Free resource
SaaS Launch
Checklist.
Twenty-odd checks across scope, auth, payments, infrastructure, and SEO — the things that are cheap to fix before launch and expensive after it.
Scope & product
- The core workflow is written down as a brief, not just discussed
- Out-of-scope items are listed explicitly, not left implied
- Every user role has a defined set of permissions
- There is one person who can approve changes to scope
Auth & data
- Passwords are hashed, never stored or logged in plain text
- Sessions expire and can be revoked
- Every input is validated on the server, not just the client
- Backups exist and a restore has actually been tested
Payments
- Webhook signatures are verified, not just trusted on receipt
- Failed and pending payment states are handled, not just the happy path
- Refund and cancellation flows exist before launch, not after the first request
Infrastructure & deployment
- Staging and production are separate environments with separate data
- Deploys are automated, not a manual file copy
- Environment secrets are not committed to the repository
- There is a monitoring or alerting signal for when the app goes down
Performance & SEO
- Largest Contentful Paint is under 2.5s on a real mobile connection
- Images are served in a modern format at the size they're displayed
- Every page has a unique title, description, and canonical URL
- A sitemap and robots.txt exist and point at the right domain
Legal & support
- A privacy policy and terms of service exist and are linked in the footer
- There is a visible way for users to contact support
- Someone is responsible for the first 30 days after launch, not just the build
Want a second pair of eyes?