Short answer
In most B2B companies, the head of sales or chief revenue officer owns the budget for sales tools and signs, after sales operations or RevOps evaluates the options and checks the fit with the CRM. Managers and reps test them. Above a spending limit, finance approves; IT and security review data access, single sign-on and the vendor's security reports; procurement and legal handle the contract and data processing terms. In small companies, the founder does most of this.
- The sales leader owns the budget; sales ops or RevOps usually runs the evaluation and owns the stack.
- A tool that reads email, calendars or CRM data needs an IT admin's approval before reps can connect it.
- Security asks for a SOC 2 report or a questionnaire; legal asks for data processing terms.
- Spending limits decide who else signs, so size the first order to an approval you can get.
- Start the security review during the trial, not after it.
On this page
- Who is involved, and what each one decides
- How it changes with company size
- Sales ops, RevOps and the sales leader: who owns what
- How a sales tool purchase runs, step by step
- What IT, security, procurement and legal will ask for
- Worked example: a 25-seat purchase against a deadline
- For sellers: questions that map the buying group
- Self-check for a deal in progress
- Pitfalls
- Sources
- Questions people ask
This guide is for people who sell sales software, data or services to sales teams, and for sales leaders and RevOps managers about to buy. It maps who takes part in a sales tool purchase, how that changes with company size, what IT, security, procurement and legal will ask for, and a worked 25-seat purchase with the approval and timeline arithmetic. For how buying groups form shortlists before they talk to anyone, see how B2B buyers build a shortlist.
Who is involved, and what each one decides
The table is guidance from how sales tool purchases usually run, not survey data. Titles vary; look for the person doing each job.
| Role | Usual part in the purchase | What they need to see | Can they stop it? |
|---|---|---|---|
| CRO or VP of sales | Budget owner and final yes | Effect on pipeline, win rate or rep time; total cost | Yes |
| Sales ops or RevOps | Runs the evaluation, owns the CRM and the stack, administers the tool afterward | CRM integration, data model, reporting, overlap with tools they already have | In practice, yes |
| Sales enablement | Rollout and training | How easy it is to adopt and teach | Rarely |
| Frontline managers and reps | Trial users | Time saved in their day, inside their workflow | Indirectly: no adoption, no renewal |
| Finance | Approves above a spending limit; budget timing | Cost, payment terms, payback, which budget line | Yes, above their threshold |
| IT and security | Data access, single sign-on, integrations, vendor security | Security reports, the access the tool requests, where data is stored | Yes |
| Procurement | Vendor onboarding, terms, competing quotes | Standard terms, price benchmarks, vendor details | Can delay, sometimes block |
| Legal and privacy | Contract, data processing terms, call recording consent | Data processing agreement, liability, how prospect data is used | Yes |
| Marketing ops | Involved when the tool touches lead routing or contact data | Field mapping, duplicates, consent records | Sometimes |
How it changes with company size
Also guidance, not survey data:
| Under 50 employees | 50 to 500 | Over 500 | |
|---|---|---|---|
| Who decides | The founder or first sales leader | VP of sales, with sales ops or RevOps evaluating | CRO or VP of sales, with a RevOps leader who owns the stack |
| Who else signs | Usually nobody | Finance above a threshold | Finance, procurement, security and legal |
| Security review | A quick check, if any | A questionnaire for tools that touch email or the CRM | A formal review with a SOC 2 report and a standard questionnaire |
| Typical path | Free trial, card payment | Trial, quote, approval | Pilot, business case, security and procurement, contract |
| Typical time | Days | Weeks | Often a quarter or more |
Sales ops, RevOps and the sales leader: who owns what
Sales operations usually sits inside the sales team and reports to the sales leader. RevOps spans marketing, sales and customer success, and often owns the shared systems: the CRM, routing and the data that feeds them. Either way, the ops team is the one that says "we already have something that does that," because it knows what's in the stack and what overlaps. The sales operations manager role covers the job in more detail.
| Decision | Sales leader | Sales ops or RevOps | IT |
|---|---|---|---|
| Whether to buy anything | Decides | Recommends | Advises |
| Which vendor | Approves | Runs the evaluation and recommends | Can veto on security |
| Integration and data model | Informed | Decides | Approves the access |
| Rollout and adoption | Accountable | Administers | Sets up sign-on and access |
| Renewal | Decides | Brings the usage data | Reviews the access again |
How a sales tool purchase runs, step by step
- A trigger. A missed number, a new sales leader, a move upmarket, an incumbent tool up for renewal, or reps complaining about a manual task.
