Tag
SaaS, page 2
43 articles
Compliance frameworks
The FERPA school official exception
The three conditions a vendor must meet to receive student data as a FERPA school official, what direct control means for SaaS, and the redisclosure rules.
6 min read
Compliance frameworks
PHI vs ePHI: what counts as protected health information
How HIPAA defines PHI and ePHI, why the holder matters as much as the data, what the definitions exclude, and how to classify the edge cases SaaS teams hit.
6 min read
Trust and sales
Answering due diligence questionnaires
What a vendor due diligence questionnaire asks beyond security, who should own each section, and how to handle financials, continuity and signed attestations.
6 min read
Compliance frameworks
FERPA for EdTech vendors
FERPA regulates schools, not vendors, yet it shapes every EdTech contract. How it reaches you, what counts as an education record, and the controls to run.
6 min read
Privacy
Handling data subject access requests on time
How to answer a GDPR access request within one month: the deadline rules, proportionate identity checks, what the response must contain, and the records.
6 min read
Trust and sales
Handling an enterprise security review
A stage-by-stage playbook for an enterprise security review: intake questions, the standard package, the questionnaire, follow-up calls, and findings.
6 min read
Compliance frameworks
Tokenization and PCI DSS scope
Tokenization takes systems out of PCI DSS scope only under certain conditions. Where the vault sits, who can detokenize, and what assessors check in a design.
6 min read
Trust and sales
Gating documents behind an NDA
How to gate a SOC 2 report and other security documents: choosing the NDA mechanism, setting approval rules, expiring access, and keeping a usable log.
6 min read
Compliance frameworks
Business associate agreements: what to check before signing
What HIPAA requires every business associate agreement to contain, the clauses customers add on top, and how to test whether you can perform each.
6 min read
Compliance frameworks
SOC 2 processing integrity: who needs it and why
Which services should include processing integrity in a SOC 2, how its five criteria turn into controls on inputs, processing, and outputs, and what it costs.
6 min read
Privacy
What belongs in a GDPR data processing agreement
The terms Article 28(3) makes mandatory in every DPA, what each one commits a processor to in practice, and the clauses worth negotiating beyond the minimum.
6 min read
Trust and sales
What to put on a Trust Center
The documents and facts a Trust Center should carry, which belong in public view and which behind an NDA, and what should never be published there at all.
6 min read
Compliance frameworks
HIPAA technical safeguards for SaaS teams
What each HIPAA technical safeguard means inside a multi-tenant SaaS product, where ePHI escapes your controls, and the evidence a healthcare buyer expects.
6 min read
Compliance frameworks
The SOC 2 confidentiality criterion in practice
What C1.1 and C1.2 ask in practice: defining confidential data, finding every copy, deleting it on time at contract end, and the records an auditor samples.
6 min read
Compliance frameworks
Should you include availability in your SOC 2?
How to decide whether availability belongs in your SOC 2: what it adds beyond security, the commitments that trigger it, and the evidence auditors will test.
6 min read
Trust and sales
Building a security answer library
How to structure a security answer library: the fields each entry needs, how to seed it from past questionnaires, and the review rules that keep it true.
6 min read
Security engineering
SSO as a compliance control
Single sign-on makes access controls cheaper to run and easier to prove, but only for the apps behind it. What SSO covers, what it misses, and what to test.
6 min read
Trust and sales
SIG, CAIQ and custom questionnaires compared
How the SIG, the CAIQ and a buyer's custom questionnaire differ in origin, structure and use, and when to complete a standard one before anyone asks.
6 min read
Privacy
The six GDPR lawful bases, and how to choose one
What each of the six Article 6 lawful bases requires, which ones a SaaS company can rely on, and how to choose and record a basis before processing.
7 min read