biz59Articles
Notes on what we see in AI, software and startups, with the sources we used.
SOC 2 for a five-person SaaS: what the audit costs and when a customer really needs it
Type 1 or Type 2, what Vanta, Drata and Secureframe sell for in 2026 (Vendr medians of $20,000 to $24,934 a year), auditor and pen test fees, a full year-one budget for five people ($36,500 to $46,500 in cash), what a bridge letter can and cannot do, which buyers stall without the report and the break-even deal size.
Support with two people: the response times customers expect from a small SaaS and how to meet them
Published benchmarks (62% of companies never answer an email; a one-hour first reply puts a SaaS in the top 15%), what Plausible, Transistor, Buttondown and Fathom promise, how two people cover a week without 63-hour Friday gaps, 2026 prices of shared inboxes, help desks and AI replies ($0.75 to $2.00 a resolution) with a worked example, where an AI answer angers customers, and six numbers to check every Monday.
The first salesperson at a small SaaS: when to hire, what to pay and how long until they earn it back
The signs founder-led sales has done its job (10-20 referenceable customers, a 15-25% win rate), 2026 pay and quota norms (median AE OTE $200,000, quota 4.6x OTE, 48% at quota, 6.2-month ramp), a month-by-month payback for a $12,000-a-year product (month 15 to 21 depending on attainment), the commission clauses that matter, a 90-day plan and the signs it isn't working.
Backups for a ten-person business: what Google Workspace and Microsoft 365 don't keep, and what a restore costs
Google keeps a deleted file about 55 days and a removed user 20; Microsoft keeps files 93 days, email 14 and a removed user 30. The day-by-day windows, two cases where they were not enough, 2026 backup prices for ten people ($360 to $1,057 a year), what a slow restore costs and a drill to test yours.
A developer in another country: contractor, employer of record or your own entity, with 2026 costs
The same $5,000-a-month developer costs $5,030 as a contractor and $5,740 in India, $6,623 in Poland or $8,143 in Brazil through an employer of record. Deel, Remote and Oyster 2026 prices, employer charges by country, Poland's July 2026 reclassification rules, the IP clauses that decide who owns the code, payment fees and when to switch routes.
Annual or monthly: the discount that pays for itself at a small SaaS
What Zoom, Slack, Calendly, Notion and Shopify take off for annual (16.7 to 24.8 per cent), how many customers choose it (ChartMogul's 2024 data), the retention gap, and a worked $29 plan: year-one revenue, the break-even discount, the cash that is not revenue yet, refund rules and the renewal notice.
Why they cancelled: the exit questions a small SaaS asks and what the answers change
Between a fifth and a third of a small SaaS's lost customers never chose to leave: their card failed. Stripe's and Recurly's churn splits, why renewals fail (40.6% insufficient funds), what retries and emails recover (51% to 70%), the one exit question to ask, published save rates, the California cancel-button rule, a worked 500-customer example and a one-page monthly churn review.
Download my data, delete my account: answering privacy requests on time
Someone has asked for a copy of their data, or to be deleted. GDPR gives you one month, California 45 days. What the answer must contain, where one person's data hides, what you may keep after a delete, a worked timeline, and how to run it from a footer link without building an admin panel.
Offboarding the last day: the accounts, keys and devices a ten-person company takes back when someone leaves
Five dated cases where a leaver's access stayed on, an eight-item leaver sheet, the last day hour by hour (money and admin first), what Google Workspace (20 days) and Microsoft 365 (30, 60, 93 and 365 days) do with a removed user's mail and files, and what a forgotten account costs, from $0 to a $150 OneDrive reactivation.
Section 174 is fixed: the R&D tax credit and expensing for a small US software company in 2026
What the July 2025 law changed for software development costs (deductible again from 2025, the 2022-2024 balance written off over one or two years), who qualifies for the research credit, how a startup takes up to $500,000 a year of it against payroll taxes, a six-person company worked through ($699,000 of research costs, a $73,360 credit used over five quarters), the records courts ask for, what specialists charge and nine questions for your accountant.
A cloned voice asks for a wire: the payment checks a small business adds against deepfake fraud
Real cases from the EUR 220,000 voice clone of 2019 to Arup's $25.6m video call, the 2025 loss figures (FBI: $3.05bn to business email compromise; UK CEO fraud averaging GBP 28,000 a case), and five checks that cost a 12-person company about $300 a year: call back on a known number, two approvers, a code word, the bank's name check and a one-day hold on changed details. Plus the first hour after a payment goes wrong.
