SaaS security and GDPR: the baseline, then SOC 2 or ISO 27001

A SaaS that stores personal data needs a baseline from its very first customer: each user only sees their own data, secret keys stay out of the code, a backup has already been restored, providers are under contract, and there is a procedure to report a breach to the regulator within 72 hours. A security and GDPR audit checks that baseline and ranks the gaps by severity. SOC 2 and ISO 27001 come later: no law requires them, but some customers demand them before signing, and a SOC 2 Type II report alone involves an observation period of several months.

What GDPR requires from a SaaS

Start with your role. For your own records (customer accounts, billing, prospects), you are the controller. For the data your business customers put into your product, you are usually their processor: you handle it on their behalf and on their instructions (EDPB guidelines on controllers and processors). Each role carries obligations, all set out in the GDPR.

• Secure the data with measures suited to the risk. Article 32 mentions encryption and pseudonymisation, the ability to restore access to data after an incident, and regular testing of how well the measures work.
• Keep a record of processing activities (Article 30). Organisations with fewer than 250 employees get an exemption, but it does not cover regular processing such as customer management, nor sensitive data (CNIL, in French). A SaaS is therefore in scope. The CNIL, the French regulator, offers a simplified template.
• Put every processor under contract (Article 28): hosting, email delivery, analytics, AI provider. And offer your customers your own data processing agreement, often called a DPA.
• Report a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33). Every incident must also be documented internally, even when it is not reported (CNIL, in French).
• Answer requests from individuals (access, correction, deletion) within one month, extendable by two further months for complex requests (Article 12).
• Cover transfers outside the EU with an adequacy decision or standard contractual clauses (CNIL, in French).
• Appoint a data protection officer (DPO) in the cases set out in Article 37, for example regular and systematic monitoring of people on a large scale, or large-scale processing of health data.

Fines are set by Article 83. Breaching the obligations on security, records or processors can cost up to €10 million or 2% of worldwide annual turnover. For breaches of the core principles and individuals’ rights, the ceiling rises to €20 million or 4%. In both cases, the higher amount applies.

Two more frameworks may apply depending on what you do.

• Health data in France. If your SaaS stores health data collected during prevention, diagnosis, care or follow-up on behalf of French professionals or institutions, the host must hold HDS certification (article L1111-8 of the French Public Health Code).
• The NIS2 directive. It sets cybersecurity requirements for medium and large entities in 18 sectors, and France was still transposing it at the time of writing (ANSSI, in French). A company with fewer than 50 employees whose turnover and balance sheet do not exceed €10 million usually falls outside its direct scope. But customers covered by NIS2 must secure their supply chain, including their relationships with direct suppliers (Article 21 of Directive (EU) 2022/2555). Expect security questionnaires and security clauses in contracts.

The security baseline: what an audit checks first

• Data accessEach customer only sees their own data, enforced on the server.
• Admin accountsNamed, two-factor authentication, at least two administrators.
• Secret keysNo keys in the code sent to the browser or in the repository.
• DependenciesVulnerability alerts switched on and acted upon.
• BackupsA restore tested, dated and documented.
• EnvironmentsTesting runs on a separate database, without real data.
• LogsAdmin actions are recorded and kept.
• LeaversAccess is removed on the day someone leaves.
• ProcessorsA list, a contract and a hosting location for each.
• IncidentsA written procedure to decide and report within 72 hours.

OWASP, the reference foundation for web application security, ranks the most critical risks in its Top 10 (OWASP Top 10:2025). The first three apply directly to a SaaS.

1. Broken access control: a user reads or changes data that is not theirs. AI-generated apps are exposed when database access rules are missing or too broad. In 2025, a CVE record reported sites generated with Lovable (up to 15 April 2025) whose database security rules allowed tables to be read or modified without authentication. Lovable disputes that it is a vulnerability and points out that each customer is responsible for protecting their own data (CVE-2025-48757).
2. Security misconfiguration: a test environment open to the internet, a public file storage bucket, an admin account without two-factor authentication.
3. Software supply chain failures: a vulnerable or abandoned dependency, a compromised third-party component.

