Free tool · 5 minutes

The 12-point enterprise-readiness self-check

Tick every statement that is TRUE for your company today. Be honest — this runs entirely in your browser; nothing is stored or sent anywhere. Your unticked boxes are, almost exactly, the questions you will fail in a real enterprise security review.

01Data handling & storage

We can state exactly where customer data is stored (provider, region, country) without checking. Customer data is encrypted at rest and in transit, and we can name the standards used.

02Access control

Access to production and customer data is role-based, logged, and reviewed at least quarterly. Every customer's data is isolated from every other customer's, and we can explain how.

03AI & model governance

We can answer, in writing, whether customer data is used to train or fine-tune any model. Our AI guardrails (input/output filtering, misuse prevention) are documented, not just implemented.

04Secure development

Code is scanned for vulnerabilities before release (automated, in the pipeline, not occasional). We have had at least one external penetration test, or one is scheduled.

05Incident response

A written incident-response plan exists, with named roles and customer-notification timelines. We could tell an enterprise customer, contractually, how fast we would notify them of a breach.

06Business continuity

Backups exist, are tested, and we know our recovery time if the primary environment dies. We can state our uptime commitment and what happens when we miss it.

07Vendors & subprocessors

We keep a current list of every third party that touches customer data — including AI model providers. We could hand an enterprise our subprocessor list today without scrambling.

08Compliance posture

We can state, honestly and precisely, our SOC 2 / ISO 27001 status and the date we expect the next milestone. We know which privacy laws (GDPR, CCPA, etc.) apply to our customers' data, and our answer is written down.

09Logging & audit trails

Access to customer data is logged, and logs are retained long enough to investigate an incident months later. An enterprise could ask "who accessed our data in March?" and we could answer.

10Privacy program

We have a real privacy policy that matches what the product actually does. We can honor a deletion request — fully, including backups and any model-related copies — and describe how.

11Security documentation

A security overview document exists that we could send a prospect within one hour of being asked. Our policies (access, incident, vendor, data handling) are written, dated, and owned by someone.

12Questionnaire & RFP readiness

We could return a 200-question security questionnaire in days, not weeks, without derailing engineering. Someone on our side is named as the owner of security reviews — and it is not "whoever is free".

Tick what is true — your score updates live.

0 / 24 confirmed

Discuss your gaps — 25 min, free

Scoring: 19–24 confirmed — nearly ready; polish the gaps before your next enterprise cycle. 12–18 — you will lose deals in review; the gaps are fixable in weeks, in the right order. Under 12 — do not enter an enterprise sales cycle yet; fix the deal-blockers first. The fixed-price Enterprise-Readiness Audit turns every unticked box into a ranked fix-it plan.