B2B SaaS sales in Germany: procurement, legal review and the stakeholder layers explained

German organisations buy in a different order, and the order is the whole article

An Irish team lead who likes a tool puts it on the company card, uses it for a month, and only then does anyone in procurement hear about it. The tool proves itself first and gets approved second, and most Irish SaaS funnels are built in that shape.

In my experience selling into German organisations, the order flips. The people whose job it is to say no come first: purchasing, the data protection officer, IT security, and often the works council. The user who wanted the tool comes last, and by the time they log in, the contract has been signed for a year. Nothing about this is slow by accident. The caution has roots: a strong data protection culture, managing directors who take their personal responsibility seriously, and a legal right of employees to have a say in the software they are measured by. The process will not skip a step because your landing page asked nicely.

I have also noticed, as an observation from my own deals rather than a law of nature, that a "book a demo" button on a German page gets fewer clicks than the same button in English, and the people who do click arrive with their lawyer's questions. A demo answers "does this look nice". The German buyer's first question is "are we allowed to use this at all". Answer that first and the demo takes care of itself.

Worked example: a Cork SaaS meets a Hamburg logistics buyer

Throughout this article I will use an invented company, Ledgerline, a SaaS business in Cork run by a founder called Aoife. Ledgerline reconciles freight invoices against shipments and flags the ones that do not match, so a dispatch team stops paying for pallets that never moved. It costs €1,200 a month. Nobody real, and every number is made up so that every step can be shown.

In the first half of the year 120 German visitors started Ledgerline's free trial. Two became customers. In Ireland the same 120 trials would have produced about 20. Her buyer in this story is also invented: Elbkai Logistik, a freight forwarder in Hamburg with 280 staff, a works council, a data protection officer and a purchasing department with a form for everything.

The six stages a German buyer walks through, top to bottom

This is the sequence I have seen in nearly every German deal, from a company of 40 people to one of 4,000. There is no survey behind it, so take it as one engineer's field notes. The names of the stages vary. The order hardly ever does.

The diagram reads top to bottom. The security questionnaire and the data processing agreement are where most Irish funnels die, because nobody prepared the paper. The decision in the middle is the works council question, and in practice it runs alongside the pilot. The rest of the article takes each stage in turn, with the law where there is law and my experience where there is not.

Stage one: discovery is a fit check, and your champion needs paper to carry

In Ireland a discovery call sells. In Germany it qualifies. The person on the call is almost never the person who signs, and they know it. They are collecting what they need to open an internal process, and if they leave with a good feeling and nothing to forward, the deal stalls there, politely, for months.

So the goal of discovery is to hand the champion a packet they can forward without embarrassment: one page in German on what the product does, a price for 12 months rather than a monthly figure purchasing will multiply with a frown, and a list of the documents you can provide on request, by name. A tool that arrives with its paperwork already named looks like a supplier. A tool that arrives with a "start free trial" button looks like a risk.

Worked example: what Aoife sends after the first call

Jonas, head of dispatch at Elbkai, books a 30 minute call. Aoife spends ten minutes on the product and 20 on how Elbkai buys, and learns that Jonas has to open a request with purchasing, that the data protection officer sees every new tool that touches personal data, and that the works council has a say in anything that records who did what. The same afternoon she sends one email with four attachments: a two page German product summary, a one page annual price (€14,400 a year, in the buyer's own currency with no conversion to argue over), the list of documents available on request, and a one paragraph description of a paid pilot. Jonas forwards it to three people within the hour. That is the entire job of discovery, and fair play to anyone who stops there.

Stage two: the security questionnaire, and why a certificate saves weeks

Somewhere between the first call and the contract, a spreadsheet arrives, with anything from 40 to 300 questions about encryption, backups, access control and incident response. In Germany it is often built around a catalogue published by the Federal Office for Information Security, the BSI, called C5, the Cloud Computing Compliance Criteria Catalogue. The BSI describes it as minimum requirements for secure cloud computing, aimed at providers, auditors and customers, and revised for 2026.¹ If you have an ISO 27001 certificate or a C5 report, most of the spreadsheet answers itself. If you have neither, answer it once, properly, in a document you can hand over, and keep it current. The second buyer gets it in a day, and notices.

Worked example: Ledgerline's security pack

Elbkai's IT security lead sends a spreadsheet with 140 rows. Aoife's engineer spends four working days on the first version, and the answers become a 14 page security overview: hosting in a Frankfurt data centre run by a European provider, encryption at rest and in transit, daily backups kept for 30 days, two factor login for every employee, a named person for incidents, and an honest "no" against the row that asks for an ISO 27001 certificate. The pack goes back within a week. For the next German buyer it goes back within a day, no bother.

