There's a practice in enterprise SaaS that doesn't get called out nearly enough. A vendor builds security features, single sign-on, multi-factor authentication, one-time passwords, passkeys, and then gates them behind a premium or enterprise pricing tier, leaving customers on standard plans without access to tools that should be basic requirements for operating safely.
It's a business model and we understand why it happens. But we think it's wrong, and it's not how SimplyDo operates.
The SSO Tax
The software community has a wry name for this type of thing. For example, the site sso.tax maintains a public list (self-described as a "Wall of Shame") of vendors that treat single sign-on as a luxury feature rather than a core security requirement. The examples on it are striking. Some vendors charge 50% more for SSO access. Others charge 500% more. A few are simply beyond parody.
The argument made by the site's maintainers is straightforward: SSO is a core security requirement for any company with more than five employees. Some vendors exploit this by offering competitive starter plans and gating SSO behind an "Enterprise" paywall bundled with unnecessary features or large minimum seat counts, inflating cost by 3x, 5x, 10x or more, and forcing smaller companies to choose between a secure environment and an affordable budget.
That framing resonates with us. And while SSO is the most prominent example, the same logic applies to MFA, passkeys, OTPs, and the broader set of controls that determine how securely users authenticate and how much visibility administrators have over access to their systems.
Who Gets Hurt
The organisations most affected by paywalled security features are rarely the large enterprises who can absorb the cost of an upgraded plan. They're smaller organisations, charities, SMEs, local authorities, early-stage companies, who are often subject to exactly the same compliance obligations as their larger counterparts, but with significantly less budget to meet them.
Take Cyber Essentials, the UK government-backed certification that is increasingly a baseline requirement for public sector supply chains. One of its five core controls is multi-factor authentication. An organisation pursuing Cyber Essentials certification needs MFA, but if their SaaS provider has locked it behind an enterprise tier they can't afford, they face a genuine choice between compliance and cost. That's a choice they shouldn't have to make, and one that exists entirely because a vendor decided to treat a security feature as a revenue opportunity.
The Risk to the Vendor
There's a self-interested argument here too, and it's worth making plainly.
If a vendor locks away an MFA feature and one of its customers suffers a credential-based breach, the kind of breach that MFA would have prevented, what's the story? "Our platform was at the centre of a security incident because we charged extra for two-factor authentication" is not a good news cycle for anyone. The reputational exposure of paywalled security features isn't just a customer problem. It's a vendor problem too, and one that seems to get underweighted when these pricing decisions are made.
There's also a simpler point: the security features you've already built don't cost more to provide to customers on lower-tier plans. The marginal cost of extending MFA or SSO to all users is negligible. What's being sold isn't infrastructure, it's access to a safety mechanism that should be available to everyone.
SimplyDo's Approach
We don't operate this way. All security features in SimplyDo are available across all plans, at no additional cost.
This includes the full range of authentication and access controls: SSO, multi-factor authentication, one-time passwords, and so on. Administrators of any SimplyDo tenant can configure their own security policies, setting MFA requirements, managing user access, controlling authentication flows without needing to upgrade to a higher tier to unlock the capability.
It also includes the infrastructure-level security that sits beneath everything else: encryption at rest and in transit, encrypted backups, secure cloud components, firewalled networks, and robust security headers for web clients. These aren't premium add-ons. They're how we build and operate the platform, for everyone.
We think this is simply the right way to do it. Organisations using SimplyDo, whether they're a large NHS trust, a combined authority, a small charity, or an SME applying to an innovation programme, deserve the same baseline of security, and should be able to demonstrate compliance with security frameworks without having to negotiate a pricing tier first.
Security shouldn't be a product feature. It should be a foundation.
.jpg)
