A SaaS product holds many customers' data in one place, so a weakness affects everyone. This checklist covers the basics that every product should have.

Protect access

Control who can see what.

  • Strong password rules and optional two factor sign in
  • Roles and permissions for each customer account
  • Strict separation between customers' data
  • Prompt removal of access when someone leaves

Protect the data

Encrypt data in transit and at rest, back it up on a schedule and test restoring it. Keep secrets such as keys out of the code.

Be ready

Keep logs of important actions, apply updates promptly and write a short plan for what you will do and who you will tell if something goes wrong.