← Back to playbooks

August 20, 2026

Wedge Selling with BAA and On-Prem Deployments

When a deal requires a Business Associate Agreement (BAA) and on-prem deployment, most sellers see friction. I see the wedge.

The BAA and the on-prem ask are not blockers. They’re the two things that let you get in the door, prove yourself in a controlled environment, and then expand — silently and beautifully — once you’re trusted. Handled right, they are weapons against competitors much bigger than you.

What the Wedge Is

A wedge is the smallest possible version of a product that gets you inside an account. You win the wedge, you earn trust, and then you widen.

In the security and healthcare space, the wedge is almost always: “We can run inside your environment, under your compliance requirements, for this single pain point — nothing else.”

That’s an offer a security team can say yes to. A big, vague platform pitch makes them nervous. A small, contained, compliant deployment makes them comfortable.

Why BAA + On-Prem Beats the Big Platforms

The strategic case is simple: large platforms will never do a BAA or on-prem. Every compliance concession is a product decision and a legal liability at their scale, so they say no at the doorstep. That’s your opening.

• Target startups with regulated customers. Healthtech, fintech, anything holding protected data. These startups are desperate for vendors who respect their compliance reality, and their customers expect BAAs.
• The BAA is your differentiator against platforms. A startup with regulated customers is a buyer a big platform can’t easily serve. You can — and that’s why they’ll choose you.
• Fully managed on-prem is a second wedge. Offer on-prem deployments with FDE support. Large platforms and growth-minded startups alike ignore it, because it’s operational hassle they’re not built for. The startup that simply agrees to run inside the customer’s environment wins deals the platform can’t even enter.

Other startups will copy the BAA move to compete with you. Accept that. The copycats dilute each other — they don’t beat you. What matters is that the BAA and on-prem still eliminate the platforms, and that’s where the real competition was.

The Equipment You Need

You can’t sell this wedge without the ability to close documents fast. Compliance buyers lose faith when agreements drag.

• Outsource your legal team — and make sure they turn around documents quickly.
• The BAA is the emotional purchase. Walk the prospect through exactly how the agreement works, who signs it, and how their data is handled. The prospect should feel more intelligent after the security call, not more anxious.
• Speed the ramp from “we can do this” to “here’s the signed document.” A slow BAA is a lost CEO — the deal stalls, and your wedge rots in their pipeline.

Startups use this motion to beat each other with speed. The one with fast legal wins the account.

The Upside Trap: Watch Your Pipeline

Here’s the warning that comes with the wedge. The BAA + on-prem motion steers you into enterprise deals — and enterprise deals take forever to close and require a mountain of assurances.

You can win the wedge and still lose the quarter if your pipeline bloats with:

• Six-to-nine-month cycles on security reviews and procurement.
• Endless reassurance requests — SOC 2 details, penetration testing, insurance certificates, annual compliance regrowth.
• Legal back-and-forth that absorbs the very outsourced counsel you hired to be fast.

The wedge is real. But if every opportunity requires a BAA, on-prem, and a security review, you’ve built a pipeline of slowly strangling deals — and a revenue forecast that keeps slipping.

Keeping the Wedge Focused

• Qualify the enterprise deals hard. Just because they’ll say yes to a BAA doesn’t mean they’ll close on your timeline. Push for champion, budget, and POC duration before you invest in deal-specific legal work.
• Use the wedge to size the win, not to fill the pipeline. One or two anchor deployments that prove the model are worth more than ten BAA deals stuck in security review.
• Know which accounts buy on the wedge specifically: healthtech and security-forward startups that want on-prem with FDE from a vendor who doesn’t treat them like a platform would.

The Golden Rule of the Wedge

Never make the wedge about the full vision. The wedge is about getting inside. The vision is what keeps you there.

And never let the wedge become your whole pipeline. Use it to win the accounts platforms can’t reach — then be ruthless about not letting those deals drown you in assurances. The wedge wins the door; discipline keeps the quarter alive.