Sales tax on software subscriptions: which US states tax SaaS and when a small vendor has to register
About 21 states and DC tax SaaS in October 2026, and California and Colorado join on 1 January 2027. The state-by-state table, the economic nexus thresholds after Wayfair, a $49-a-month business with 2,000 customers worked through (it owes Ohio and Maryland, not Texas or New York), what Paddle, Stripe Tax and Stripe Managed Payments cost at $1.18m a year, and the first three registrations a small vendor usually needs.
Chargebacks at a small SaaS: what a dispute costs and which ones you can win
Dispute fees at Stripe ($15 plus a $15 counter fee since June 2025), PayPal, Paddle, Lemon Squeezy and others; the dispute rates that get an account flagged (Stripe 0.75%, Paddle 0.65%, Visa VAMP 1.5%) and where 0.65% comes from; who really disputes; the reason codes and evidence that win, Compelling Evidence 3.0 included; the arithmetic of fighting, accepting or refunding a $20 charge; and a refund-first policy.
Who owns the domain: registrar accounts, DNS and how a small business loses its own website
Domains registered in a developer's or ex-employee's name, renewals that fail, registrar logins without 2FA: real cases from Marketo's $35 lapse to a nonprofit's domain held over a $1,500 invoice. ICANN's expiry rules and 30-day redemption period, what nine registrars charge to restore a .com ($45 to $200) and when GoDaddy auctions it, what a UDRP case costs, and an eight-step handover checklist.
Who can see the company's shared passwords: a password manager rollout for a ten-person business
What Bitwarden, 1Password, Proton Pass, Keeper, NordPass, LastPass and Dashlane cost for ten people in October 2026 ($239 to $1,079 a year), what the cheap tiers leave out, why 'hide password' doesn't hide it, a vault-by-role layout, 2FA codes and passkeys in shared vaults, a ten-minute offboarding routine, and the breach numbers that make the case.
The AI notetaker joined the call: consent, recording laws and what a small business switches off
A third of US workers have had an AI notetaker in a meeting and a quarter of them were never asked. The all-party consent states and their penalties ($5,000 per recording in California), why a vendor's bot is not the same as pressing record, the Otter, Fireflies and Granola lawsuits, what Otter, Fireflies, Zoom, Teams, Meet and Fathom do by default, the exact settings to change, and a six-line rule for a small firm.
Cyber insurance for a small software company: what the application asks and what a policy pays
The questions on a 2026 cyber application in the carriers' own words (MFA, offline backups, EDR, 30-day patching, payment callbacks), the case where one wrong MFA answer voided a policy, what each cover pays with three claims worked through, the exclusions that bite, median premiums for small tech firms ($179 a month for cyber, $110 for tech E&O) and how the policy has to match your customer contracts.
Bookkeeping with AI in a small business: what to hand over and what to keep
What the AI in QuickBooks, Xero and receipt apps does in 2026 and what it costs; an independent test where Xero's auto-reconcile handled 61% of bank lines; the categorisation mistakes that move profit (a loan payment booked as expense overstates costs by $11,400 a year); what the accountant still has to see; and a monthly routine that takes about an hour.
Forty subscriptions and nobody owns them: a software spend check for a small business
How a small business ends up paying for seats of people who left, AI add-ons and two tools for one job; what Google, Microsoft, Slack, Adobe and QuickBooks raised in 2025 and 2026; how to list every subscription from card and bank statements in an afternoon; a 12-person firm's list with $4,936 a year to cut; owners, and a renewal calendar with cancel-by dates.
Free trial or free plan in 2026: what converts for a small SaaS
Free trial, card up front, freemium or reverse trial: the January 2026 conversion benchmarks side by side, what each model gives from the same 10,000 visitors, what free users cost when every request calls an AI model, and how many sign-ups a small product needs before a test can tell two models apart.
Fake reviews and AI testimonials: the FTC rule a small business has to follow
Since October 2024 a US federal rule bans fake and AI-written reviews, rewards for five stars, undisclosed staff reviews and hiding bad ones, at up to $53,088 per violation. What each part means for a small business, what Google and Trustpilot remove on their own, where the platforms are stricter than the FTC, and how to ask for honest reviews instead.
25 AI app builders compared, from idea to App Store: what each does, what it costs, and when to hire help
Rork, Replit, Lovable, FlutterFlow, Adalo and 20 more, compared on plans, free tiers, what they really build, what users say and which apps actually shipped. Then the twelve stages from idea to store submission, which ones a builder covers, what you can do alone as a vibe coder, and the five points where an hour of a freelancer beats another week of prompts.
