and our security lead has reviewed them. CEO or Founder

From the help text

A good trust page cuts weeks off procurement. 'Yes' means one public page that's kept current.

These questions apply because your product includes AI.

Asked only if you answer “Yes” to: Does your product include AI features, such as a chatbot, generated content, recommendations or automated decisions, or use a third-party AI model?

1. Have you worked out your role under the EU AI Act for each AI feature (provider or deployer) and its risk category? Product / Legal
2. Do your terms say clearly whether customer data is used to train or improve models, and is the default no unless the customer agrees? Legal / DPO
3. Are users told when they're interacting with an AI system, and is AI-generated content marked where the AI Act transparency rules require? Product / Legal
4. Have staff who build, sell or support AI features had AI literacy training appropriate to their role? HR / Operations
5. Are your AI model providers listed as sub-processors, with their data location and retention terms checked? Legal / DPO

From the help text

Most SaaS companies are providers of the AI features they put on the market, even when built on a third-party model. A feature used for hiring, education or creditworthiness may be high-risk. 'Yes' means each feature is classified and recorded.

These questions apply because you sell to banks, insurers or other financial entities covered by DORA.

Asked only if you answer “Yes” to: Do you sell, or plan to sell, to banks, insurers, payment firms or other financial entities?

1. Can your contracts include the provisions DORA Article 30 requires, such as service descriptions, data location, security, incident assistance, service levels and termination rights? Legal / DPO
2. Can you support a customer's exit strategy with a transition period, data return and help moving to another provider? CTO or Engineering lead
3. Can you give financial customers the incident information they need, fast enough for their major ICT incident reporting? Security lead
4. Will you grant customers and their regulators access, inspection and audit rights, including pooled audits or certifications where appropriate? Legal / DPO
5. Do you tell financial customers which sub-contractors support critical functions, and give notice of material changes? Legal / DPO

From the help text

Financial entities must have these terms in contracts with ICT service providers, with more for services supporting critical or important functions. 'Yes' means you've prepared a DORA addendum.