You have done the hard part. The champion loves the product, the economics work, and the deal is as good as signed. Then procurement forwards a security questionnaire, or a one-line email asks for your SOC 2 report, and everything goes quiet for a month. The offshore security review stalls more good deals than price does, and it is the part a New Zealand founder is least ready for.
Why offshore buyers scrutinise a small vendor harder
A buyer at home who knows your name extends some trust on reputation. An offshore buyer has none of that to go on. You are a small company, in a country half their procurement team could not place on a map, asking to hold their data. The security review is how they turn that unknown into something they can sign off.
The bigger the buyer, the more of the review is run by people who have never met you and are paid to find reasons to say no. It is not personal and it is not about your product. It is about whether buying from you could get someone fired.
What they actually ask
Three things come up again and again. First, a recognised security certification, almost always SOC 2 or ISO 27001. Second, where their data physically lives and who can reach it - the data residency question. Third, a security questionnaire, which runs from a dozen questions to a few hundred, covering access control, encryption, backups, incident response and the sub-processors you rely on. The questionnaire is free for them to send and expensive for you to answer, and a slow or vague reply reads as a red flag whether or not it is one.
SOC 2 or ISO 27001, and what it costs
These are the two certifications offshore buyers recognise. SOC 2, run under the American auditing body the AICPA, is the default for United States buyers. ISO 27001 is the international standard and travels better in Europe and Asia - the ISO Survey counted about 96,700 valid ISO 27001 certificates worldwide at the end of 2024. You rarely need both to start. Match the certification to where your first offshore buyers actually are.
Neither is cheap or fast. For SOC 2, Vanta puts the audit fee alone at between US$10,000 and US$50,000, and a startup's realistic first-year all-in at US$20,000 to US$80,000 or more once tooling and remediation are counted. On timing, Vanta puts a SOC 2 Type I at three to five months from a standing start, and a first Type II report at four to six months, because it needs an observation window of at least three months. That last number is the one that kills deals. If a buyer wants a Type II and you start the day they ask, you are half a year away from handing it over.
The data residency question New Zealand vendors get wrong
Founders hear "data residency" and assume they need a server in the buyer's country. Usually they do not. What a European buyer needs is a lawful basis to send personal data to you, and New Zealand quietly hands you one. The European Commission granted New Zealand a data-protection adequacy decision back in 2012, a status our own Office of the Privacy Commissioner confirms still stands. We are on the short list of countries the EU treats as safe to send personal data to without extra paperwork. That is a real advantage most New Zealand founders never mention. Know it, and say it, before the buyer's lawyer raises the question.
When the spend is actually worth it
Do not certify on spec. Twenty to eighty thousand dollars and six months is a serious bet to place before a single offshore buyer has asked for anything. The trigger is a real, qualified deal, or a clear run of them, where the review is the only thing between you and the signature.
Start then, and start straight. Tell the buyer you are mid-certification, show them your questionnaire answers and your security policies now, and ask whether a Type I report or a signed roadmap will hold the deal while the Type II window runs. A buyer who wants you will often wait if you are honest with them. What loses the deal is going silent and hoping the question goes away.
So where does your next offshore deal stand?
Look at the biggest offshore deal in your pipeline and ask the uncomfortable question. If their security team sent you a questionnaire tomorrow, could you answer it this week - or would the deal go quiet while you worked out what SOC 2 even is?
Is a security review about to stall your offshore deal?
In about 6 minutes, the free Growth Scorecard shows where your sales are leaking and what to fix first. Finish it and the International Readiness Scorecard opens straight after.
Get your free scorecardSources. SOC 2 audit fees of US$10,000 to US$50,000, a startup first-year all-in of US$20,000 to US$80,000 or more, a Type I timeline of three to five months and a first Type II report in four to six months with a minimum three-month observation window: Vanta, "How much does a SOC 2 audit cost?" and "SOC 2 for startups". About 96,700 valid ISO/IEC 27001 certificates worldwide at 31 December 2024: the ISO Survey 2024. New Zealand's European Union data-protection adequacy decision, granted in 2012 and still in force: the European Commission, confirmed by the Office of the Privacy Commissioner of New Zealand. What offshore buyers ask a small vendor, and the guidance on when to certify, draw on my own experience helping New Zealand tech firms sell offshore, not a single study.