The questions to ask any software or service vendor before your organization’s data goes anywhere: where it lives, who can see it, what happens when something goes wrong, and how you get it back.
Free to print and adaptLast reviewed October 2026
Write down what you need before you see a demo
A demonstration shows what the product does well. Your list shows whether it does what you need.
Describe the job in a paragraph: who will use it, what records it will hold, and what it replaces.
Note the sensitive information it will hold: health, financial, immigration, criminal justice, children’s records. That decides how hard you need to push on every question below.
Name the person who will own it day to day and the person who can sign the contract. If nobody can own it, do not buy it yet.
Ask at least two vendors the same questions, in writing. The comparison table at the end of this guide is a starting point.
Where your data lives
Some laws, funders and partners care which country your data is stored in. Many contracts are vague about it.
In which countries is our data stored, including backups and support copies?Listen for: Named countries or regions, in the contract, with notice before they change.
Which subprocessors (other companies) handle our data, and how will you tell us when that list changes?Listen for: A published list, and advance notice of changes with a way to object or leave.
A subprocessor is any other company your vendor relies on to hold or process your data, such as their hosting or email provider. Each one is another place your data can leak from. You do not need to vet them all, but you should know who they are.
Who can see it
The people with the most access to your data may be the vendor’s own staff.
Which of your staff can see our data, when, and is that access logged?Listen for: Access only for named roles, only when needed, logged, and visible to you on request.
Are single sign-on and multi-factor authentication included in the plan we are buying?Listen for: Yes, in your tier. Security features should not cost extra.
Check whether the vendor charges more for single sign-on or multi-factor authentication. Where they do, factor it into the price, because you will need both. Our security field guide explains why.
When something goes wrong
You may have a legal deadline to report a breach. Your vendor needs to tell you in time for you to meet it.
How quickly will you tell us about a security incident affecting our data, and who will tell us?Listen for: A fixed number of hours or days written into the contract, and a named contact.
In some countries the clock for telling the regulator is short: in the United Kingdom, for example, a reportable breach must be reported to the ICO as soon as possible and, where feasible, within 72 hours. A vendor who tells you a week later leaves you no time. See privacy duties by country.
Getting out
The best time to agree how you leave is before you arrive.
If we leave, how do we get all of our data back, in what format, and at what cost?Listen for: A complete export in an open, documented format (such as CSV or JSON), at no extra charge.
How long after we leave do you keep our data, and will you confirm deletion in writing?Listen for: A short, stated period, then deletion, confirmed in writing.
Test an export during the trial, not when you are leaving. Open the file and check that everything you need is there, including attachments and history.
Make sure the contract lets you leave if the vendor is sold, changes its terms or moves your data somewhere you did not agree to.
Security evidence: what it proves and what it does not
Certificates and reports are useful. They are not a guarantee.
What independent security evidence can you share: SOC 2 report, ISO/IEC 27001 certificate, recent penetration test summary?Listen for: A current report or certificate whose scope covers the product you are buying.
SOC 2 reports
A SOC 2 report is an independent auditor’s report, under a framework from the AICPA, on a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy. Read three things before you rely on one:
Scope. Which systems and which of those five areas were examined. The product you are buying should be inside it.
Type and period. A Type 1 report describes controls at a single date; a Type 2 report also tests whether they worked over a period, usually several months. Type 2 tells you more. Check that the period is recent.
Exceptions and your responsibilities. The auditor lists any controls that failed, and the report lists controls the customer is expected to run, such as managing your own users. Those are your job, not the vendor’s.
ISO/IEC 27001 certificates
An ISO/IEC 27001 certificate says an accredited certification body found the vendor runs an information security management system that meets the standard. Ask for the certificate itself, check the scope statement covers the service you are buying, check the expiry date, and check who issued it.
What neither proves
That the product is secure in the way you will configure and use it. Under the shared responsibility model for cloud services, some security is always yours.
That a breach cannot happen. A clean report is evidence of good practice during a period, not a promise about the future.
Anything about privacy law compliance, accessibility or the vendor’s financial health.
Accessibility
If staff, volunteers or the public will use it, people with disabilities will use it too.
Do you have an Accessibility Conformance Report (ACR), and which WCAG version and level does it cover?Listen for: A recent report for this product, honest about known gaps and when they will be fixed.
An Accessibility Conformance Report, often produced using a template called a VPAT, explains how a product meets accessibility standards. Treat it as the vendor’s own claim: try the product with a keyboard only and with a screen reader during the trial. Our accessibility guide shows how in under an hour.
Pricing traps
The first-year price is rarely the price you pay.
Does the contract renew automatically, how much notice must we give to cancel, and how much can the price rise at renewal?Listen for: Renewal reminders, a short notice period, and a cap on increases written into the contract.
If we have a nonprofit or public-sector discount, how long does it last and what happens when it ends?Listen for: A stated term, and the full price you will pay afterwards.
Are there minimum user numbers, implementation fees, support fees or charges for exporting data?Listen for: All one-off and recurring costs listed in the order form.
Automatic renewal. Put the cancellation deadline in a shared calendar the day you sign, with a reminder a month before.
Price rises. Ask for a written cap on renewal increases, or a fixed price for the whole term.
Discount cliffs. A generous first-year nonprofit discount can turn into a full price you cannot afford. Budget for the year-two price before you start.
Security as an extra. Single sign-on, audit logs and longer data retention are sometimes only in higher tiers.
Exit fees. Charges for exporting your own data, or for help leaving, should be in the order form or ruled out.
A comparison table you can copy
Ask every vendor the same questions in writing, then compare the answers side by side.
Download the table as a spreadsheet file, or copy it into your own document. Leave a cell empty until you have the answer in writing.
In which countries is our data stored, including backups and support copies?
Which subprocessors (other companies) handle our data, and how will you tell us when that list changes?
Which of your staff can see our data, when, and is that access logged?
Are single sign-on and multi-factor authentication included in the plan we are buying?
How quickly will you tell us about a security incident affecting our data, and who will tell us?
If we leave, how do we get all of our data back, in what format, and at what cost?
How long after we leave do you keep our data, and will you confirm deletion in writing?
What independent security evidence can you share: SOC 2 report, ISO/IEC 27001 certificate, recent penetration test summary?
Do you have an Accessibility Conformance Report (ACR), and which WCAG version and level does it cover?
Does the contract renew automatically, how much notice must we give to cancel, and how much can the price rise at renewal?
If we have a nonprofit or public-sector discount, how long does it last and what happens when it ends?
Are there minimum user numbers, implementation fees, support fees or charges for exporting data?
Sources
Where this comes from.
Primary sources only: governments, regulators, standards bodies and the vendors themselves. Each was opened and checked on 18 October 2026. If something here no longer matches the source, the source wins; please tell us at hello@moraph.org.
UK National Cyber Security CentreCloud security shared responsibility modelwww.ncsc.gov.uk/collection/cloud/understanding-cloud-services/cloud-security-shared-responsibility-model