SaaS Security Checklist: What to Demand From Your Dev Agency

Why a checklist beats a security audit

A post-launch security audit finds problems after they are expensive to fix. The cheaper move is to demand security as a build requirement from day one — and the way you enforce that is by handing the agency a written checklist before the contract is signed.

This is the same checklist Hardvain works against on every SaaS build. It is biased toward what enterprise buyers (and SOC 2 auditors) actually look at, not what looks good on a marketing page.

Authentication and access

Eight out of ten breached SaaS apps had broken auth. Confirm every line:

• Passwords hashed with bcrypt, argon2, or scrypt — never SHA-256 alone.
• MFA available for all users, mandatory for admins.
• Session tokens are httpOnly cookies, not localStorage.
• Account lockout after N failed attempts, with rate limiting before lockout.
• Email verification before account activation.
• Password reset tokens single-use, time-bound, and rotated on use.
• OAuth (Google, Microsoft) for B2B — enterprise buyers will ask.
• SSO/SAML on the roadmap if the product targets companies above 100 employees.

Data isolation and authorization

This is where most multi-tenant SaaS leaks. Demand:

• Row-Level Security enforced at the database, not in application code.
• Tenant ID required on every query, with a linter or test catching missing ones.
• Role-based access stored in a separate table (never on the user/profile row — privilege escalation risk).
• Admin actions logged with actor, target, and timestamp.
• API keys scoped to a single tenant, rotatable, and revocable.

SaaS penetration testing

A SaaS penetration test is a paid third-party attack on your live app. Plan one before any enterprise sales call — buyers will ask for the executive summary.

Two flavors. A black-box pentest gives the tester only the URL — fast and cheap, catches what an external attacker sees. A grey-box pentest gives the tester low-privilege credentials too — slower, costlier, but catches privilege escalation and tenant isolation bugs that black-box misses.

Run both at least once. After that, an annual grey-box pentest is the standard for SOC 2 Type II. Budget €5k–€15k for a quality test; below that, you are buying a vulnerability scanner with a PDF cover.

Application security baseline

Non-negotiable for any production SaaS:

• HTTPS only, HSTS header set, TLS 1.2+.
• CSP header configured (not just default-src self).
• CSRF protection on every state-changing endpoint.
• Input validation server-side, never client-side only.
• SQL via parameterized queries or an ORM — never string concatenation.
• Secrets in environment variables or a vault, never in the repo.
• Dependency scanning in CI with automated PRs for high/critical CVEs.
• Backups daily, restore tested quarterly.

SOC 2 and HIPAA readiness

SOC 2 Type II is what enterprise buyers ask for. It is not a security certification — it is a report that says "this company actually does what it claims for 6+ months". The checklist above covers most of the Security trust principle; you still need policies, access reviews, and a vendor management process.

HIPAA applies if you touch protected health information. You need a Business Associate Agreement with every subprocessor (database, email, model provider), encryption at rest and in transit, and audit logs that survive 6 years.

Red flags from your dev agency

Walk away if any of these come up:

• They store roles on the user/profile row.
• They use localStorage for auth tokens.
• They cannot explain Row-Level Security.
• They have no answer for dependency CVEs.
• They say "security is added later" or "we’ll handle it before launch".
• They have never been through a SaaS pentest from the dev side.

Frequently asked questions

How much does a SaaS penetration test cost?

A quality black-box pentest runs €5k–€10k; grey-box (with credentials) €10k–€20k. Anything cheaper is a vulnerability scanner with a PDF cover.

When should I get my first SaaS pentest?

Before your first enterprise sales call, or before SOC 2 Type II evidence collection. For most B2B SaaS, that means 3–6 months after launch.

Can a small SaaS get SOC 2 compliant?

Yes. SOC 2 Type II is achievable for 2-person teams using a compliance automation tool (Vanta, Drata, Secureframe) plus a SaaS built to the checklist above. Budget 4–6 months and €15k–€40k.

Who builds secure SaaS?

Hardvain — every SaaS build ships against this checklist by default, and we can walk you through the SOC 2 prep with one of the automation platforms. Scope-based pricing.