All Guides

    Buying it for a team of 50+

    When search visibility software stops being a marketing subscription and becomes a procurement project. The five buyers in the room, the security checklist, the contract patterns to negotiate, and the 8-week timeline that actually closes.

    Matiss Katanenko

    Matiss Katanenko

    Co-founder, Honeyb

    Last updated May 16, 2026

    The buying process changes around 50 people

    At 5 people, the head of marketing picks a tool with a corporate card. At 50, the same purchase involves IT, security, legal, procurement, and finance, and any of them can stop the deal. The product evaluation that was a 20-minute demo at the small-team stage becomes an 8-week project at this one.

    None of this is the vendor's job to manage for you. It's the buyer's job, and it's the part of buying enterprise SaaS that nobody writes about because it isn't glamorous. This guide is the version of the buying process written for the marketing leader who has to actually drive it.

    The angle is procurement-aware, not procurement-friendly. The goal is to close the right contract on a tool that survives security review, scales to multi-brand, and doesn't hold your data hostage if you ever leave.

    The five buyers in the room

    Every one of them has a different question. Walking in knowing what each will ask is how the process moves in weeks instead of quarters.

    01

    Marketing (the user)

    Asks: Does this tool actually help my team report on AI visibility and act on the data?

    What gets you to yes: A 30-day paid pilot on the real product with a clear success criterion (e.g., "we can produce a monthly per-engine recommendation share report without engineering help").

    02

    IT and Security

    Asks: What's the vendor's security posture, and how does this integrate with our identity and access stack?

    What gets you to yes: SOC 2 Type 2 report under NDA, SAML SSO, role-based access, audit logs, documented incident response. Anything missing from this list will eat 2-4 weeks of back and forth.

    03

    Legal

    Asks: What's in the DPA, what happens to our data if we leave, and what's the liability exposure?

    What gets you to yes: A standard DPA the vendor will agree to without 6 weeks of redlines, a written data-export-on-termination clause, and a reasonable liability cap. Vendors who use a non-standard DPA usually need 4-8 weeks just for legal review.

    04

    Procurement

    Asks: Is this the right vendor, the right contract structure, and the right price?

    What gets you to yes: Multi-year discount option, ramp pricing if you're scaling brands, a clear cancellation path. Procurement teams are paid to find things that look standard from another angle; come prepared with two comparable quotes.

    05

    Finance

    Asks: What's the total cost over three years, including implementation and renewal escalators?

    What gets you to yes: A simple TCO model that includes the line-item price, implementation time (in marketing hours), training, and worst-case renewal pricing. The vendor's quote covers the line item; you cover everything else.

    The security and compliance checklist

    Send this to vendors before the demo. The ones who answer all of it cleanly in 48 hours are usually the ones who'll survive your security review. The ones who ask "what do you need this for?" are giving you the answer.

    SOC 2 Type 2

    Most recent report, available under NDA. Type 2 specifically (Type 1 is a snapshot). If they're in audit but don't have a report yet, ask for the auditor and a target date.

    Data residency

    Where exactly is your data stored? EU, US, or both? If you have GDPR or schrems concerns, this is a hard requirement.

    Encryption

    AES-256 at rest, TLS 1.2+ in transit. Most vendors meet this; the ones who don't won't survive your security review.

    Vendor's own data handling

    What do they do with the prompts and responses they collect on your behalf? Used for training models? Shared with the AI engine providers? Get the answer in writing.

    SSO and SCIM

    SAML 2.0 or OIDC for SSO, SCIM for user provisioning if you have 30+ seats. The right answer is "yes to both, on the plan you're buying." Not "yes, on enterprise tier."

    Role-based access control

    At minimum: admin, editor, viewer. Better: workspace-level roles so a marketing manager can see one brand without seeing another.

    Audit logs

    Who accessed what, when, with timestamps. Required for SOC 2 compliance on your side too.

    DPA and sub-processors

    Standard DPA. Published sub-processor list with notification mechanism for changes. Right of audit, even if you'll never exercise it.

    If the vendor's answer to "are you SOC 2 Type 2 compliant" is "we're working on it," budget six months of additional procurement time. That's not a vendor problem; that's a buyer problem you're about to inherit.

    Multi-brand and agency architecture

    If you're a holding company with 4 brands or an agency with 30 clients, the architecture matters more than the feature list.

