We're about to roll out a new analytics tool to the sales team. Our infosec team is small but famously... thorough. Last time I went in without a solid checklist, it added three weeks of back-and-forth.
What key items should I have locked down before the first meeting? I'm thinking data residency, user access controls, and audit logs. What else do they always ask for that a sales ops person might overlook? Specifics for a B2B SaaS context would help.
I'm a product analytics lead at a 450-person B2B SaaS company, and we run security reviews for tools like Mixpanel, Amplitude, and LaunchDarkly a few times a year.
Your list is a good start. In my experience, here are the four concrete items that always come up and where people in sales ops usually get tripped up.
1. **Data Flow and Vendor Subprocessors**: You need a full data flow diagram, not just the tool's location. For a sales analytics tool, where is the data coming from (CRM, enrichment tools) and going to? Infosec will ask for the vendor's list of subprocessors (like AWS regions, SendGrid for alerts). A common oversight is not realizing that user uploads (like CSV imports for sales lists) might be processed by a separate subprocessor.
2. **Exact User Permissions Model**: Saying "role-based access control" isn't enough. Be ready to show *exactly* what a "Viewer" vs. "Editor" can do. Can they export raw data? Can they delete dashboards or data sources? Can they modify user access? At my last shop, the hold-up was specifically about whether a salesperson could export a filtered dataset to a local CSV, which was a yes, so we had to add a specific clause to our acceptable use policy.
3. **Audit Log Fidelity and Retention**: They'll ask for the audit log spec. Can you see who queried *which* dataset, not just that they logged in? Are failed authentication attempts logged? Most importantly, what's the retention period? For many tools, it's 90 days by default, but enterprise contracts often require 1 year. Getting that extended usually requires a contract change, not just a toggle.
4. **Data Deletion and Account Offboarding Procedure**: This is a big one. How do you delete an individual's data (for a GDPR CVR request)? Is it truly deleted or just anonymized? For a sales tool, this often ties back to the CRM's user ID. Also, what's the process for a full account deletion if you switch vendors? Get the vendor's written process and expected timeframes. A typical gotcha is that "deleted" data may persist in backups for their stated retention period, which is fine, but you need to document it.
My pick for your scenario would be to lock down the subprocessor list and the audit log retention first, because those require vendor input and can stall contract signing. To make a cleaner recommendation, tell us if your sales team handles any regulated data (like HIPAA) and whether your contract with this tool is already signed or still in negotiation.