To go further, two public references make good working bases: the CNIL’s practice guide for the security of personal data (25 factsheets, 2024 edition) and ANSSI’s guideline for a healthy information system in 42 measures. ANSSI is the French national cybersecurity agency.

The GDPR baseline: documents customers will ask for

Before signing, a business customer may send you a security and compliance questionnaire. Have these ready:

• an up-to-date record of processing activities;
• a privacy policy that describes what the app actually does;
• your data processing agreement template, to sign with each customer;
• the list of your own processors, with their hosting location and contract;
• retention periods, and evidence that data is actually deleted when they expire;
• the procedure for handling requests from individuals, tested on a test account;
• the breach procedure, with the internal incident log;
• a short description of your security measures that points to the real controls.

How does a security and GDPR audit work?

1. MappingWhich data, where, with whom, who can access it.
2. Technical checksAccess, secrets, dependencies, backups.
3. Document reviewRecords, contracts, procedures.
4. RankingEach gap rated P0, P1 or P2.
5. PlanDated fixes, named owners.

Each gap gets a priority:

• P0, immediate: anything that could cause a data leak or data loss, or block a sale in progress. Fix it before any new feature.
• P1, within the month: anything that clearly reduces the likelihood of an incident or a compliance failure.
• P2, within the quarter: anything that strengthens the organisation over time.

This kind of audit reads the code, the configuration and the documents. It does not replace a penetration test, which attacks the application from the outside to find what reading alone cannot show.

At Techvisor, the app audit covers the technical side of this baseline: data access, secret keys, backups, account ownership and costs. The express assessment takes about 3 working days (€1,200 excluding VAT); the full audit with a costed roadmap takes about 5 working days (€2,400 excluding VAT). For debt that slows the team down, see also the article on the technical debt audit.

SOC 2 and ISO 27001: what are they?

GDPR, SOC 2 and ISO 27001 side by side

Criterion	GDPR	SOC 2	ISO/IEC 27001
Nature	EU regulation	Attestation report, AICPA framework	International standard you can certify against
Mandatory	Yes, from the first piece of personal data	No, required by contract	No, required by contract
Who checks or issues it	Data protection authorities	An independent CPA firm	An accredited certification body
What you get	No mandatory certificate	A Type I or Type II report	A certificate
Period covered	Ongoing	Type I: one date. Type II: 3 to 12 months	3 years, with a surveillance audit each year

SOC 2 is an attestation framework defined by the AICPA, the professional body of American certified public accountants. An independent, licensed CPA firm examines your controls against the Trust Services Criteria, which cover five categories: security, availability, processing integrity, confidentiality and privacy (AICPA & CIMA). There are two types of report (Schellman):

• Type I assesses the design and implementation of controls at a specific date;
• Type II assesses their design and how well they actually operate over a period, from 3 months (often for a first report) to 12 months (the usual cadence for renewals), according to Schellman and A-LIGN.

A SOC 2 report is not public: it is meant for your customers and partners, sometimes under a non-disclosure agreement. A SOC 3 report is the public version, without the details of the tests (Schellman).

ISO/IEC 27001 is an international standard that sets the requirements for an information security management system: an organisation that assesses its risks, chooses its measures and keeps improving them (ISO). Certification is issued by an accredited certification body (in France, accreditation is handled by Cofrac) after a document review and then an on-site audit. The certificate is valid for 3 years, with a surveillance audit every year and a renewal audit every 3 years (AFNOR Certification, in French).

Neither replaces GDPR. And an audit like Techvisor’s prepares the baseline without issuing a SOC 2 report or an ISO 27001 certificate: only a CPA firm or an accredited certification body can do that.

When should you go for SOC 2 or ISO 27001?

Start the process in one of these situations:

• a customer or a tender requires it in the contract. Ask which framework they accept, for what scope, and whether a process under way is enough;
• security questionnaires take up so much of your team’s time that they slow sales down: a report or certificate can replace part of the answers;
• your customers fall under NIS2 or sector rules and have to prove that their suppliers are secure.

