Enterprise SaaS deals that die late rarely die on the demo. They die in the buyer's review gates, which are the vendor security assessment, procurement and legal, and the IT team's question about how your product connects to the CRM they already run. Selling to enterprise means treating those gates as part of the sale from the first call, with an owner, an answer and a date for each, instead of discovering them after your champion says yes.
For a SaaS company, the gate that most often has no answer is the integration. A buyer who runs Salesforce or HubSpot wants to see your product working inside it, reviewed and installable, before procurement signs. Appnigma's done for you integrations service is built for that moment ("Build your product. We'll build the integrations."), and its marketplace apps team gives buyers "a working integration in the system they already use." If you came here about selling your SaaS company to an acquirer, this page is about selling the product, not the business.
Updated October 2026. Checked against Gartner's and Forrester's latest buyer research, the AICPA and ISO descriptions of SOC 2 and ISO/IEC 27001, Salesforce's ISVforce Guide and HubSpot's marketplace docs. The earlier version gave unsourced figures for committee size, sales cycle length and pilot length, called SOC 2 a baseline certification, and never covered the platform reviews behind a native integration. This update replaces those with sourced figures and adds the integration review most enterprise sales guides skip.
Who decides an enterprise SaaS purchase now
More people than your champion can reach, and they don't agree. Gartner's 2024 survey of 632 B2B buyers found buying groups of "five to 16 people across as many as four functions," with 74% of buyer teams showing unhealthy conflict, per Gartner's May 2025 release. Forrester's State of Business Buying 2026 adds that procurement decides in 53% of buying cycles, "engaging from the start of the process." The two firms count differently, so don't combine their numbers.
You can't win a group that size one persona at a time. Map it by gate instead, with a document that clears each gate and a named owner on your side.
| Gate | Who raises it | What clears it | Owner on your side |
|---|---|---|---|
| Business case | Sponsor, finance | ROI memo in their numbers | Account executive |
| Vendor security assessment | IT security, risk | SOC 2 report, completed questionnaire | Security or engineering lead |
| Integration review | CRM admin, IT architect | Install path, permissions, data flow | Product or integration owner |
| Procurement and legal | Procurement, legal | Order form, DPA, redlines | Founder or deal desk |
| Rollout | End-user managers | Pilot results, onboarding plan | Customer success |
The integration row is the one most SaaS teams leave blank until IT asks, usually after the business case is approved. It is also the only row where a document alone won't do, because the admin wants to see the product running in their org.
Why deals stall after the champion says yes
Late stalls are a sequencing problem. The champion approves the business case first, and that approval is what triggers security, IT and procurement, each with its own queue. G2's 2024 buyer behavior research found "97% of respondents involve a security stakeholder" and "80% said their company requires a security or privacy assessment when purchasing software." In G2's 2023 report, over 80% said integration with existing tools matters, "ranking ease of integration even over the cost of the software."
Those are two separate reviews. The vendor security assessment judges your company, meaning how you store data, who can reach it and how you handle incidents. The integration review judges the connection, meaning what your product touches in their CRM and how the admin removes it. A champion can forward your deck but can answer neither, so start both in the first two meetings and let them run alongside the commercial conversation.
Two discovery questions surface the integration review early. Ask who approves new apps in their Salesforce or HubSpot account, and get that person on a call before the business case goes up. Then ask which Salesforce edition they run. "API access isn't normally supported in Group and Professional Edition orgs," and becomes available for some APIs only "after your app passes the security review," per API Access in Group and Professional Editions. A Professional Edition buyer can't run an API-only integration you planned to ship next month, and finding that out in week eight kills the quarter.
What your security packet must cover once CRM data leaves the org
The usual packet is a SOC 2 Type 2 report plus a completed standard questionnaire, either the Cloud Security Alliance's CAIQ or the Shared Assessments SIG. What sinks integration vendors is the scope of that packet, not whether they have one.
