What breaks when your first enterprise customer arrives?
you're moving fast, you've shipped login, it works, users are in. and then an enterprise prospect shows up and the first thing they ask is 'do you support SSO?' and suddenly the thing you built in a weekend is blocking a six-figure deal.
but SSO is usually just the first question. after that comes the security questionnaire. then someone asks about audit logs. then their IT team wants to know how they'll provision and deprovision users at scale. then legal asks about data residency.
none of these are unreasonable asks. they're just things that consumer auth setups were never designed to handle, and retrofitting them while the deal is live is one of the more stressful engineering experiences a startup can have.
the teams that handle this well usually didn't predict every enterprise requirement upfront. they just built on a foundation that could extend without being rebuilt from scratch.
curious what actually broke first for people when the first enterprise customer arrived. was it SSO, audit logs, permissions, something else entirely?
Replies
Data residency is one those things you probably dont think about until a customer actually asks for it.
MonoCloud for Startups
@bradywilfaqn exactly!! and by the time they ask, it's usually not a nice to have anymore. it's a blocker. and retrofitting data residency into an architecture that wasn't designed for it is a very different project than building it in from the start.
I'm on the other side of this one. I run engineering inside a big org, so I'm closer to the people who send you that questionnaire than the people filling it in, and what kills vendors from where I sit is never a missing feature.
It's an answer that shows there's no process behind the capability. "Do you have audit logs" is asking whether anyone ever looks at them. Deprovisioning is the same: the honest failure isn't that you can't remove a user, it's that nobody can tell me who removed the last one or when. A small vendor who writes "no SCIM this quarter, here's when, and here's how offboarding works by hand until then" gets through review. One who answers yes to everything and then can't produce a single example triggers a second round of questions, and the second round is where deals actually die.
SSO, logs and provisioning are things a startup can buy from you. Evidence that somebody reviewed access last quarter isn't, and it's the one item on that list nobody can backfill once the deal is live. So if I were advising the startup side, the cheap thing to start today is writing down who approved what in whatever ugly file, from the first customer on.
MonoCloud for Startups
@siarheihamanovich this is a good distinction. SSO, logs, provisioning etc. get treated as feature requirements, but having them doesn’t mean much if there’s no process behind them.
and agreed on the evidence part. you can add capabilities later. you can’t recreate a history you never recorded.