Industry
Engineering and security for technology and SaaS companies
A technology company’s product is also its attack surface and its customers’ supply chain. Onion Infosec builds product features, runs cloud platforms and secures both for SaaS companies, platforms and startups.
- Sector
- Technology & SaaS
- Segments
- SaaS, Platforms, Startups and scale-ups, Digital products
01Context
Technology companies are both targets and routes to others.
Their intellectual property is valuable, and their products are supply chain paths into every customer. A SaaS company holds the data of all its customers at once, which makes tenant isolation, access control and evidence of security into product features that decide enterprise deals.
For startups and scale-ups, security is a growth constraint before it is a threat problem. The first enterprise customer asks for a SOC 2 report, a completed questionnaire and a penetration test. Foundations laid early cost less than retrofits, and small engineering teams have no time for controls that exist only for show.
02Technology
What the sector builds and runs.
- Product engineering
- Web and mobile applications, APIs and multi-tenant architecture, from a first release to the rework needed when a product outgrows its original design.
- Cloud platforms and delivery pipelines
- Infrastructure as code with Terraform, Kubernetes platforms, CI/CD, observability and cost control on AWS, Azure and Google Cloud.
- AI features inside products
- Retrieval, agents and model integration with evaluation harnesses, tenant-aware data access and testing for prompt injection before release.
- Operations for lean teams
- Identity, device management, IT support and 24×7 monitoring, so that engineers are not also the help desk and the on-call security team.
03Risk
The risks that matter most.
- Tenant isolation failures
- Authorization flaws that expose one customer’s data to another, usually in object-level access checks that automated scanners do not find.
- Build system compromise
- CI/CD infrastructure holds production credentials and signs what customers install. One altered build reaches every customer.
- Admin plane and developer account compromise
- Internal tooling with access across all tenants, and the phishing, malicious packages and token theft aimed at the engineers who use it.
- Cloud and secrets exposure
- Fast-built infrastructure with leaked keys, public storage, over-privileged roles and control planes that nobody monitors.
04Regulation and assurance
What you may need to demonstrate.
Obligations are mostly customer-driven. SOC 2 and ISO 27001 act as procurement gates, often with CSA STAR or ISO 27701 for cloud and privacy. GDPR and CCPA apply by customer geography. PCI DSS and HIPAA apply when the product handles card or health data. Regional privacy law, such as the DPDP Act in India, follows the same pattern. Enterprise contracts add testing, notification and audit clauses.
Which of these apply depends on where you operate and what you do. We scope against your actual obligations.
05Where we usually start
Services that matter most here.
DevSecOps
Pipeline security, secrets management, dependency control and signed builds, fitted to the release process the team already uses.
Application security
Authorization and tenant isolation review, API testing and threat modeling for the features that carry customer data.
Cloud engineering
Landing zones, Kubernetes platforms and infrastructure as code built with least privilege and logging from the first commit.
AI security
Testing and design review for LLM features: prompt injection, data leakage between tenants and agent permissions.
SOC 2 readiness
SOC 2 and ISO 27001 readiness scoped to what enterprise buyers actually ask for, with controls the engineering team can keep running.
Penetration testing and VAPT
Penetration tests that customers and auditors accept, with findings written so developers can reproduce and fix them.