- An owner and a budget. Someone, often in sales ops or RevOps, is asked to fix it, and the budget line is identified.
- Requirements. Must-haves, CRM fit, data, integrations and the security standards any vendor must meet.
- A shortlist, mostly without sellers. In G2's March 2026 survey of 1,076 B2B software buyers, 51% said they now start research with an AI chatbot more often than with Google, AI chatbots were the top source influencing shortlists, and 69% chose a different vendor than they first planned.
- A trial or pilot with a few reps and their manager, judged on measures agreed beforehand.
- A business case and approval: cost, payback and the budget it comes from.
- Security, IT and privacy review, ideally in parallel with the trial.
- Procurement and legal: terms, the data processing agreement and the order form.
- Signature, set-up and rollout: single sign-on, user provisioning, training.
- An adoption check well before the renewal date.
What IT, security, procurement and legal will ask for
| Item | Who asks | What it is |
|---|---|---|
| SOC 2 report | Security | A CPA firm's report on a service organization's controls. The AICPA's SOC 2 reporting covers security, availability, processing integrity, confidentiality or privacy. |
| Security questionnaire | Security | Often a standard one. The Cloud Security Alliance's CAIQ "captures how your cloud service implements each CCM control", and vendors can publish it in CSA's public STAR Registry. |
| App access approval | IT admin | Google Workspace admins can mark a third-party app trusted, limited, limited to specific Google data, or blocked, can block all unconfigured third-party apps, and can restrict high-risk Gmail and Drive scopes. In Microsoft Entra, users can by default consent to apps for permissions that don't need an admin, and Microsoft recommends allowing user consent only for apps from verified publishers. |
| Single sign-on and provisioning | IT | How users sign in and how accounts are created and removed |
| Data processing agreement | Legal and privacy | Under UK GDPR Article 28(3), as the ICO explains, a contract with a processor must cover documented instructions, confidentiality, security, sub-processors, help with individuals' rights, deletion or return of data, and audits. |
| Call recording terms | Legal | For conversation tools: consent rules vary by state. See is cold calling legal. |
| Vendor onboarding | Procurement | Company details, tax forms, insurance certificates and bank details |
The app access row catches many sellers out. A tool that reps connect to Gmail or Outlook can be blocked at the moment they connect it if IT has restricted third-party apps, even after the contract is signed. Ask about it in the first call.
Worked example: a 25-seat purchase against a deadline
Illustrative example. The companies, people and figures are invented to show the arithmetic.
Brightwell Insurance Services (brightwell.example) has 600 employees and 25 account executives. Its VP of sales wants a sales engagement tool that sends sequences from reps' Gmail accounts and syncs with the CRM. The vendor quotes $110 per user per month: 25 × $110 × 12 = $33,000 a year. Brightwell's policy lets a VP approve up to $25,000 a year; above that, the CFO signs. IT allows apps with Gmail access only once they're marked trusted, which needs a current SOC 2 report and the company's security questionnaire.
Can the order fit under the VP's limit? 20 seats = 20 × $110 × 12 = $26,400, still over. 18 seats = $23,760, under, but leaves 7 reps out and splits the team. The better plan is to get the CFO's approval, with evidence from the trial.
The business case. In the trial, five reps saved about 3 hours a week each on manual follow-up. Across 25 reps over 46 working weeks, that's 25 × 3 × 46 = 3,450 hours. At an illustrative loaded cost of $60 an hour, that's $207,000 of rep time, against a $33,000 subscription.
The timeline. It's 1 October, and the VP wants the tool live for the 1 January kickoff, 13 weeks away.
| Step | Weeks | Owner | Run in sequence, starts | Run in parallel, starts |
|---|---|---|---|---|
| Trial with five reps | 3 | RevOps manager | Week 1 | Week 1 |
| Security review | 4 | IT security | Week 4 | Week 1 |
| Business case to the CFO | 1 | VP of sales | Week 8 | Week 4 |
| Procurement and data processing agreement | 3 | Procurement and legal | Week 9 | Week 5 |
| App marked trusted, sign-on set up | 1 | IT admin | Week 12 | Week 8 |
| Rollout and training | 2 | Enablement | Week 13 | Week 9 |
| Live | After week 14: misses the date | After week 10: three weeks to spare |
In sequence, the steps take 3 + 4 + 1 + 3 + 1 + 2 = 14 weeks, one more than there is. Starting the security review and the questionnaire in week 1 saves four weeks. The seller's job is to make that happen: send the SOC 2 report and the completed questionnaire before the trial starts.