Stage three: the data processing agreement is law in Cork as much as in Hamburg

A data processing agreement is not a German preference. It is the law. Article 28 of the GDPR requires a written contract between a controller (your customer) and a processor (you) whenever the processor handles personal data on the controller's behalf, and it lists what the contract must contain: the subject matter, duration, nature and purpose of the processing, the types of data and categories of people, and the processor's duties, from acting only on documented instructions and getting approval for subprocessors to deleting the data at the end and allowing audits. Electronic form counts as writing.² The Data Protection Commission says the same for Ireland, because it is the same regulation: the controller and processor must enter into a legally binding contract, Article 28 prescribes what it must contain, and the processor's own duties, from the Article 32 security measures to deleting or returning the data at the end and allowing audits, are written into it.³ So an Irish SaaS needs a data processing agreement, a DPA, for its Irish customers anyway, and one that also satisfies a German data protection officer is a matter of language and care.

The transfer question, which eats months for a supplier outside the EU, barely arises here. Personal data of German employees moving from Hamburg to a server or a support desk in Cork stays inside the EU, so there is no third country, no adequacy decision to cite and no standard contractual clauses to sign. A German controller sends personal data to an Irish processor as it would to one in Munich, as long as the Article 28 contract is in place.

Where the transfer question does come back is your subprocessor list. A US subprocessor certified under the EU US Data Privacy Framework is treated as adequate by the Commission, and one that is not certified needs the standard contractual clauses, the SCCs, the Commission's model contract for transfers to countries that are not adequate, modernised in June 2021.⁴⁵ The data protection officer will go down your subprocessor list line by line. Make the list before they ask.

Worked example: Ledgerline's data processing agreement

A German data protection lawyer changes three things in Aoife's Irish agreement: the subprocessor list becomes an annex with the country and legal basis for each entry, the annex on technical and organisational measures grows from half a page to three, and the document is produced in German with the English alongside, the German version governing. The annex lists seven subprocessors, among them the Frankfurt hosting provider and two Irish tools (EU, no transfer), one UK tool (covered by the Commission's adequacy decision for the UK), a certified US error tracking tool (Data Privacy Framework) and one uncertified US email service, for which Aoife signs the SCCs with the vendor and attaches them. Elbkai's data protection officer sends back two comments, both about deletion deadlines, and signs in nine working days. In Aoife's old funnel this stage took four months, because the document did not exist when it was asked for.

The works council has a say when your tool could watch an employee

A German works council, the Betriebsrat, can be elected in any establishment that normally has five or more permanent employees with voting rights.⁶ Among its rights of codetermination is section 87, paragraph 1, number 6 of the Works Constitution Act, the BetrVG: "the introduction and use of technical devices designed to monitor the behaviour or performance of the employees".⁶ Codetermination means the employer cannot introduce such a device without the council's agreement, or a ruling in its place.

The word "designed" sounds narrow. The Federal Labour Court reads it wide: in its settled case law, as German employment lawyers summarise it, a system is "designed to monitor" when it is objectively suited to record behaviour or performance data, whatever the employer intends, so that nearly every IT system that stores who did what falls under the section, a line the court confirmed for Microsoft's Office 365 in March 2022.⁷ A SaaS tool that logs which employee approved which invoice, and when, is inside the section.

The deal is not lost. The buyer has to agree a works agreement, a Betriebsvereinbarung, with its council on how the tool is used, which data is kept, who sees it and for how long. You cannot sign that agreement, but you can make it easy. A role based permission model, a setting that turns individual performance reports off and leaves team totals on, an export of exactly which fields are logged, and a plain German description of what the audit trail records are the four things I have seen councils ask for, every time. Have them ready and the council's deliberation shrinks from months to weeks.

Worked example: the dashboard that nearly sank the deal

Ledgerline has a "team performance" screen that shows, per user, how many invoices they cleared this week and their average time to a decision. The chair of Elbkai's works council reads it, correctly, as a device that measures individual employees. Aoife does three things in two weeks. She adds a company level switch that hides individual figures and shows only team totals. She writes a two page German description of every field in the audit log and how long it is kept. And she offers the council a call, not to sell, but to answer questions about the data. The council and Elbkai's HR agree a works agreement that keeps individual figures off, keeps audit logs for 90 days, and names Jonas as the only person with export rights. It takes five weeks, alongside the pilot. Without the switch it may well have ended in a no.

