For software startups and growing businesses selling to enterprise buyers in the US, Europe, Canada, and Australia, security compliance is no longer a check-the-box exercise.
It is a prerequisite to closing enterprise deals.
A single SOC 2 or GDPR compliance failure during a prospect's security review can derail a 6-figure enterprise contract.
Here is what developers and founders need to know about engineering compliant custom software.
Start with the honest framing: compliance is a documentation and process discipline layered on top of real security, and the two are not the same thing. You can pass an audit with a well-organised spreadsheet and still get breached; you can be genuinely hardened and fail a review because nobody wrote down a policy. Enterprise buyers check both, and the sales cycle stalls on whichever one is missing.
The Big Three: Understanding the Perimeters
┌─────────────────────────────────────────────────────────────┐
│ 1. GDPR (Europe / Global): Privacy, Consent & Right to Erase│
│ 2. HIPAA (United States): Protected Health Information (PHI)│
│ 3. SOC 2 Type II (Global): Security, Availability & Control │
└─────────────────────────────────────────────────────────────┘
What Each One Actually Requires
| Framework | Applies when | Core obligation | Typical evidence buyers ask for |
|---|---|---|---|
| GDPR | You process personal data of EU/UK residents, regardless of where you are | Lawful basis, data subject rights, breach notification in 72 hours, DPAs with subprocessors | Privacy policy, DPA, records of processing, subprocessor list, SCCs for transfers |
| HIPAA | You handle protected health information for a US covered entity | Administrative, physical and technical safeguards; a signed BAA with every covered entity | BAA, risk analysis, access controls, audit logs, encryption attestation |
| SOC 2 Type II | Enterprise buyers demand it; effectively mandatory above mid-market | Documented controls operating effectively across a period (typically 3–12 months) | Audit report, control matrix, policies, evidence samples |
Two nuances that trip founders up constantly. HIPAA compliance is not something you can claim unilaterally — if you do not sign a Business Associate Agreement, you are not in scope, and if you do sign one, you have taken on specific obligations that a checkbox on your website does not satisfy. And ISO 27001 is increasingly the preferred certificate in Europe and the UK where SOC 2 is a US-centric standard; some prospects will accept either, some will insist on one.
Technical Architecture Checklist for Compliance
1. Encryption Everywhere
- In Transit: Enforce TLS 1.3, strict HSTS headers, and A+ SSL ratings on Qualys SSL Labs.
- At Rest: Enable database encryption (PostgreSQL transparent data encryption / AWS RDS KMS) and encrypt sensitive columns (like Tax IDs or SSNs) with application-level AES-256 keys.
Two operational details make the difference between encryption on paper and encryption in practice: rotate keys on a schedule and document the process, and keep application-level keys out of the database — in a secrets manager with an audit trail, never in a .env file that ends up in a backup. Column-level encryption is also worth reserving for genuinely sensitive fields; encrypting everything makes the database unusable for reporting and creates key-management work you will not maintain.
2. Immutable Audit Logging
Maintain append-only audit logs that track: * Who accessed which customer record? * When was data modified, exported, or deleted? * What IP address and user-agent initiated the request?
Audit logs are only useful if they are complete, tamper-evident and retained. Write them to storage that application credentials cannot modify (append-only tables, write-once object storage, or a dedicated log service), include a correlation ID so a single user action can be traced across services, and set a retention period that matches your contractual obligations — 12 months is common, longer for regulated data. Crucially, audit logs must not become a data-leak vector: log identifiers and actions, not the contents of sensitive fields.
3. Data Residency & The Right to Be Forgotten
- For EU customers, store data in European regions (e.g., Frankfurt or Dublin AWS/Hetzner data centers).
- Build automated GDPR deletion endpoints that purge user records, backups, and log references within 30 days of request.
The deletion requirement is where most implementations quietly fail. A real erasure flow has to cover the primary database, the object storage bucket and its old versions, search indexes, analytics warehouses, the CRM, and backups — where the honest answer is usually "deleted at the next backup expiry, within 35 days", and that answer must be written into your policy rather than left implicit. Keep a deletion receipt: what was removed, when, by whom, and across which systems.
4. Access Control and Least Privilege
Every auditor asks variations of "who can see what, and how do you know?" The evidence they want:
- MFA on every account, especially admin, and no shared logins anywhere.
- Role-based access with documented role definitions, plus a quarterly access review whose results are retained.
- Joiner/mover/leaver process: access granted by request, changed on role change, revoked within 24 hours of departure.
- Production access is exceptional, logged and time-limited, not a standing privilege for the whole engineering team.
- Break-glass accounts documented, monitored, and rotated regularly.
