From ten employees, IT is no longer a laptop.

At the latest when IT no longer fits in one head. That is often the case at around ten employees: roles, access rights, customer data, contracts and the first customer requirements for security can then no longer be managed on the side.

The pace. What is built for twenty people today has to carry a hundred in a year, in several countries and under new regulations. Modern technology without legacy baggage makes this possible if it is documented and built to scale from the start.

That depends on the exit horizon, the valuation logic and the type of investor, not on a fixed rule. Subscriptions and cloud services are running expense (OPEX) and preserve liquidity; with a near exit, this also avoids investments that a buyer often does not pay for. Own hardware or locally operated systems are investments (CAPEX) that can be cheaper over time and are negotiable with a long-term investor. The decision belongs to financial planning and is justified in the decision log.

Because otherwise errors, test data and experiments have a direct effect on live operations, and because customers, investors and auditors increasingly ask about it. Anyone who introduces development, test and production systems and the separation of customer tenants only afterwards rebuilds existing processes and pays considerably more for it than if the separation had been planned from the beginning.

That depends on industry and markets. Customers in the EU bring the GDPR, corporate customers bring security evidence such as ISO 27001 or TISAX, AI products bring the EU AI Act, and critical sectors bring reporting obligations. An overview is on the Regulation page.