Stage four: the pilot is paid, scoped and on an invoice

A free trial asks the buyer to invest time in something nobody has approved. A paid pilot asks the buyer to approve something small. In my experience the second is far easier to get through a German organisation, because it goes through the same door everything else does: a purchase order, an invoice, a fixed scope, an end date. It also changes who shows up: not a curious user but the user, the IT contact and someone from purchasing. Scope it like a small project: one site or one team, a fixed number of weeks, three or four measurable outcomes written down before it starts, and a price that is small next to the annual contract but not free. End it with a one page report in German, because that page is what the champion puts in front of the person who signs.

Worked example: Elbkai's twelve week pilot

Aoife proposes a 12 week pilot for one Elbkai site, 14 users, at €3,600, invoiced on day one, with three outcomes written into the pilot agreement: the share of freight invoices matched automatically, the number of disputes raised with carriers, and the hours the dispatch team spends on reconciliation each week. Purchasing raises an order within eight days, because the amount is below the threshold that needs a second signature. At week 12 the report is one page. Automatic matching went from zero to 71% of invoices, 38 disputes were raised with carriers, and weekly reconciliation hours fell from 22 to nine. Aoife's own estimate, clearly labelled as hers, is that the disputes are worth about four times Ledgerline's annual fee to Elbkai. Jonas takes the page to his managing director. Nobody needs a demo.

Stage five: procurement, the contract and the language it is written in

Nothing in German law forces two businesses to contract in German. German legal departments prefer it all the same, for one hard reason: the language of the German courts is German, by statute.⁸ An English only contract under German law gets translated at someone's expense and argued about twice. That is why your English terms will come back with a request for a German version, and why I treat a bilingual contract with the German governing as the cost of doing business there.

The second hard fact concerns your standard terms. Irish contract law, like English, largely lets two businesses agree what they like. German law does not. The rules on standard business terms in the Civil Code, the BGB, apply to terms used towards a business as well, with fewer of the specific prohibitions, and the general test survives: a clause in standard terms is invalid if it disadvantages the other party unreasonably and against good faith, and an unreasonable disadvantage can follow simply from the clause not being clear and comprehensible.⁹ The clauses this most often catches in an Irish SaaS contract are the blanket liability cap, the one sided right to change the service, and the automatic renewal buried in a definitions section. I am not a lawyer. Pay a German one for an afternoon before the first contract, not after the first dispute.

The third is smaller and visible from the first visit: the Impressum. Section 5 of the Digital Services Act, the DDG, requires providers of business digital services to keep name and address, legal form and authorised representatives, an email address, the register number and the VAT identification number easily recognisable and directly reachable.¹⁰ Whether the duty formally reaches an Irish company with a German language site is a question for a lawyer. Whether a German buyer looks for the Impressum link in your footer before trusting you is not. They do. Put it there.

Worked example: Ledgerline's contract comes back with 23 comments

Elbkai's legal department returns Aoife's English terms with 23 comments. Eleven are about language and are solved by the bilingual version her German lawyer prepares for €2,400. Six are about liability: her cap of 12 months' fees survives, but the blanket exclusion of liability for data loss is struck out. Four concern the right to change features at any time, replaced with 60 days' notice. Two move the automatic renewal from the definitions section into its own clause with a three month notice period. Purchasing signs a 12 month contract at €14,400 a year, and Aoife uses the same contract, unchanged, for the next three German buyers.

Stage six: payment terms, invoices and SEPA direct debit

German buyers pay on invoice, and the law shapes the terms. Under the Civil Code a business debtor is in default at the latest 30 days after the invoice is due and has been received,¹¹ and an agreed payment period longer than 60 days is only valid if it was expressly agreed and is not grossly unfair to the creditor.¹² So "30 days net" is the default, "60 days" is a negotiation, and anything beyond that is a flag the law itself raises. An Irish SaaS that insists on a card and monthly billing is asking the buyer's accounts department to do something it does not do for any other supplier. I have not found a payment survey that covers B2B software, so that preference is my experience, not a statistic.

For recurring payments there is a business only direct debit, and an Irish supplier is already in the same SEPA area, so there is nothing new to set up. The SEPA Business to Business Direct Debit scheme is designed solely for business customers, the debtor's bank must check the mandate before it debits, and, unlike the ordinary Core scheme with its eight week return right, a business to business debit cannot be returned.¹³ Comfortable for the supplier, routine for the buyer. Offer it as the second option on the invoice.