For sellers: questions that map the buying group
Ask your champion these early, and write down the names:
- Who signed the last sales tool you bought, and how long did it take?
- What's the spending limit before finance gets involved?
- Who owns the CRM, and who approves a new integration?
- Does IT have to approve apps that connect to email or calendars?
- Is there a standard security questionnaire, and how long does a review usually take?
- Is anything up for renewal that this would replace, and when?
For the formal side of authority (approval limits and who can commit money), see who has buying authority. Finding the RevOps, sales ops and IT people at each target account is research before it's selling; Bebop finds the people at each account and writes a playbook with who to talk to and why.
Self-check for a deal in progress
- You know who owns the budget and what their approval limit is.
- You've met the person in sales ops or RevOps who will run the evaluation.
- You know whether the tool needs IT's approval to connect to email, calendars or the CRM.
- The security material (SOC 2 report or questionnaire) is with the buyer, or the date it's due is agreed.
- You know who reviews the contract and the data processing terms, and roughly how long they take.
- The trial has success measures the budget owner agreed to.
Pitfalls
- Selling only to the VP of sales and meeting RevOps in week eight, when they find an overlap with a tool they already pay for.
- Leaving security until after the trial. It's usually the longest step.
- Forgetting app access controls. A signed deal can still be blocked when reps try to connect.
- Pricing just over an approval limit without planning for the extra signature.
- Mistaking enthusiastic reps for a buyer. Users can win you a trial; they rarely own a budget.
Next step: see how buyers narrow the field before they call anyone in how B2B buyers build a shortlist.
Sources
- In the Answer Economy, Don't Win the Click: Win the Answer, G2, 15 April 2026
- System and Organization Controls: SOC Suite of Services, AICPA and CIMA, accessed 30 October 2026
- STAR, Cloud Security Alliance, accessed 30 October 2026
- Control which apps access Google Workspace data, Google Workspace Admin Help, accessed 30 October 2026
- Configure how users consent to applications, Microsoft Learn (Microsoft Entra ID), updated 4 August 2026, accessed 30 October 2026
- What needs to be included in the contract?, Information Commissioner's Office (UK), accessed 30 October 2026
Written by the Bebop team at Blackpearl Group. Published .
Questions people ask
Who makes the decision to buy sales software?
Usually the head of sales, such as the VP of sales or chief revenue officer, who owns the budget and gives the final yes. Sales operations or RevOps typically runs the evaluation and recommends a vendor, and reps and managers test it. Above a spending limit, finance also signs, and IT, security, procurement and legal can each block the purchase until their review is done. In a small company, the founder often does all of this.
Does RevOps or sales ops own the sales tech stack?
It depends on how the company is organized. Sales operations usually sits inside the sales team and owns the tools reps use. RevOps spans marketing, sales and customer success, and where it exists it often owns the shared systems, such as the CRM, routing and data. In both cases the ops team evaluates new tools, decides how they integrate and administers them, while the sales leader approves the spend.
What does a security review for a sales tool involve?
Typically the vendor provides a SOC 2 report or completes a security questionnaire, IT checks the access the tool requests to email, calendars and the CRM, and sets up single sign-on. Google Workspace and Microsoft Entra admins can restrict or block third-party apps until they're approved. Legal or privacy teams review the data processing agreement. For tools that record calls, they also check consent rules.
How long does it take a company to buy a sales tool?
As general guidance: days for a small company on a free trial and a card, a few weeks for a mid-sized company with a quote and one approval, and often a quarter or more for a large company with security, procurement and legal reviews. The security review is often the longest step, so running it in parallel with the trial is the easiest way to shorten the whole process.
What is a SOC 2 report, and why do buyers ask for it?
A SOC 2 report is a CPA firm's report on the controls at a service organization, under AICPA standards, covering security, availability, processing integrity, confidentiality or privacy. Buyers ask for it because a sales tool often holds or reaches customer, prospect and email data, and the report lets their security team assess the vendor's controls without auditing the vendor themselves. Have it ready before the trial starts.
Who should I target when selling a sales tool?
Start with the budget owner, usually the VP of sales or CRO, and the person in sales ops or RevOps who will run the evaluation; win both. Bring in a frontline manager to run the trial, and ask early about finance's approval limit, IT's rules for apps that connect to email or the CRM, and who reviews contracts. A deal sold only to users or only to the executive tends to stall.