An AI receptionist for a small business: what phone agents cost and where callers hang up
Voice agents that answer the phone for salons, clinics and trades cost from about $50 to a few hundred dollars a month. What Rosie, Goodcall, Smith.ai and a build-your-own agent charge for 400 calls, what they do well (hours, prices, bookings, messages) and badly (accents, angry callers, emergencies), the recording and disclosure rules, and a two-week trial an owner can run on missed calls first.
Revenue-based financing or a seed round: money for a small profitable SaaS
What revenue-based lenders such as Lighter Capital, Capchase, Founderpath and Stripe Capital offer in 2026, how to turn a 1.4x cap or a 10% fee into a real annual rate (17% to 34% in our example, depending on growth), the terms that matter more than the fee, when a seed round still makes sense, and what neither kind of money wants to see.
One page on AI at work: the policy a ten-person company actually needs
Most of your staff already use AI at work, many on personal accounts. The six decisions a small company makes (which accounts, what never goes in, a person checks what leaves, code, what customers are told, new tools and mistakes), a one-page policy to copy, and how to roll it out in a thirty-minute meeting and review it twice a year.
After the outage: what a small SaaS publishes, and when
Customers forgive an outage more easily than silence. The order of things a small SaaS publishes during and after one: the first status update within half an hour, updates on a timer, the customer email, the one-page write-up a week later and credits applied without a claim; with wording to copy and what Atlassian, Cloudflare and GitLab did in public.
Your AI feature reads customer email: prompt injection tests a small vendor runs before shipping
When an AI feature reads email, documents or web pages, strangers write part of its prompt. What indirect prompt injection is in plain words, what happened with Microsoft 365 Copilot and Slack AI, ten tests to run in an afternoon with a canary, and what to limit when they fail: rendered links, silent actions, tools on the reading step and data scope.
The wrapper question: what seed investors ask an AI startup about defensibility in 2026
"Isn't this just a wrapper?" is asked in nearly every AI seed meeting. Where the question came from (a16z, Jasper, Sequoia), why Cursor changed how it is asked, the four answers that land (workflow, switching cost, distribution, a real data loop), the ones that lose the room, and the numbers a founder with a few dozen customers can show.
Selling a small SaaS in 2026: what buyers pay and what they check
Small SaaS businesses sell for about 3 to 5 times yearly profit on the marketplaces, more through brokers when the books are clean. Where to sell, how profit becomes a price, what moves the multiple (including AI), what due diligence asks for, and a list of what to fix a year before.
When the AI feature eats the margin: gross margin for a SaaS that calls a model
Every use of an AI feature costs the vendor money, and a tenth of the customers can take most of the margin. A worked example for a small SaaS at $30 a month, what prompt caching, a cheaper model, caps and usage pricing do to it, and how investors read AI gross margin in 2026.
What five developers spend on AI coding tools in a month, and how a small team caps it
Copilot, Cursor and Claude now charge a seat plus usage, and one developer running agents can be most of the bill. Current list prices, a month for an illustrative team of five, the caps each vendor offers and what happens when you hit them, and how to tell the founder what the spend bought.
Raising prices on customers you already have: how a small SaaS decides, writes the email and keeps them
What Slack, Atlassian and Unity did when they raised prices, and what a small software company can copy: who pays the new price and from when, how many customers you can afford to lose, the notice the law and your terms require, who to call first, an email that says it plainly, and how to measure it a quarter later.
Fifty examples and a spreadsheet: how a small company picks an AI model for one job
Leaderboards do not say whether a model is good enough for your invoices or your support mail. How to collect fifty real cases, have the person who does the work mark the answers blind, compare a cheap and an expensive model on quality and on the cost of each case including the mistakes, and when to run the test again.
Leaving the AI app builder: what it takes to move an app off Lovable, Bolt or Replit
The code comes out of an AI app builder in a few clicks. The database, the user accounts, the files and the hosting take longer. What each of Lovable, Bolt and Replit lets you take with you, what breaks on the way out, how many days a small app needs, and how to keep the exit open from the first week.
The model you built on is being switched off: what a deprecation notice costs a small product
Hosted AI models are retired on as little as two months' notice. What the main providers promise, what breaks besides the obvious when the replacement answers differently, how fifty saved examples turn a migration into a checklist, what to promise your own customers, and how to budget for one or two switches a year.
