How secure is it?
What SaaS companies need to publish
Procurement wants evidence, not adjectives. The question is really 'what can you show me'.
How customers actually ask it
The same intent arrives in wording your page probably does not use. All of these mean the same thing:
- “How secure is it?”
- “are you SOC 2”
- “do you encrypt data”
- “penetration testing”
- “security certifications”
What a complete answer contains
For SaaS companies specifically, an answer is only complete when it covers all 5:
- 1
Certifications you actually hold, with dates — and silence rather than implication where you hold none
- 2
Encryption in transit and at rest, stated separately
- 3
Whether SSO and enforced MFA are available, and on which plan
- 4
Penetration testing cadence and whether a summary is shareable
- 5
How to report a vulnerability
A worked example
Illustrative — not a real business
TLS 1.3 in transit, AES-256 at rest. SSO via SAML on the Best plan; MFA available on all plans and enforceable per workspace. Annual third-party penetration test with a summary available under NDA. Report vulnerabilities to security@example.com.
Which page should own it
Security page
What silence costs
Claiming certifications you do not hold is worse than having none. Stating precisely what you do have is what passes review.
More questions SaaS companies get
Related
industry
AI customer support for SaaS companies
SaaS support is dominated by questions your documentation already answers: what a plan includes, whether a feature exists, how an integration works. RubyRep reads your docs, pricing and changelog and answers those on the site, so trial users get unblocked in seconds instead of waiting on a ticket.
term
What is AI customer service?
AI customer service means answering customer questions with a language model rather than a person. The useful implementations are grounded in a specific business's own content; the poor ones let a general model improvise, which produces confident answers that are wrong.
term
What is a knowledge base?
Traditionally a knowledge base is a help centre humans read. For AI support it is the source material a representative answers from — which means an ordinary website, well written, can serve as one without a separate help centre.
Does your site answer this already?
Point RubyRep at your website and ask it this exact question. If it cannot answer, neither can your customers.