Who controls the tools you already run

The announcements worth your attention today are not about new features. They are about who controls the tools you already run — where the data sits, who is allowed to administer it, how the numbers it produces get read, and what happens when the price of running it goes up.

That is the shape of a maturing market. When a category is young, buyers compare capability. When it settles, they compare control: residency, permissions, security, and the economics underneath the subscription. Five of the day's items speak to that shift, and each one changes a decision a business actually has to make.

Where your data is allowed to live

Google Workspace announced that its Gemini app now supports data regions, so the assistant follows the same regionalisation rules an organisation already sets for the rest of Workspace. In the vendor's words, "Beginning today, the Gemini app adheres to your organization's data regionalization requirements" [1]. Admins can require EU storage and processing, US storage and processing, or both.

This matters more than it looks. An AI feature bolted onto a suite you trust is not automatically covered by the promises the suite made about your data. Residency — the guarantee that information is stored and processed in a named jurisdiction — is one of those promises, and until an AI surface honours it, using that surface can quietly move regulated data somewhere your contracts did not allow. The lesson for a buyer is to treat every new AI capability as a fresh data-handling decision, not an extension of the platform's existing one. Ask where the prompts go, where the outputs are stored, and whether the same regional controls apply. If the answer is vague, the feature is not yet ready for regulated work. This is the same discipline that governs how you leave a tool cleanly, covered in what happens to your data when you leave.

Reading your own numbers without becoming an analyst

Xero introduced industry benchmarks inside Xero Analytics, letting an owner see how their business compares against others in the same sector. The framing is honest about who this is for: "You didn't start your business to become a data analyst" [2]. Most owners can read their own figures but cannot tell whether a number is good until they have something to compare it against.

A benchmark supplies that missing context. On its own, a figure like a 40-day payment cycle or a 30% gross margin means nothing — it is only a warning or a reassurance once you know what is normal for your trade. The caution is that a benchmark is a starting question, not a verdict. Sector averages hide enormous variation by size, region and business model, so the right use is to notice a gap and then investigate it, never to treat the comparison as a target. A number is worth acting on only when it would change what you do next; we wrote about that test in numbers that change a decision. Used that way, a benchmark turns a dashboard from a wall of figures into a short list of things to look into.

Scoping who can administer what

Google Workspace also made mobile device management privileges assignable by organisational unit. The announcement puts it plainly: "We're giving admins more granular control over how mobile device management privileges are delegated" [3]. Instead of one administrator holding device powers across the whole company, those powers can now be scoped to a specific part of it.

This is the principle of least privilege made concrete. As a team grows, the risk is rarely a malicious insider; it is an over-broad account that can touch far more than the job requires, so that one mistake or one compromised login reaches everything. Scoping administrative power to the unit that needs it shrinks the blast radius of any single error. The trade-off is real — more granular roles mean more roles to design and maintain — but that overhead is cheaper than the alternative of a handful of accounts that can do anything. When you evaluate any tool that multiple people will administer, look for whether privileges can be divided along the lines your organisation actually has. We cover why this matters as headcount rises in why permissions matter as a team grows. 360REV takes the same view: administrative scope is defined per workspace and per seat, so ending someone's access in one place changes nothing elsewhere.

The supply chain you did not choose

GitHub published a look inside its Advisory Database, reporting that "The GitHub Advisory Database is processing more vulnerability reports than ever before" [4]. Every business that runs software depends, indirectly, on the open-source components inside it, and the rate at which flaws in those components are being catalogued is climbing.

For a buyer, the takeaway is not to read vulnerability feeds yourself. It is to ask vendors how they track and respond to flaws in the code they build on. A rising volume of disclosures is, in one sense, good news — problems found and recorded are problems that can be fixed — but it also means a vendor's patch discipline is now part of what you are buying. When you assess a tool, treat "how quickly do you respond to a disclosed vulnerability" as a first-order question, on par with price and features. The suppliers who answer it clearly are telling you they take the parts of the stack you cannot see seriously.

What a price increase actually costs

SaaStr addressed a question every growing vendor faces: how to raise prices on small-business customers. Its answer starts from the tension — "Raising prices in SaaS serving SMBs is tricky but necessary as you scale" [5]. Prices rise because costs and value both rise, but small buyers are the most sensitive to it.

This is worth reading from the buyer's seat as well as the seller's. A price increase is a signal about the relationship. Handled with notice and a clear reason, it tells you a vendor intends to be around and to keep investing. Sprung without warning, it tells you something about how the vendor sees the account. When you choose a tool you plan to depend on, ask about the pricing history: how often it has changed, how much notice was given, and whether existing customers were protected. A subscription is a recurring decision, not a one-time purchase, and the way a vendor manages its own economics is part of what you are signing up for.

The thread

None of today's items is a new capability you did not have yesterday. Each is about control over capabilities you already have: the jurisdiction your data sits in, the scope of who can change it, the security of the parts you cannot see, the context that makes a number mean something, and the terms under which the price can move. In a settled market, that is where the real choosing happens.