The first enterprise contract: six clauses a small software vendor should read twice
After the security questionnaire comes the buyer's paper: forty pages, a data processing agreement and a new AI addendum. The six clauses that carry real money for a five-person vendor, what is normal to ask for in each, what to let go, and when an hour of a lawyer's time is worth it.
Set up your small business online in an afternoon
Five small jobs that never get a free afternoon: a work email address, a Gmail you can use again, QR codes you only print once, a privacy policy at a link, and the week's shifts on everyone's phone. Our list, in the order we'd do it, with screenshots of the real tools.
Give your AI agent a notebook and a whiteboard: MCP with two small tools
An agent's work usually ends up forty messages deep in a chat. With one MCP server it can keep a run log in a note you can search and share, and hand you a fishbone or a mind map it wrote as a plain list. The calls, three habits that made it useful, and four cautions about giving software write access.
One markdown note, three ways out: a PDF, a link and a plain file
A proposal usually gets written three times: once as notes, once in a document for the client, once pasted into an email. md.biz59.net is a markdown editor that treats the note as the only copy and lets it leave as a typeset PDF, a read-only link or the plain file. What it does, with screenshots, and what it deliberately doesn't.
Type the outline, get the diagram: a whiteboard for people who can't draw
Most diagrams in a small company start as a list somebody typed in a chat. draw.biz59.net takes that list as it is, indented with two spaces, and lays out the mind map, fishbone, swimlane or architecture drawing for you. Here is how it works, with screenshots of the real board, and where it stops.
Who reads the AI's code? What a code review looks like when most of the change was generated
Teams using AI merge twice as many changes, each more than twice the size, and review time has nearly doubled. What reviewers miss in a long, tidy, generated diff, the four areas that always get a second person, why the tests are the contract, and eight things a founder with no developer can ask a contractor to show.
The security questionnaire arrives: what a five-person software vendor can honestly answer
Your first large customer sends a spreadsheet with two hundred rows: SOC 2, penetration tests, sub-processors, and now a section on AI. Which answers a tiny team can give truthfully, how to write a no that keeps the deal alive, what to fix in the first week, and what SOC 2 really costs.
Per seat, per use or per result: how AI is changing what software vendors charge for
Vendors now bill for a credit, an action or a resolution, and the definition decides the invoice more than the price does. What Intercom, Zendesk, Salesforce, HubSpot and Cursor actually wrote, eight questions for a buyer, and how a small vendor picks a unit without giving away its margin.
Open-weight models in a small company: when running your own beats the API bill
Four places a language model can run, priced from the providers' own pages in October 2026, and the break-even for a firm of five to fifty people. On cost alone, your own GPU wins much later than most expect. Where it wins sooner: data that can't leave, a steady queue, hardware you already own.
Case study #2: we ran our own app through AppBro, and it found 12 problems before a customer could
AppBro sets up the pages an app needs for store review. Before asking anyone else to trust it, we used it for iPaid iOwe, an app of ours that is already in the stores. Here's what worked in under a minute, the 12 things that broke, and what we still haven't tested.
Privacy policy and sync for your app without a backend
The app is finished and the store form still wants a privacy policy URL, a support URL and a delete-account page, and your users want their data on a second phone. What the stores really ask for, three ways to cover it, an honest table, and how far our two small tools, AppBro and DBSync, take you before you need a real backend.
The missing junior developer: what entry-level hiring data shows in 2026
Young workers in AI-exposed jobs are 19% behind their peers, and new-graduate hiring is down about 65% at big technology firms and 76% at startups since 2019. What the payroll and job-advert data shows, how much of it is AI, and why a small company should read it as an opening.
Agents with wallets: what MCP and agent payments mean for a small SaaS vendor
AI assistants can now find a product, sign in for a user, call it and pay. What has actually shipped from Stripe, Visa and the MCP specification, what a small vendor should expose, how to price for a customer that is a program, and what to lock down first.
How to brief a contract developer in the AI era: a one-page spec that gets you a working build
A developer working with AI agents can build what you described in days, including the parts you described badly. Here is a one-page brief a non-technical founder can fill in, with a worked example, and what changes when the person you hire builds with AI.
The EU AI Act since August 2026: what a small software vendor actually has to do
The big high-risk deadline moved to December 2027 three weeks before it was due. What did start on 2 August 2026 is smaller and reaches far more products: telling people when they are talking to AI and marking what it generates. A plain guide for vendors outside the EU.