You signed the contract. The kickoff call went well, everyone agreed on the first use case, and then three weeks went by and nothing happened. The Pendo security review landed on the desk of someone who had never heard of Pendo and had no reason to hurry.
I know the objection, because I hear it on almost every kickoff. Security is not your job. You are a product person, or a CS leader, and the review is something IT does to you while you sit and wait. That is the part I want to argue with. The teams that clear this in two weeks do not have friendlier security departments than you do. They just showed up with the answers already written down.
A security review works a lot like a building permit. The inspector is not judging your taste in kitchens. They want to know what you are running through the walls and how to shut it off. Bring them a drawing and they stamp it. Bring them a shrug and they put you in the pile.
Security teams do not block tools. They block unanswered questions.
I have been on the wrong side of this one. We once let an install sit for over a month because I assumed the client’s security team would come to us when they had questions. They never did. They put the request at the bottom of a queue, and we burned most of a quarter on what was technically a thirty minute snippet install. That was my fault, not theirs.
Here is the sequence that works.
Ask yourself right now, on paper, who the approvers are. Not the team. The people.
It is almost never just IT. In most of the companies we work with the list includes an application security reviewer, someone from privacy or legal, the engineering lead who owns the front end where the snippet goes, and sometimes procurement with a vendor questionnaire nobody mentioned. In regulated industries, add whoever signs data processing agreements. That signature can take longer than the technical review.
The pattern we see over and over is that compliance shows up late. Concerns get raised after the contract is signed, after the kickoff, after the plan has dates on it. Every one of those approvers was always going to be involved. They just got discovered one at a time, and each discovery cost a week.
Pull up your implementation plan and see if you could answer these today, in writing, without going back to your vendor rep.
What data gets collected, and can we control it? Where does that data go and who else touches it? What actually executes inside our application? How do we turn it off if we need to?
That last pair is where most reviews stall. Pendo runs JavaScript in your app, and if your product has a Content Security Policy, someone in engineering has to review any custom code and explicitly allow the domains it calls. That is a real code review with a real queue, not a checkbox. Consent handling is the other common snag, especially if your privacy banner blocks third party scripts by default. Find out how your app treats an opt out before security tells you.
Put the answers on one page and attach the vendor’s security documentation behind it. One page a busy reviewer can read in four minutes moves faster than a perfect forty page packet.
This is the step almost everyone skips, and it is the one that saves the quarter.
Waiting on production approval is not the same as waiting on everything. Ask engineering to put the snippet in a lower environment, a staging or prototype instance, where the data is fake and the risk conversation is much shorter. Security teams say yes to that far more easily. Once it is live you can tag pages and features, agree on naming, build and preview your first guide, and set up your account structure. When production approval lands, you deploy work that is already finished instead of starting from zero.
We now ask for the lower environment install in week one of every project, before anyone has a reason to say no. It has turned a lot of stalled engagements back into moving ones.
Look at what your developers plan to pass as the visitor ID. If the answer is an email address, you have a problem in two directions at once.
Privacy reviewers will flag personal data going to an analytics vendor, and they will be right to. Emails also change, people get married, accounts get merged, and your history quietly rots. Use a stable, globally unique internal identifier instead. It clears the privacy objection and protects your data at the same time, which is a rare thing to get for free. It is also a big part of why Pendo installs fail long after the security review is a memory, and we walk through the identifier decisions in our notes on setting up your Pendo admin account.
Ask whether the work you just did lives anywhere other than your sent folder.
You will be asked these questions again. New application, new acquisition, annual vendor re-review, a renewal where a new security lead wants to start fresh. Teams that keep a living document with the data flow, the CSP entries, and the name of whoever approved it last time get through the second review in days. Teams that rebuild it from memory spend another month. That document belongs with the rest of your Pendo governance basics, next to your naming rules and your tagging owners.
Write down the names. Not the departments, the actual humans who have to approve your install, and what each one needs from you. Fifteen minutes of work, and it is usually the difference between launching next month and launching next quarter. If your snippet is already live, start with your first thirty days in Pendo instead.
It ranges from a few days to most of a quarter, and the variable is almost never the vendor. It is how many approvers you found late and how many of their questions you had to go research after they asked. Teams that arrive with a written data flow, a CSP plan, and a named owner tend to clear it quickly.
Four things. What data is collected and whether you can control it, where that data goes, what code executes inside your application, and how you shut it off. The code question is usually the slow one, because JavaScript running in your product has to pass your engineering team’s review and be allowed in your Content Security Policy.
In most cases yes, and you should ask for it in week one. A lower environment carries fake data and a much shorter risk conversation, so it is an easier approval. Once it is live you can tag, agree on naming, and build your first guide, so production approval becomes a deployment rather than a starting line.
No. Privacy reviewers will flag personal data going to an analytics vendor, and emails change over time, which quietly corrupts your historical data. A stable, globally unique internal identifier solves the privacy objection and the data quality problem in the same decision.
If your Pendo rollout is stuck somewhere between a signed contract and a working install, I am happy to look at it with you. We run a free 30-minute Pendo strategy session, no deck and no pitch, just a look at where you are stuck and what the next move is. You can book a time here.
You must be logged in to post a comment.