Questions to Ask a SaaS Vendor Before You Sign
Picture of Jessie Guerrero
Jessie Guerrero

Questions to Ask a SaaS Vendor Before You Sign

Questions to Ask a SaaS Vendor Before You Sign

A software demo shows you the best day of the product. The contract and the vendor's answers to a few direct questions show you the other days: the outage, the price increase, the request to get your data out. Asking before you sign costs a conversation. Asking after costs leverage.

This list is written for small and mid-sized teams buying subscription software without a dedicated procurement department. It groups questions by theme, explains why each matters, and notes what a good answer tends to look like. If the basics of the model are new to you, start with our explainer on what software as a service is.

A note on scope: this is general information to help you prepare. It is not legal advice, and contract wording varies. For anything high-value or involving sensitive data, ask a qualified adviser to review the agreement.

How to use this list

  1. Send the questions in writing so you have a record of the answers.
  2. Ask the vendor to point to the document (security report, terms, order form) that backs each answer. A verbal "yes, we do that" is weaker than a clause.
  3. Compare answers across two or three vendors. Differences between them can tell you more than any single answer.
  4. Store the answers with the contract so the next person who renews it can find them.

1. Data: who owns it and where does it go?

Who owns the data we put into the product? You want the agreement to say that you keep ownership of your content and that the vendor has only the rights needed to run the service. Look for any clause that lets the vendor use your content for other purposes, and ask what those purposes are.

Where is our data stored, and which sub-processors touch it? SaaS products may rely on other companies for hosting, email delivery, analytics, or support tools. Ask for the list of sub-processors and how you are told when it changes.

If we are subject to data-protection rules, will you sign a data processing agreement? Under the EU's General Data Protection Regulation, processing by a processor on behalf of a controller must be governed by a contract that sets out the subject matter, duration, and nature of the processing, among other things. If your business handles personal data of people in the EU, ask whether the vendor provides a standard data processing agreement. Whether the regulation applies to you is a question for your own adviser.

Can we export all of our data in a usable format, and how? Ask what formats are available (for example, CSV or JSON), whether attachments and history are included, whether exports are self-service, and whether there is any fee. It is easy to skip at signing and hard to fix later. We cover the exit side in more depth in our guide to a SaaS exit plan checklist.

2. Security: what can they show you?

Do you have an independent security audit report we can read? Some vendors share a SOC 2 report. SOC 2 is an examination of a service organization's controls, and the AICPA's trust services criteria it draws on relate to security, availability, processing integrity, confidentiality, and privacy. Ask which of these areas the report you would receive addresses, which period or date it covers, and how recent it is. Be cautious of a vendor that cannot explain what its report covers.

How do you handle user access and sign-in? Ask about multi-factor authentication, single sign-on support, role-based permissions, and audit logs of who did what. Check whether these features are on the plan you are buying or reserved for a higher tier.

How is data protected in transit and at rest? You do not need a lecture on cryptography. You want a clear statement of what is encrypted and where the vendor's documentation says so.

What is your process if there is a security incident, and how fast will you tell us? Ask for the notification commitment in writing. Under the GDPR, a processor is required to notify the controller without undue delay after becoming aware of a personal data breach, which gives you a reference point to compare against.

3. Reliability: what are you actually being promised?

What uptime do you commit to, and how is it measured? A headline percentage means little without its definition. Ask how downtime is calculated, whether scheduled maintenance is excluded, over what period it is measured, and where the status is published.

What happens if you miss the commitment? Service credits are one possible remedy; they may be limited, and you may have to claim them. Read how to claim and whether credits are the only remedy.

What is your backup and recovery approach? Ask how often backups run, how long they are kept, and whether you can request a restore of your own data if you delete something by mistake.

4. Price: what does the number really cover?

What is included in this plan, and what costs extra? Possible add-ons can include additional storage, API access, premium support, extra integrations, and advanced security features. Ask for the full price list, not just the plan page.

How is the price calculated: per user, per usage, or flat? Ask what counts as a user, whether read-only or inactive users are charged, and what happens when you add or remove people mid-term.

How much can the price rise at renewal? Ask whether the agreement caps increases or leaves them to the vendor. If you can negotiate a cap, ask now, when you are the prospect.

What is the renewal and cancellation process? Find out whether the plan renews automatically, how much notice you must give, and where notice goes. Put the deadline in a tracker; our walkthrough on building a SaaS renewal date tracker shows one way to do it.

5. Fit: will it work with what you already use?

Which integrations are built in, and which need custom work? Ask for a list, and ask whether the integration you need is maintained by the vendor or by a third party. Our overview of integrating business software explains the options in plain terms.

Is there an API, and what are its limits? If you plan to automate work, ask about rate limits, authentication methods, and whether API access is included in your plan.

How do we get started, and who does the setup? Clarify whether onboarding is included, what it involves, and how long customers like you typically take. Ask for specifics rather than a general promise.

6. Support: who answers when something breaks?

What support channels and hours are included? Check the hours against your own working hours and time zone. Ask whether the response targets in the agreement apply to your plan.

Is there a named contact or only a ticket queue? Neither is wrong, but you should know which you are getting.

How do you announce product changes and retirements? Ask how much notice customers get before a feature is removed or a plan is discontinued.

7. Exit: how do we leave if this does not work?

What happens to our data when we cancel? Ask how long the vendor keeps data after termination, how deletion is confirmed, and whether you receive a final export first. For personal data covered by the GDPR, the processor contract must provide that, at the controller's choice, the processor deletes or returns all personal data after the end of the services, and deletes existing copies unless law requires storage.

Can we terminate early, and what does it cost? Understand any minimum term, early-termination fee, or non-refundable prepayment.

Red flags worth pausing on

  • Vague answers about where data is stored or who can access it.
  • No data export, or export only through a paid service request.
  • A vendor that will not share its security report even under a confidentiality agreement, and gives no reason.
  • Unlimited price increases at renewal with short notice.
  • Pressure to sign by a deadline before you have received written answers.

None of these means you should walk away automatically. They mean you should ask a follow-up and weigh the risk against the value.

A short scorecard

If you are comparing vendors, give each a simple rating from one to three on the same rows: data ownership and export, security evidence, reliability commitments, pricing clarity, integration fit, support, and exit terms. A shared scorecard keeps the decision about evidence and not about whoever gave the best demo. For help judging category differences, see our guides to CRM software and customer support software.

For a practical inventory workflow to use during vendor review, see our SaaS renewal date tracker spreadsheet guide.

Sources

Note for reviewer: no statistics, prices, quotes or named people. The SOC 2 description and the five area names come from the two AICPA & CIMA pages listed above.

MORE TO EXPLORE