Two more things come from the buyer's accounts team. The first is a request for an electronic invoice in a structured format, XRechnung or ZUGFeRD. Since 1 January 2025 German businesses must be able to receive electronic invoices, and the duty to issue them covers transactions between businesses established in Germany, with transition periods for issuing that run to the end of 2026 and, for smaller issuers, the end of 2027.¹⁴ An Irish supplier without a German establishment is outside the issuing duty, but the buyer's accounts system is built around it, so a structured invoice gets you paid faster. The second is VAT. For an Irish business supplying services to a business customer in another EU member state, Revenue's general rule puts the place of supply where the customer is established, so no Irish VAT is charged. Revenue asks you to put the customer's VAT number on the invoice, state that the reverse charge applies, keep the records and include the supply on your VIES return.¹⁵ In practice: no Irish VAT on the invoice, the buyer's VAT identification number, a reverse charge note and a line on the VIES return, confirmed with your accountant once.

Worked example: how Elbkai pays

Aoife's invoice to Elbkai is €14,400, no conversion needed, with no Irish VAT, Elbkai's VAT identification number, the reverse charge note and an embedded XRechnung file. Terms are 30 days net. Elbkai pays on day 26. For year two Elbkai's accounts team takes the business to business direct debit, because it saves them a manual transfer.

The arithmetic of a slower funnel

The honest objection to all of this is that it is slow. The arithmetic says it is worth it, and it fits on a napkin.

The first number is the win rate, the share of qualified opportunities that become customers:

$$w = \frac{D}{Q}$$

Here $w$ is the win rate, $D$ is the number of deals won in a period and $Q$ is the number of qualified opportunities in the same period. The only trap is counting the opportunities honestly: a trial signup who never logged in a second time is not an opportunity. The arithmetic of rates is in Foundations: ratios and rates.

Turned around, the same ratio says how many opportunities you need at the top to hit a target at the bottom: the target divided by the win rate. Halve the win rate and you need twice the opportunities.

The second number is the value of what sits in the pipeline today, weighted by how likely each deal is to close:

$$E[V] = \sum_{i=1}^{n} p_i \, V_i$$

Here $E[V]$ is the expected value of the pipeline, $n$ is the number of open deals, $p_i$ is the probability that deal $i$ closes, and $V_i$ is its annual value in euro. In a staged process each stage gets a probability from experience, and a deal in procurement is worth far more of its face value than one in discovery. The idea is explained from scratch in Foundations: expected value.

Worked example: Ledgerline's two funnels, counted

Before the rewrite, Ledgerline counted 120 German trial signups in six months and won two, so $w = 2 / 120 = 0.017$, or 1.7%. Both were on the €800 monthly plan, worth €9,600 a year each, so six months of German marketing produced €19,200 of annual revenue, and both customers left within the year.

After the rewrite, the same six months produced 18 qualified discovery calls, of which five became customers, so $w = 5 / 18 = 0.278$, or 27.8%. All five signed 12 month contracts at €14,400, so €72,000 of annual revenue. Aoife's target for the next year is eight new German customers. At $w = 0.278$ that is $8 / 0.278 = 28.8$, so about 29 qualified calls, roughly one a fortnight. On the old funnel the same eight deals would have needed $8 / 0.017 = 471$ trial signups, nearly four times her entire German traffic.

Her pipeline today has one deal at each of five stages, worth €14,400 each, and from her own deals she gives them probabilities of 10% in discovery, 25% after the security questionnaire, 40% after the data processing agreement, 60% after the pilot and 85% in procurement. The expected value is $E[V] = (0.10 + 0.25 + 0.40 + 0.60 + 0.85) \times 14{,}400 = 2.2 \times 14{,}400 = 31{,}680$, so €31,680. Five logos on a slide say €72,000. The arithmetic says €31,680, and that is the number she plans her hiring on.

Worked example: Ledgerline's year with Elbkai, start to finish

Put together, with every figure invented, the Elbkai deal ran for 27 weeks from first call to first payment, the works agreement negotiated alongside the pilot.

The chart shows the six stages along the bottom and the number of weeks each took up the side. The pilot is the longest bar and also the one the buyer pays for, so the long middle of the process is revenue and evidence, not dead time. The two bars that used to be the longest in Aoife's old funnel, the security questionnaire and the data processing agreement, are now among the shortest. The length of a German sales cycle is mostly the time it takes you to produce paper.

