Industries

Enterprise readiness arrives as a deal blocker, not as a roadmap item.

SaaS companies discover SSO, audit logs, data residency and certification when a large deal depends on them. MENTARA works that gap before it costs a contract.

Discuss a SaaS priority Read the detail

More in Industries

The sector's actual constraint

A recurring pattern in growing SaaS businesses: the product wins on capability and speed, moves upmarket, and then meets a procurement and security review that asks for things the product does not have — SAML SSO, SCIM provisioning, granular audit logging, role-based permissions, data residency options, a security certification and a penetration test report.

None of these are hard individually. Collectively they are months of work that was never prioritised, because until the first large deal nobody was asking, and every quarter that work lost to features that customers were requesting.

The failure mode

Multi-tenancy decisions made early, paid for later.

Early architectural choices about tenant isolation are made when the requirements are simplest and are extremely expensive to revisit. A shared-schema model is efficient and fast to build, and it becomes a serious constraint the first time a customer requires data residency in a specific jurisdiction, or a contractual guarantee of isolation, or the ability to be restored independently of other tenants.

By then the model is embedded in the data access layer, the migration tooling, the backup strategy and the operational runbooks, and changing it is a programme rather than a project — usually one that competes with the revenue-generating roadmap and loses.

The second pattern is cost per tenant being unknown. Infrastructure cost is tracked in aggregate rather than attributed to tenants, so nobody knows which customers are unprofitable. Pricing then gets set on a blended assumption, and the heaviest users are subsidised by the lightest — which becomes acute exactly when a large customer with heavy usage negotiates a discount.

Priorities

Where the work usually sits.

01Enterprise readinessSSO, SCIM, audit logging, permission models and residency options — scoped as a coherent programme rather than discovered one deal at a time.

02Tenant isolation strategyWhat your model can support, what it cannot, and what changing it would cost — before a contract depends on the answer.

03Security certification preparationThe management system, controls and evidence that SOC 2 or ISO 27001 require, and preparation for audit by an accredited body.

04Cost per tenantAttributing infrastructure cost to customers so pricing and packaging decisions rest on actual margin.

05Scaling and reliabilityWhere the architecture breaks next, and the SLA commitments you can credibly make to enterprise buyers.

06Delivery pace as the product growsKeeping release frequency as the codebase, team and customer commitments all grow — usually a testing and environment problem.

Questions

What buyers ask.

Can you get us SOC 2 certified?

We can help you build the management system, controls and evidence model, and prepare for audit. Certification itself requires an accredited auditor, which we are not.

Stated plainly: MENTARA does not hold SOC 2 or ISO 27001 itself. You should weigh that when deciding whether we are the right firm to advise you on obtaining it — our value here is the engineering and process work, not a credential we could lend you.

We need to move fast. Will this slow us down?

Some of it will, and pretending otherwise would be dishonest. Tenant isolation changes and audit logging are real engineering work that competes with your roadmap.

The useful judgement is which parts genuinely block deals now, which can be staged, and which are being asked for by a procurement checklist rather than a real requirement. That triage is frequently the most valuable part of the engagement.

Where MENTARA fits best.

Scope

We fit architecture and readiness assessment, isolation and residency strategy, certification preparation and cost attribution — senior judgement rather than volume capacity.

Penetration testing, audit attestation and adding twenty engineers to your product team next month are all better served elsewhere.

MENTARA was incorporated in July 2026 and has no published client work in this or any sector, so the quality of the thinking on this page — and in a first conversation — is what there is to judge us on.

Where this connects

Services

Workforce model

Dedicated Delivery Teams