60+ item checklist · technical, security, billing, legal
Ship your SaaS without a launch-day surprise.
A pre-launch checklist covering the four things that quietly sink a go-live: technical readiness, security hardening, billing correctness, and the legal basics. Run it two weeks out, fix the blockers, and launch with confidence instead of crossed fingers.
Why a launch checklist matters
Most failed SaaS launches are not failures of product. They are failures of readiness. The feature set was fine, but the first customer hit a billing edge case that double-charged their card, or a competitor probed an endpoint that leaked another tenant's data, or the team discovered on launch night that nobody had ever tested restoring a backup. None of those problems are hard to prevent. They are just easy to forget when you are racing to ship.
This is the checklist we run before we put any SaaS platform we build in front of paying customers. It is organized into four areas because a launch that nails the code but mishandles a refund is still a bad launch. If you are not sure what "SaaS" formally covers, the SaaS glossary entry is a one-minute primer.
1. Technical readiness
- Production environment is fully separated from staging and development, with no shared databases, credentials, or third-party API keys.
- Automated database backups run on a schedule, and you have restored at least one backup into a scratch environment to prove the backup is usable.
- Health-check and uptime monitoring is live, with alerts routed to a channel a human actually watches (not an unwatched inbox).
- Error tracking is wired up so unhandled exceptions surface with stack traces, request context, and the affected user.
- Structured logging is in place, and logs never contain plaintext passwords, full card numbers, or session tokens.
- A rollback path exists. You can revert a bad deploy in minutes, and database migrations are reversible or forward-only by design.
- Performance baseline is captured: page load, key API latency, and database query times under realistic load, not an empty database.
- Rate limiting and basic abuse protection guard your authentication, signup, and password-reset endpoints.
2. Security hardening
- Authentication uses a vetted library or provider, passwords are hashed with a modern algorithm, and sessions expire and rotate correctly.
- All traffic is HTTPS-only, HSTS is enabled, and security headers (content security policy, frame options, no-sniff) are set.
- Authorization is enforced server-side on every endpoint. A user cannot read or modify another tenant's data by changing an ID in the URL.
- Secrets live in a secrets manager or environment variables, never in source control, and have been rotated since the last contractor left.
- Input is validated and output is encoded to close off injection and cross-site scripting, mapped against the OWASP Top 10.
- Dependencies are scanned for known vulnerabilities, and you have a plan for patching critical issues quickly after launch.
- A pre-launch penetration test or at least a thorough internal security review has been completed for anything handling sensitive data.
3. Billing and subscriptions
- Payment processing is handled by a PCI-compliant provider, and raw card data never touches your servers.
- Subscription lifecycle is correct end to end: trials, upgrades, downgrades, proration, cancellations, and reactivations all behave as intended.
- Failed-payment handling (dunning) retries, notifies the customer, and downgrades or suspends access on a defined schedule.
- Webhooks from your payment provider are signature-verified and idempotent, so a duplicate event never double-charges or double-provisions.
- Taxes, invoices, and receipts are generated correctly for the regions you sell into, and the numbers reconcile with the provider dashboard.
- Pricing, plan limits, and entitlements are enforced in code, not just displayed on the marketing page.
- Refund and chargeback handling is defined and tested, including what access a customer keeps or loses after a refund.
4. Legal and compliance
- A privacy policy and terms of service are published, current, and actually describe what your product does with data.
- If you collect personal data from regulated regions, your consent, data-access, and deletion flows meet the applicable requirements.
- A data-processing approach is documented: what you store, where, for how long, and which sub-processors touch it.
- Customer-facing security and compliance questions have a home — a trust page or a short security overview you can send on request.
- Service-level commitments and support expectations are written down before a customer asks you to honor them.
- Cookie and tracking disclosures match the analytics and marketing tools you actually run in production.
How to use it
Run the checklist two weeks before your target launch date, not the night before. Mark each item green, yellow, or red. Green is done and verified. Yellow is in progress with a clear owner and date. Red is a gap with no plan. Your only goal for launch day is zero reds in the technical, security, and billing sections.
Treat the four sections as gates, not a wish list. Authentication, working backups you have actually restored, correct payment handling, and a published privacy policy are blockers. Items like single sign-on, full SOC 2 readiness, and a polished incident-response runbook are fast-follows you can schedule for the weeks after launch. If the security section feels thin, pair this with our web app pentest checklist, and if billing is the risky part, the Stripe integration checklist goes deeper on payment correctness.
How this connects to our work
Every QUANT LAB go-live runs through a version of this checklist, with the security and billing sections expanded to match the product. When teams come to us late — a launch is days out and nobody is sure it is safe — we use the checklist to triage in hours instead of weeks. The same review feeds directly into our SaaS platform development and custom business software engagements, and the billing column is informed by every Stripe integration we have shipped.
If the security gates are where you feel least confident, a pre-launch penetration test turns the checklist's yellow items into a prioritized findings report. For a deeper look at how we scope an engagement, see our pricing overview or read the primer on what a penetration test actually covers.
Frequently asked questions
Who is the SaaS launch checklist for?
Founders, technical co-founders, and engineering leads shipping a SaaS product to its first paying customers. It is also useful for teams relaunching after an MVP, or for a fractional CTO running a go-live review on someone else's codebase.
Do I need to complete every item before launching?
No. The checklist separates launch-blockers from fast-follows. Authentication, backups, payment correctness, and a privacy policy are blockers. Items like SSO, SOC 2 readiness, and a full incident-response runbook can ship in the weeks after launch as long as you have a plan for them.
How long does a pre-launch review take?
Plan for a focused half-day for a small product and one to two days for anything with billing, multi-tenancy, or compliance obligations. The point is to surface gaps two weeks before launch, not the night before, so you have time to fix the blockers.
Does this cover security and billing, or just the technical basics?
All four areas. The checklist is organized into technical readiness, security hardening, billing and subscription correctness, and legal and compliance, because a launch that is technically perfect but mishandles a refund or a privacy disclosure is still a failed launch.
Related resources & reading
MVP to Production Playbook
What "production-grade" means once the prototype works.
Web App Pentest Checklist
The OWASP-aligned deep dive for the security section.
Stripe Integration Checklist
Payment, subscription, and webhook correctness in detail.
SaaS Platform Development
How we build and launch SaaS products end to end.
Want a second set of eyes before you launch?
If the security or billing sections are where you feel least sure, we can run a focused pre-launch review and hand you a prioritized punch list. See how engagements are priced or just book a call.