Agentum Cloud
Agentum

Sourced writing from Agentum R&D

Enterprise-Grade, Explained · For business owners

What "enterprise-grade" means: ten things to check

By Agentum R&D · 5 min read
Published · Updated

Short answer "Enterprise-grade" has no standard definition. It usually means ten checkable things: single sign-on, multi-factor login, roles, least privilege, an audit log, encryption, tested backups, an uptime promise, a SOC 2 report and a data processing agreement. Ask about each, and ask for proof.

"Enterprise-grade" shows up on every software sales page and in every developer's quote. It sounds like a standard, but there is no standard definition: NIST's security glossary, for one, has no entry for it. What it usually bundles is ten things you can check. Here they are, each with an official definition in plain English and one question to put to whoever sells or builds your software.

Enterprise-grade as ten things to check, each with a question to ask. Who gets in: single sign-on (which login providers?), MFA (can we require it for everyone?). What they can do: roles (show me the roles), least privilege (what can the AI and integrations reach?), audit log (can I see who deleted this?). Keeping data safe: encryption (HTTPS everywhere, and at rest?), backups with RPO and RTO (when was a restore last tested?). Promises on paper: SLA (what happens if you miss it?), SOC 2 (send your latest SOC 2 report), DPA (send me your DPA).
Ten things to check. Ask for proof, not adjectives.

Who gets in

1. Single sign-on (SSO)

One account and its login are used to reach several applicationsSource 1. For you, that means staff sign in with the company's Google or Microsoft account, and when someone leaves, switching off that one account stops them signing in to every app connected to it.

Ask: "Which login providers do you support, is SSO included in our plan, and when we switch someone off, how fast are they logged out?"

2. Multi-factor authentication (MFA)

Logging in with two or more different kinds of proof: something you know, such as a password; something you have, such as a phone or key; or something you are, such as a fingerprintSource 2. A stolen password alone is then not enough.

Ask: "Can we make MFA compulsory for every staff account, including the owner's?"

What they can do

3. Roles

Permissions come with a role, such as "front desk" or "manager", rather than being set person by personSource 3. New staff get a role on day one, and when someone changes job, you change their role instead of untangling years of one-off permissions.

Ask: "Show me the roles the system has and what each one can see and change."

4. Least privilege

Every user, and every program acting for a user, gets the minimum access needed for the taskSource 4. This matters more now that AI assistants and integrations act on your behalf: our post for developers on AI tool connectors (MCP servers) shows what goes wrong when one holds more access than its job needs.

Ask: "What can your AI features and integrations reach in our data, and can we narrow it?"

5. Audit log

A time-ordered record of what happened in the system, including logins and the actions taken, over a given periodSource 5. When a customer record vanishes, the log is where you find out what happened.

Ask: "If a booking or customer record is deleted, can I see who did it and when, and how long is that kept?"

Keeping data safe

6. Encryption

Scrambling data so it can't be read without the keySource 6. You want it in two places: in transit, which on the web means HTTPS, built on Transport Layer Security (TLS), the protocol that protects data between two applicationsSource 7, and at rest, on the disks and backups.

Ask: "Is all traffic HTTPS, and are the database and backups encrypted on disk?"

7. Backups, with RPO and RTO

Two numbers describe a backup better than "yes, we back up". The recovery point objective (RPO) is the point in time to which data must be recovered after an outageSource 8: in plain terms, how much recent work you can afford to lose. The recovery time objective (RTO) is how long the system can stay in recovery before your business is hurtSource 9. Decide yours first: if losing a day of bookings would hurt, a nightly backup is not enough.

Ask: "What RPO and RTO do you commit to in writing, and when did you last test a restore?" A backup nobody has restored is a hope, not a plan.

Promises on paper

8. Service level agreement (SLA)

A contract that sets out what the provider is responsible for and what you can expectSource 10, usually including uptime. Do the arithmetic: 99.9% uptime still allows about 43 minutes of downtime in a 30-day month.

Ask: "What uptime do you promise in writing, and what happens if you miss it?"

9. SOC 2 report

SOC stands for System and Organization Controls, a family of reports that certified public accountants (CPAs) provideSource 11. A SOC 2 report covers a service company's controls relevant to security, availability, processing integrity, confidentiality or privacy, under standards set by the AICPA, the US body for CPAsSource 11. A vendor saying it is "SOC 2 compliant" is a claim; the report is the evidence. In February 2026, CPAs quoted in the AICPA's Journal of Accountancy warned that promises of "fast and easy" SOC reports threaten their credibility, and told clients to vet the CPA firm doing the workSource 12. So check which firm signed it.

Ask: "Can you send your latest SOC 2 report, under a non-disclosure agreement (NDA) if needed? If you have none, which hosting company's SOC 2 do you rely on?" A host's report covers the host, not the vendor's own app and staff.

10. Data processing agreement (DPA)

Under the EU's General Data Protection Regulation (GDPR), when a company processes personal data on your behalf, that processing must be governed by a binding contract that sets out what is processed, why and for how longSource 13. Software that stores your customers' details usually needs one, and other privacy laws have similar requirements. Ask a lawyer which apply to you.

This is general information, not legal advice. Check with a lawyer for your situation.

Ask: "Please send me your DPA, the list of subprocessors (the other companies that handle our data for you) and where our data is stored."

Using the list

You won't need all ten for every tool. A booking widget may not need SSO; anything holding customer records needs roles, an audit log, encryption and tested backups. Use the list to compare quotes, and treat a vague answer as a "no" until you see proof. If an AI tool built your app, our ten-minute data-leak check is a good first test of the database.

  1. Staff log in with MFA, through SSO where you have it And leavers are locked out the same day.
  2. Roles exist, and nobody has more access than the job needs
  3. An audit log answers "who deleted this?"
  4. Data is encrypted, and a restore has been tested Know your RPO and RTO.
  5. You hold the SLA, the SOC 2 report and the DPA

Sources

  1. single sign-on (NIST CSRC Glossary). Retrieved . ↩
  2. multi-factor authentication (NIST CSRC Glossary). Retrieved . ↩
  3. role-based access control (NIST CSRC Glossary). Retrieved . ↩
  4. least privilege (NIST CSRC Glossary). Retrieved . ↩
  5. audit log (NIST CSRC Glossary). Retrieved . ↩
  6. encryption (NIST CSRC Glossary). Retrieved . ↩
  7. Transport Layer Security (NIST CSRC Glossary). Retrieved . ↩
  8. recovery point objective (NIST CSRC Glossary). Retrieved . ↩
  9. recovery time objective (NIST CSRC Glossary). Retrieved . ↩
  10. service level agreement (NIST CSRC Glossary). Retrieved . ↩
  11. SOC suite of services (AICPA & CIMA). Retrieved . ↩ ↩
  12. Promises of 'fast and easy' threaten SOC credibility (Journal of Accountancy, Feb 2026). Retrieved . ↩
  13. Art. 28 GDPR: Processor (gdpr-info.eu). Retrieved . ↩

Published · Updated Report an error (support@agentum.cloud)