A SOC 2 report covers the system your company described to the auditor. The AICPA calls it an "assertion-based examination of a service organization's description of its system," per the AICPA SOC 2 guide. If the service that syncs Salesforce or HubSpot data was built after the audit, or runs on a third party's middleware, a careful reviewer will find it outside that description. Check the system description in your own report before you send it. If the integration isn't in it, say so and answer for that component separately, including which third party hosts it as a subprocessor.
The integration answers reviewers ask for most map to three facts about your connector.
| Reviewer question | What to answer for the integration |
|---|---|
| Where is customer data stored? | Which CRM fields you copy, where they're cached and for how long |
| How are credentials protected? | Where OAuth tokens live, how they're encrypted, how they're revoked |
| Who can access the data? | Which of your staff can see synced records, and how that's logged |
Two naming details also matter to security teams. Call it a SOC 2 report, because it is an attestation by a CPA firm. ISO/IEC 27001 is a certification, but not one ISO issues. ISO says it "does not perform certification or issue certificates," per ISO's certification page. Name the certification body that issued yours.
What IT asks about your Salesforce or HubSpot connection
The CRM admin's questions are concrete. They want to know what gets installed, who gets access and how to back it out. Answer in the platform's own terms and the review moves faster, because the admin can check your answers against what they see at install.
On Salesforce, a native app ships as a managed package, which Salesforce defines as "a bundle of components that make up an application or piece of functionality" in the first-generation packaging guide. At install, the admin chooses between installing for admins only, for all users or for specific profiles, per Install a Package. You can include an access permission set "so that subscriber admins can grant users access after install," per packageable components. The exit path is documented too. "Uninstalling a managed package removes its components and data from the org," and Salesforce deletes the export file two days after uninstall, per Manage Installed Packages.
On HubSpot, the answer starts with OAuth. "OAuth is required for multiple accounts, while static auth access tokens are used for installing in a single account at a time," per HubSpot's authentication overview. Private distribution caps out at 10 accounts, so an app you plan to sell broadly has to be built for OAuth from the start. Listed apps "must use all of the scopes that it requests during installation," per the listing requirements, which makes the scope list a quick thing for an admin to verify.
Two details save a review cycle. Admins often install for admins only first, then widen access, so ship an access permission set and tell them which one to assign. And if your package isn't authorized for distribution yet, Salesforce warns the admin "during installation," per Unauthorized Managed Packages, so tell them before they see it.
The overview that clears this review fits on one page. It shows what installs, which objects and fields it reads and writes, which permission set or scopes it needs, where data leaves the CRM and how the admin uninstalls it. Every customer's org is different, with its own custom objects and field mappings, so leave room for the mapping the admin will ask to change.
Does an AppExchange or HubSpot listing replace the buyer's security review?
No. A listing tells the buyer the platform reviewed your app. It doesn't replace their own vendor assessment, and Salesforce says so in its terms. Salesforce "makes no guarantees regarding the quality or security of any Partner Application and Customers are responsible for evaluating" partner apps, per Pass the AgentExchange Security Review. Expect the same questionnaire and SOC 2 request either way.
What the listing adds is evidence the connection itself was tested. Salesforce's Product Security team scopes its review with "a follow-the-data approach. Wherever the customer goes, we go," including your external web applications and services, per Required Materials. That is exactly the path the customer's IT architect worries about. Salesforce also runs periodic re-reviews of listed apps, per Periodic Security Re-Reviews. The install guide tells admins that "private listings do not go through a security review," per the AgentExchange install FAQ, so a package shared privately gets more scrutiny, not less.
HubSpot has two levels. A listing needs "at least three active, unique installs" from unaffiliated production accounts, per the listing requirements. Certification is the stronger security signal. It adds a web security assessment and a questionnaire on "encryption, access controls, and token lifecycle management relating to OAuth token access," per HubSpot's certification requirements. You can only apply after six months listed with 60 active installs, per applying for certification, so an early vendor can't show the badge yet and should send the listing plus its own answers to the same questions.