Until one of these happens, keep the baseline in place and prepare an answer pack: a standard questionnaire already filled in, a description of your security measures, the architecture diagram, the list of processors and your latest audit report.

To choose between the two, start from what your customers accept. SOC 2 comes from the United States; ISO/IEC 27001 is an international standard. If your customers accept both, compare scope, auditor cost and upkeep: a SOC 2 Type II report is renewed over a new period, while an ISO 27001 certificate goes through a surveillance audit every year.

The path to a first SOC 2 Type II report

1. 01ReadinessMeasure the gap between your practices and the chosen criteria.
2. 02RemediationPut missing controls in place, with their evidence.
3. 03Type I reportThe auditor checks the design of controls at one date.
4. 04Observation periodFor 3 to 12 months, the controls must operate.
5. 05Type II reportThe auditor attests to how they operated over the period.

My take as a CTO

For 8 months, I was Engineering Manager at Resilience Care, a 200-person scale-up: I led 10 people across two teams on the oncology scope, in a regulated medical environment. In my view, in a regulated setting as anywhere else, security depends less on audit day than on the team’s everyday habits: access that gets reviewed, releases that are traceable, test data that is not real data. When I audit an app that handles health or banking data, I also check where that data is hosted and who can access it, and I can work without any real patient data. My advice for a SaaS run by a handful of people: hold the baseline and prepare an answer pack before talking about SOC 2. Start a certification process when a customer asks for it in writing, using the framework they accept.

Frequently asked questions

Does GDPR apply to a SaaS that only sells to businesses?

Yes. Your customers’ users are people: their names, email addresses and logins are personal data. For that data you are usually your customers’ processor, and you remain the controller for your own records.

Do we need a DPO?

Only in the cases listed in Article 37 of the GDPR: a public body, regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive data such as health data. Otherwise it is optional, but someone still needs to own the subject.

SOC 2 Type I or Type II: which comes first?

Type I is quicker: it checks the design of your controls at a given date, and Schellman describes it as a good starting point for a first examination. Type II proves they operated over several months. Before choosing, ask your customer which one they accept.

How long does a first SOC 2 Type II report take?

Allow time for readiness and remediation, which depends on your gaps, then an observation period of 3 to 12 months, then the time the auditor needs to write the report. The total is measured in months, so be wary of anyone promising it in a few weeks.

Does NIS2 apply to my startup?

Directly, only if your activity falls within one of the 18 sectors covered and you are larger than a small enterprise (at least 50 employees, or turnover and balance sheet above €10 million). Some activities, such as DNS services, are covered whatever their size. Indirectly, as soon as your customers fall under it: they will ask you for security guarantees. France’s transposition was still in progress in early November 2026, and ANSSI keeps its NIS2 page up to date.

Next step

To check where you stand, the production-readiness checklist (in French) has several sections on the baseline described here: data and access security, secrets and API keys, accounts, backups and GDPR.

For an outside view of the technical side, the app audit gives a green, amber or red light for each point, with examples from your code and a plan. To find out whether it fits your situation, book a 15-minute call. The call costs nothing and comes with no commitment.

Sources

• EUR-Lex, Regulation (EU) 2016/679 (GDPR)
• European Data Protection Board, Guidelines 07/2020 on the concepts of controller and processor
• CNIL, record of processing activities (in French)
• CNIL, reporting a personal data breach (in French)
• CNIL, transfers outside the EU (in French)
• CNIL, Practice guide for the security of personal data, 2024 edition
• ANSSI, Guideline for a healthy information system in 42 measures and NIS 2 page (in French)
• EUR-Lex, Directive (EU) 2022/2555 (NIS2)
• Légifrance, article L1111-8 of the French Public Health Code (in French)
• OWASP, Top 10:2025
• CVE, CVE-2025-48757 record
• AICPA & CIMA, 2017 Trust Services Criteria (with revised points of focus, 2022)
• Schellman, SOC Type 1 vs Type 2 and SOC 2 vs SOC 3
• A-LIGN, SOC 2 Type I vs Type II
• ISO, ISO/IEC 27001
• AFNOR Certification, ISO 27001 certification (in French)