SaaS Security & Compliance (SOC2/GDPR)
If you want to sell to big companies (like banks or healthcare), you can't just have a great product. You must be Compliant.
The Big Three
- GDPR (General Data Protection Regulation): The law in Europe. If you have European users, you must follow this.
- SOC2 (System and Organization Controls): A certification that proves your company handles data securely. (Very important in the US).
- HIPAA: The law in the US for healthcare data.
Key Vocabulary
- PII (Personally Identifiable Information): Data that can identify a person (Name, Email, SSN). Protect this at all costs!
- Encryption: Scrambling data so only authorized people can read it. ("Data is encrypted at rest and in transit.")
- Audit Trail: A record of who did what in the system.
- Data Residency: The requirement that data must be stored in a specific country.
Talking to Customers
- "Are you SOC2 compliant?"
- "We need to sign a DPA (Data Processing Agreement)."
- "Our Security Whitepaper explains our encryption standards."
Alex's Tip: Security is everyone's job. If you see a colleague sharing a password in a public Slack channel, that's a Security Risk. Remind them to use a password manager!
The Rule of 40 is one benchmark among several. A full health check also looks at:
- NRR above 100% : existing customers growing.
- LTV:CAC of 3:1 or higher : efficient acquisition.
- Low churn : customers staying.
- Gross margin above 70-80% : typical for SaaS, since serving one more customer costs little.
A company strong on all of these is in excellent shape.
Common mistakes
- Using revenue instead of profit margin. The Rule of 40 uses profit margin (often EBITDA margin), not revenue. Revenue is already part of the growth rate.
- Treating 40 as a hard pass/fail. It is a benchmark, not a law. A score of 38 is not a disaster; a score of 60 is excellent.
- Ignoring the trend. A score falling from 50 to 35 over several quarters is a warning, even if 35 is not catastrophic.
Practice
A SaaS company grows 30% per year and has a profit margin of 5%.
- What is its Rule of 40 score?
- Is it healthy?
Answers:
- Score = 30 + 5 = 35.
- It is slightly below the 40 benchmark. The company could improve either growth or margin to reach the healthy zone.
You have now completed the SaaS Business Models course. You can explain the subscription model, unit economics, churn, pricing, the acronyms, and the benchmarks of a healthy SaaS business. In the next course, Pitch Deck Language, you will learn to turn this vocabulary into a compelling pitch.