Buyers expect this route. Salesforce reports "91% of Salesforce customers using at least one AppExchange app," per a February 2026 Salesforce newsroom story. Our post on why a native app does not skip the buyer's vendor review goes deeper on the Salesforce side.
How to plan platform review time into the close date
A deal that needs a listed app has a calendar the buyer doesn't control and neither do you. Salesforce says "approximately 4 to 6 weeks after you submit a solution for an initial review, your security review is complete," per Act on Security Review Results. Its stage estimates are 1 to 2 weeks for submission verification, 3 to 4 weeks for the first test and 2 to 3 weeks for a resubmission test, per How the Security Review Works.
Here is the arithmetic from those published estimates, not from any customer. A clean first pass takes 4 to 6 weeks. One failed round adds a resubmission test, which makes it 6 to 9 weeks. Add the build before submission, and a buyer whose quarter ends in eight weeks needs the package submitted almost immediately. Appnigma's marketplace apps page gives one real reference point. Warmly's kickoff-to-AgentExchange launch took eight weeks, "including six weeks of Salesforce security review," which the page labels "a project example, not a guaranteed schedule."
HubSpot's order of operations is different. You need three active installs before the listing review, and HubSpot's team then completes "an initial review within 10 business days," per the listing requirements. Your first enterprise HubSpot customer may install before you are listed, so their admin is reviewing an unlisted OAuth app. Plan the integration overview for that case.
Tell the buyer which dates you control and which the platform controls. Our guide to how long the Salesforce security review takes breaks down each stage, and the HubSpot App Marketplace guide covers listing and certification.
How to run a pilot that ends in a signature
Forrester found "more than 60% of business buyers now make use of a trial," rising to 78% for purchases of $10 million or more, per The State of Business Buying 2026. For a product that lives next to the CRM, the pilot is also the integration review, so design its exit criteria around the admin as well as the user.
| Exit criterion | Who signs it |
|---|---|
| Records sync in their production org, with their custom fields mapped | CRM admin |
| Permission set or scopes match what the security review approved | IT security |
| Uninstall or disconnect tested, with the data that stays behind written down | CRM admin |
| The business metric agreed at kickoff moved | Sponsor |
Put those criteria on a mutual action plan, which Salesforce defines as "a document shared between the seller and the buyer to set expectations throughout every stage of a sales cycle," per the Salesforce blog. Add the platform review dates if your app isn't listed yet. A pilot run in a sandbox with sample data skips the first three rows, and those rows are what procurement asks about next.
Mistakes that lose enterprise SaaS deals late
- Promising "native" without a scope. The buyer hears "inside our Salesforce, with our custom objects." Write down which objects, which fields and which edition you support before the demo.
- Treating the listing as a pass. The listing proves a platform review, not the buyer's. Send the questionnaire anyway.
- Requesting scopes you don't use. On HubSpot it blocks the listing, and on any platform it invites questions from the admin.
- Sending a private package without saying so. Salesforce tells admins private listings skip review, so explain what you tested and why it's private.
- No owner after the deal closes. The admin's last question is who fixes the integration when their org changes. If the answer is "the core team, between sprints," the risk shows up in renewal.
Who should build the integration a deal is waiting on
Decide by what happens after the deal, not by who can build it fastest. One deal waiting on one CRM is a project. Every enterprise deal asking for the same CRM is a product line, and it needs an owner for each customer's org changes, platform releases and re-reviews long after the contract is signed.
| Route | Fits when | What you own after launch |
|---|---|---|
| Your engineers, from scratch | The integration is core to your product | Everything, on the roadmap's time |
| Your engineers on integration infrastructure | Many customers need variations of one integration | Logic, with per-customer mapping handled by the infra |
| Done for you | A deal is waiting and the core team can't stop | Review and approval, with build and maintenance handed off |
Appnigma offers both outside routes. On its integration infrastructure your engineers build the logic. The page's promise is that "a change for one customer does not have to change the integration for everyone else." With done for you delivery, Appnigma builds the integration with custom logic and backend changes, then maintains it, with code delivered to your repository. Its stated target is "one to three weeks after approval of the technical plan." The same page notes that "marketplace listing and platform review take additional time." It also reports $2M+ in enterprise revenue for Warmly, an Appnigma customer, in "deals where the Salesforce integration came up during evaluation." If a middleware tool fits your case better, our comparison of native integrations and iPaaS tools covers when.