What to change on your German page on Monday

Swap the single "start your free trial" button for two offers: a product summary in German for the champion to forward, and a paid pilot with a scope and a price. Put the data processing agreement, the subprocessor list and the security overview behind a request form with a one day turnaround. Add the Impressum. Offer an annual invoice at 30 days and a business direct debit. Build the switch that turns individual performance figures off before the works council asks. And say, where a German data protection officer will see it, that the data stays in the EU, hosting and support included, and where each of your US subprocessors stands on the Data Privacy Framework.

None of this is about pushing harder. The German buyer's process has a shape you can see from the outside. Build your funnel in the same shape and the organisation that used to go quiet on you will do what it does with every supplier whose paperwork is in order: sign, pay on day 26, and renew. Grand. The registration, tax and compliance steps underneath all of this are in the cross border setup for Germany, and the tone of the page itself in why your home brand tone can undermine trust in DACH.

Footnotes

1. Bundesamt für Sicherheit in der Informationstechnik (BSI), Cloud Computing Compliance Criteria Catalogue (C5), BSI, 2026, https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5_node.html

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 28, Processor, as published by Intersoft Consulting, 2016, https://gdpr-info.eu/art-28-gdpr/

3. Data Protection Commission, Controller and Processor relationships, in Know your obligations, DPC, https://www.dataprotection.ie/en/organisations/know-your-obligations/controller-and-processor-relationships

4. European Commission, Adequacy decisions: how the EU determines if a country outside the EU has an adequate level of data protection, European Commission, 2025, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

5. European Commission, Standard contractual clauses (SCC) for international transfers, European Commission, 2021, https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en

6. Betriebsverfassungsgesetz (Works Constitution Act), sections 1 and 87, English translation by the Federal Ministry of Justice, https://www.gesetze-im-internet.de/englisch_betrvg/englisch_betrvg.html and the German original of section 87, https://www.gesetze-im-internet.de/betrvg/__87.html

7. GÖRG Partnerschaft von Rechtsanwälten, Neues zur IT Mitbestimmung (on the Federal Labour Court's reading of section 87(1) number 6 BetrVG, including the decision of 8 March 2022, 1 ABR 20/21), GÖRG, 2024, https://www.goerg.de/de/aktuelles/veroeffentlichungen/20-03-2024/neues-zur-it-mitbestimmung

8. Gerichtsverfassungsgesetz (Courts Constitution Act), section 184, Die Gerichtssprache ist deutsch, Federal Ministry of Justice, https://www.gesetze-im-internet.de/gvg/__184.html

9. Bürgerliches Gesetzbuch (German Civil Code), section 307, Inhaltskontrolle, https://www.gesetze-im-internet.de/bgb/__307.html and section 310, Anwendungsbereich, https://www.gesetze-im-internet.de/bgb/__310.html, Federal Ministry of Justice

10. Digitale Dienste Gesetz (DDG), section 5, Allgemeine Informationspflichten, Federal Ministry of Justice, 2024, https://www.gesetze-im-internet.de/ddg/__5.html

11. Bürgerliches Gesetzbuch (German Civil Code), section 286, paragraph 3, Verzug des Schuldners, Federal Ministry of Justice, https://www.gesetze-im-internet.de/bgb/__286.html

12. Bürgerliches Gesetzbuch (German Civil Code), section 271a, on agreed payment periods, Federal Ministry of Justice, https://www.gesetze-im-internet.de/bgb/__271a.html

13. Deutsche Bundesbank, SEPA Direct Debit (the Core and the Business to Business schemes), Deutsche Bundesbank, https://www.bundesbank.de/en/tasks/payment-systems/services/sepa/content/sepa-direct-debit-626654

14. IHK Berlin, eRechnung: ab 2025 Pflicht, IHK Berlin, 2025, https://www.ihk.de/berlin/service-und-beratung/recht-und-steuern/steuern-und-finanzen/erechnung-6184420

15. Revenue Commissioners, VAT obligations of Irish traders when supplying services abroad, Revenue, https://www.revenue.ie/en/vat/vat-on-services/when-is-vat-charged-on-services/vat-obligations-of-Irish-traders-supplying-services-to-business-customers-abroad.aspx and General place of supply rules for services, https://www.revenue.ie/en/vat/vat-on-services/when-is-vat-charged-on-services/general-place-of-supply-rules-for-services.aspx