Your first enterprise deal doesn't die on price. It goes quiet. The champion loves the demo, the number works, and then it hits their security team — and a questionnaire lands in your inbox with a Data Processing Agreement attached, and you have nothing to send back. That silence is the deal stalling, and the fix is not charisma. It's a finite, known set of documents you can assemble in weeks.
Here's the whole answer up front, because it's the thing you actually came for: an enterprise buyer expects four artifacts — a SOC 2 report, a signed DPA, a subprocessor register, and a completed security questionnaire — and in 2026 that questionnaire now carries an AI-governance section that asks which models you use, whether you train on their data, and how long you keep it. Get those, in the right order, and the deal moves. Everything below is how.
The core four an enterprise buyer expects#
Strip away the theater and every enterprise security review reduces to four things.
1. A SOC 2 report. SOC 2 is an independent auditor's attestation that your security controls exist and operate, measured against the AICPA's Trust Services Criteria (security, and optionally availability, confidentiality, processing integrity, privacy). There are two flavors and the difference is time: Type I proves your controls are designed right at a single point in time; Type II proves they operated correctly over a window of three to twelve months. Type II is the one large buyers trust. You get Type I first to unblock deals now, then let the Type II window run.
2. A signed Data Processing Agreement. The moment a customer's data enters your system, you're a processor, and a DPA is the contract that governs it — GDPR Article 28 terms plus, for an AI product, explicit training and retention defaults. Adapt a solid template; sign one per deal.
3. A subprocessor register. A living list of every vendor that touches customer data: your hosting provider, your analytics, and — the one enterprises now zero in on — your model provider. Include change-notification terms so the buyer knows when the list changes.
4. The security questionnaire itself. Fifty to three hundred questions. The first one costs you a couple of days; after that you reuse the answers. Answer honestly — an unknown answered "not yet, targeting Q4" is fine and expected. An evasive answer is not.
The rest — a penetration test, a public trust page, your written policies — exists to support these four. A trust page in particular earns its afternoon of work by deflecting half the questionnaire before it's ever sent.
What's genuinely new in 2026: the AI-governance module#
If you sell an AI product, the standard questionnaire now has a section that didn't exist two years ago. Enterprise procurement teams have added a dedicated AI-governance module on top of the usual security review, and its questions have settled into a de facto standard around four areas:
- Model provenance — which foundation models sit behind your product, and who owns their training corpora.
- Data flow — every hop a prompt takes from input to output, and where it's stored at each step.
- Training and retention policy — in writing, with retention windows named in days.
- Subprocessor disclosure — the full register, with change-notification terms.
Expect frameworks like ISO 42001 and the NIST AI RMF to be named as the shape of a good answer. You don't need certification against them on day one, but you should recognize the vocabulary.
The single question that sinks unprepared founders: "Do you train on our data?" A bare "no" is no longer accepted, because security teams have watched too many "we don't train on your data" answers get walked back once the DPA arrived carrying product, feedback, opt-in, or fine-tuning exceptions. The bar now is a signed document that maps to the questionnaire line by line. So the correct move is to put your model provider on its enterprise, zero-retention, no-training tier, sign that provider's DPA, and answer from the document — listing the provider as a subprocessor and naming its retention window. Honesty with paper beats confidence with nothing.
What it costs and how long it takes#
Two separate bills, and founders conflate them constantly. A compliance-automation platform — Vanta, Drata, or Secureframe — wires evidence collection into your cloud and tools and runs roughly $5–12K/year (Secureframe has been the aggressive price leader for startups; Vanta sits at the higher end). Separately, an independent CPA firm performs the audit for roughly $15–50K depending on scope (2026 pricing breakdown). Budget $30–90K all-in for Type I then Type II in year one, plus your own hours.
On timeline: a Type I report typically lands in 8–12 weeks once your integrations are connected and policies are drafted. Type II then adds a 3–12 month observation window — and this is the number that punishes procrastination, because you cannot compress it after the fact. The observation clock only runs forward. That single constraint is why "start SOC 2 the week you smell your first enterprise deal" is the whole strategic insight of this piece.
The order that saves the deal#
Do these in sequence and you convert a stalled deal instead of losing it:
- Fix your model provider first. Move to the zero-retention / no-training enterprise tier and get its DPA in hand. This is the fastest, highest-leverage step and it pre-answers the hardest questions.
- Publish a trust page and your own DPA template. An afternoon of work that deflects half of every future questionnaire and lets buyers self-serve.
- Write your subprocessor register. An hour. Keep it current.
- Start SOC 2 with a platform now — so the Type II window is already running when a buyer asks.
- Answer the questionnaire honestly, today. "Type II in progress, here's our Type I, DPA, and subprocessor list" is a converting answer. Silence is not.
None of this is the moat — your product is. But in 2026 the gate between a verbal yes and a signed contract is a security review, and it rewards the founder who treated compliance as a finite checklist to get ahead of, not a fire to fight after the deal was already cold. If your buyer is EU-facing, pair this with the EU AI Act Article 50 disclosure checklist and, if you operate across regions, the seams where model, data, and content rules fork by market. And when the questionnaire asks how enterprise identity flows into your tools, the answer is usually SSO and managed authorization at the boundary.