Frequently Asked Questions
How many people are in an enterprise SaaS buying group?
Gartner's 2024 buyer survey found five to 16 people across up to four functions. Forrester's 2026 figure is 13 internal stakeholders plus nine external influencers, counted differently.
Is SOC 2 required to sell SaaS to enterprise customers?
Not legally, but G2 found 80% of buyers' companies require a security or privacy assessment. Send a SOC 2 Type 2 report that covers your integration service, plus a completed CAIQ or SIG.
Does an AppExchange listing help close enterprise deals?
It helps in deals already open, because the admin gets a reviewed app to install and assess. It won't replace their vendor assessment, and it is "not a promise of inbound leads."
How long does the Salesforce security review take?
Salesforce estimates approximately 4 to 6 weeks for an initial review. Each failed round adds a 2 to 3 week resubmission test, so submit before the buyer's quarter is in sight.
Can Appnigma build the integration an enterprise deal is waiting on?
Yes. Appnigma builds and maintains Salesforce and HubSpot integrations and native marketplace apps for SaaS companies. Salesforce or HubSpot control platform review timing and approval.
About the author
Sunny Chauhan is the co-founder and CEO of Appnigma AI, which builds and maintains customer integrations and native Salesforce and HubSpot apps for B2B SaaS teams. Before Appnigma, he was on Salesforce's AppExchange team, where he worked with more than 300 SaaS partners. He has spent close to a decade on the Salesforce platform, including work at Zennify, and holds Salesforce certifications including Platform Developer II, Platform App Builder, Administrator, Data Cloud Consultant, and AI Associate.
Related Articles
- Is It Worth Listing Your SaaS on the Salesforce AppExchange?
- What a Native Salesforce App Is and When to Build One
- How Long the Salesforce Security Review Takes
- The HubSpot App Marketplace Guide
- Native Integration vs iPaaS
Sources
- Gartner, Survey Finds 74% of B2B Buyer Teams Demonstrate Unhealthy Conflict (May 2025)
- Forrester, The State of Business Buying, 2026
- G2, How Vendors Can Showcase Their Credentials (2024 Buyer Behavior Report)
- G2, 5 Factors Shaping the Modern Software Buyer (2023)
- AICPA and CIMA, SOC 2 Reporting on an Examination of Controls at a Service Organization
- ISO, Certification
- Cloud Security Alliance, Cloud Controls Matrix and CAIQ
- Shared Assessments, About the SIG
- Salesforce Developers, First-Generation Managed Packages
- Salesforce Developers, Install a Package
- Salesforce Developers, Packageable Components
- Salesforce Developers, Manage Installed Packages
- Salesforce Developers, AgentExchange Install FAQ
- Salesforce Developers, Pass the AgentExchange Security Review
- Salesforce Developers, Security Review Required Materials
- Salesforce Developers, How the Security Review Works
- Salesforce Developers, Act on Security Review Results
- Salesforce Developers, Periodic Security Re-Reviews
- Salesforce Newsroom, IDC MarketScape Application Platform Marketplaces (February 2026)
- HubSpot Developers, Authentication Overview
- HubSpot Developers, App Marketplace Listing Requirements
- HubSpot Developers, App Certification Requirements
- HubSpot Developers, Applying for App Certification
- Salesforce Blog, What Is a Mutual Action Plan?
- Salesforce Developers, API Access in Group and Professional Editions
- Salesforce Developers, Unauthorized Managed Packages