5. Backups, Disaster Recovery and Business Continuity
Compliance frameworks ask for availability commitments, and Type II audits test them. What you need in writing: backup frequency, retention, encryption, restoration testing cadence (quarterly is a reasonable, defensible standard), documented RTO and RPO targets, and evidence that a restore was actually performed. A backup that has never been restored is a hypothesis, not a control.
6. Vendors and Subprocessors
Every third party touching customer data is in scope. Maintain a subprocessor list published to customers, sign DPAs with each, review their security posture annually, and know your breach-notification obligations toward your own customers when a vendor is compromised. This is where shadow SaaS usage causes real damage — an engineer pasting production data into a free online tool can create a reportable incident.
7. People, Process and Training
The controls above are only as good as the habits around them, and auditors know it. Minimum viable practice: security awareness training at onboarding and annually thereafter, a documented process for reporting a suspected incident, a phishing-resistant path for the accounts that matter, and a written policy covering acceptable use of production data. For HIPAA-scoped teams, training must be documented per person with dates — "we talked about it in a standup" is not evidence.
The Security Review: What Buyers Actually Ask
Enterprise security questionnaires converge on the same twenty or thirty questions. Preparing a single, current answer set removes weeks from every deal:
| Area | The question behind the question |
|---|---|
| Data classification | Do you know where our data lives, and what else sits beside it? |
| Encryption | Is it encrypted in transit and at rest, with managed keys? |
| Access control | Can I get a list of who can access our tenant, on request? |
| Incident response | How fast would you tell me, and who would tell me? |
| Sub-processors | Who else touches our data, and can we object? |
| Availability | What is your uptime commitment, and what happens if you miss it? |
| Deletion | Can you prove our data is gone when we leave? |
| Testing | When was your last penetration test, and may we see the summary? |
| Insurance | Do you carry cyber liability cover, and at what limit? |
| Continuity | What happens to our data if you are acquired or shut down? |
Under GDPR, a breach affecting personal data must be reported to the supervisory authority within 72 hours of becoming aware; HIPAA gives covered entities 60 days to notify individuals, and business associates must notify the covered entity without unreasonable delay. Knowing those clocks, and having a written incident response plan that names who makes the call, is a documented control in its own right.
A Practical Compliance Roadmap
| Stage | Typical timeline | What happens | Indicative cost |
|---|---|---|---|
| Foundations | Month 1–2 | Policies, MFA, access reviews, logging, asset inventory | $5,000–$20,000 in tooling and internal time |
| GDPR readiness | Month 1–3 | DPA, privacy policy, records of processing, SCCs, deletion flows | $3,000–$15,000 |
| SOC 2 Type I | Month 3–4 | Controls designed and evidenced at a point in time | $10,000–$25,000 audit |
| SOC 2 Type II | Month 4–12 | Observation window (3–12 months) then audit | $15,000–$60,000 audit |
| Penetration test | Annual | External test, remediation, retest of critical findings | $8,000–$25,000 |
| HIPAA (if applicable) | Month 2–6 | Risk analysis, BAA template, safeguards, training, incident plan | $5,000–$30,000 + legal |
| Continuous monitoring | Ongoing | Compliance platform, evidence collection, annual renewals | $7,000–$25,000/year |
Compliance platforms (Vanta, Drata, Sprinto and similar) do not make you compliant — they automate evidence collection against a checklist, which is genuinely valuable and will save months of spreadsheet work, but they will happily show a green dashboard for a control your engineers are not actually performing.
Common Compliance Mistakes
- Claiming HIPAA compliance without a BAA, or "SOC 2 compliant" before the report exists. Both statements can be contractual misrepresentations.
- Logging sensitive data into error trackers. A stack trace containing a patient's name in Sentry is a reportable exposure, and it happens in most codebases until someone checks.
- Shared admin accounts — the fastest way to invalidate an audit trail.
- Treating compliance as a one-time project. Type II renews annually, and controls are tested in the period, not on the day.
- No incident response rehearsals. An untested plan is a document, not a capability.
- Ignoring the vendor trail. Your weakest subprocessor determines your practical posture.
- Writing policies nobody follows. Auditors sample reality; the gap between the document and the workflow is the finding.
- Over-collecting data. Every field you store is an obligation you must protect, retain and delete.
Related reading: RBAC is the control auditors inspect first; document management covers handling regulated files; and website maintenance covers the patching discipline that keeps a compliance posture real. Building software in regulated industries? KEHEM IT engineers secure, compliant platforms built for enterprise due diligence.
Facing a compliance requirement on your roadmap? Tell us which one and we will tell you what it changes in the build.
Have a project in mind?
KEHEM designs and builds thoughtful websites, SaaS products, and business systems.