Regulated buyers need SOC 2, HIPAA, or FedRAMP depending on sector.

Data residency commitments are increasingly standard.

Document your subprocessors.