SaaS security & compliance, compared

How to read a vendor’s security claims

SOC 2 vs ISO/IEC 27001

Both are independent audits of how a vendor runs security. A SOC 2 Type II report covers how controls actually operated over a period (usually 6–12 months); Type I is a point-in-time snapshot. ISO/IEC 27001 is a certificate for the vendor’s information security management system. US buyers usually ask for SOC 2; European buyers often ask for ISO 27001. Either way, ask for the current report or certificate, not just the badge.

The single sign-on tax

Single sign-on (SAML, or OpenID Connect at some vendors) lets your team sign in through Okta, Microsoft Entra ID or Google Workspace and lets IT switch off a leaver’s access in one place. Many vendors put it on their top plan only, so the plan you actually need can cost several times the entry price. Check the plan shown in the SSO column before comparing prices.

SCIM and audit logs

SCIM creates and removes user accounts automatically from your identity provider; without it, someone has to remember to remove leavers by hand. Audit logs show who changed settings, exported data or signed in, which most security questionnaires ask about.

HIPAA and data residency

If you handle US patient data, the vendor has to sign a business associate agreement (BAA), usually on a specific plan. If you need data stored in the EU, UK or Australia, look for vendors that let you choose the region, often only on higher plans.

What “Not published” means

We only record what a vendor says on its own site. “Not published” means we could not find it there on the date checked. The vendor may still offer it on request, so ask sales before ruling a tool out.