[louthy]

GDPR & ISO27001 compliance are the important ones, but depending on the industry there maybe others (HIPAA for example). You need to hire an advisor and start writing everything down. Being able to hand over compliance documentation along with proof of an audit is absolute gold. If you don’t do this, be prepared for a mini-audit on every sale (if you get that far).

Sales to governments will likely come with even more compliance requirements, national security audits, and potentially staff vetting. It’s not worth it early on unless you’re really well funded.

Compliance does actually scale with the business, so it’s not particularly onerous at the start. Although it can get out of hand if you’re not careful. Compliance should be pragmatic.

SSO is clearly one of the major factors for integrating anything into an enterprise organisation. Their IT team will want to have complete control over who has access, when somebody leaves the company they want to make sure that they can shut them down immediately, not have to reach out to third-party providers, or login to multiple systems. Ignore this at your peril.

Independent penetration tests are also really important.

You can usually resist requests for self-hosting or multi-tenancy if you have all the above, but not always. If they don’t think you’ll be around tomorrow, then they won’t touch you.

[magicalhippo]

> If you don’t do this, be prepared for a mini-audit on every sale (if you get that far).

That's the position we're in, though as an older but still growing B2B we have to do this for existing customers as well.

We're in the process of getting ISO27001, meanwhile we got one guy out of 40ish almost full-time answering such questions now.

[louthy]

It never stops, but at least with evidence of audits, evidence of pen tests, and policy documentation, it can be a little easier!

[louthy]

Edit: meant to say self-host/single-tenant in the last paragraph.