    Workspaces vs accounts. One workspace per brand is the right model for most multi-brand setups. Separate prompts, separate dashboards, separate reports, shared billing. Avoid tools that force everything into one workspace with brand filters; the data segregation gets messy fast.

    RBAC granularity. A marketing manager assigned to Brand A shouldn't see Brand B's data by default. The roles need to enforce that, not the team's discretion. This is especially true for agencies handling competing clients.

    Centralised billing. One contract, one invoice, even if 12 brands run on it. Procurement and finance both lose interest fast if they have to track 12 separate invoices.

    White-label reporting. If you're an agency, this is non-negotiable. Your clients shouldn't see the vendor's logo on the report; they should see yours.

    Contract patterns worth negotiating

    The line-item price is what vendors lead with. These are the terms that actually determine whether the contract holds up at year three.

    Annual with monthly opt-out, not annual upfront. Pay annually for the discount, but with a 30-day notice clause if the vendor materially changes the product or pricing. Most vendors will agree; some won't. The ones who won't are pricing risk into the upfront commitment.

    Ramp pricing if you're scaling. If you're adding brands over the year, negotiate ramp pricing instead of paying full year-1 freight for capacity you won't use until month 9.

    Renewal price cap. Cap year-two renewal price increases at 5-7%. Vendors who refuse this are telling you they intend to raise prices significantly. Better to know now.

    Data export and deletion on termination. Written in the DPA. Full data export within 30 days of termination, written confirmation of deletion after. Without this, the data you collected for 18 months becomes the vendor's asset, not yours.

    SLA with credits. Real SLA (99.5% uptime is standard) with actual service credits for breaches. Vendors who only offer "best effort" usually have something to hide about their infrastructure.

    The real TCO

    The quote shows you the line item. The total cost of ownership over three years looks different.

    Implementation: 20-40 hours of marketing time in month 1. Defining the prompt set, configuring the workspace, training the team. Most vendors will help with this; some charge for it; few quantify it in their pricing.

    Ongoing operations: 4-8 hours per week. Running the weekly review, refreshing prompts quarterly, acting on the data. This is the cost that doesn't appear on the invoice and usually isn't planned for.

    Renewal escalators. Without a renewal price cap, year 3 can be 1.5x year 1. Run the model both ways before you sign.

    Sunk-cost migration risk. If you ever want to leave, the cost isn't the new tool; it's recreating 18 months of prompt sets, custom reports, and team workflows on the new platform. Optimise for portability now, not later.

    The realistic 8-week timeline

    Working backwards from a target signing date.

    Weeks 1-2: Marketing builds the shortlist (3 vendors max), runs demos, picks the lead candidate. Don't waste security and procurement's time on more than three.

    Weeks 3-4: Security review. SOC 2 report, vendor questionnaire, identity integration test. Run this in parallel with legal starting on the DPA.

    Weeks 5-6: Legal redlines on the DPA and MSA. Procurement starts the pricing negotiation in parallel. This is where the slowest stakeholder dictates the timeline.

    Weeks 7-8: Final contract execution, paid pilot start. The pilot runs against the production product, not a sandbox.

    Anything faster than this usually means a step got skipped (often security or DPA) and will get rediscovered painfully at renewal. Anything slower usually means one of the buyers wasn't given the right materials at the right time.

    Frequently asked questions

    Matiss Katanenko

    About the author

    Matiss Katanenko

    Co-founder, Honeyb

    My name is Matiss Katanenko and I co-founded Honeyb, the AI visibility platform that tracks how ChatGPT, Gemini, Claude, Perplexity and the other major AI engines talk about brands. I'm based in Riga, Latvia. Before Honeyb I spent years on the agency side running SEO and content programs for fast-growing brands across the US and Europe. That work is where I watched AI search start to compress the entire discovery channel into a four-brand short list, and decided to build the tool I wished agencies had. In my free time I'm in the sauna, on a padel court, or behind a drum kit.

    Connect on LinkedIn
    Honeyb

    Free, instant, no signup

    See your brand through every major AI model.

    Run a free check in 30 seconds. The picture is usually different than you'd expect.

    ChatGPTChatGPT
    ClaudeClaude
    GeminiGemini
    PerplexityPerplexity

    Full Spectrum and Enterprise plans include a monthly 30-min strategy call.