Check four things: whether the contract auto renews, how long the non renewal notice window is, what the vendor may change at renewal, and what you can do with your data if you leave. Then put the notice deadline in a shared calendar, not in the contract folder.
Why this gets missed
Security tools are signed in a rush, often after a pilot, and then forgotten. The notice deadline might fall months before the renewal date. Miss it and you may be committed for another term, whether or not the tool is still right.
The terms to find
| Term | What to look for |
|---|---|
| Renewal type | Auto renew or fixed end. Auto renew is common |
| Notice window | Days before term end you must give notice, and by what method |
| Notice method | Written to a named address, or through the portal |
| Change rights | Can the vendor change scope, features or terms at renewal, and with how much notice |
| Quantity changes | Can you reduce volume at renewal |
| Term length | Multi year commitments limit your options |
| Termination | Rights for cause, such as a breach or a missed commitment |
| Data on exit | Export formats and deletion timeline |
Build the routine
- Record the renewal date and the notice deadline in your vendor register, both with owners.
- Set calendar reminders at 120, 90 and 60 days before the notice deadline.
- At 120 days, start a usage and value review. Use the same measures as your pilot.
- At 90 days, decide: renew, renegotiate, or replace.
- Send any notice by the method the contract specifies and keep proof.
What to review before deciding
- Usage. Are you using what you bought? See how usage is metered.
- Outcomes. Time to fix, noise rate, gates that blocked real issues.
- Incidents. Any vendor outages or security incidents during the term.
- Support. Response against what was promised.
- Alternatives. Whether your needs have shifted, for instance more container or API coverage.
- Exit readiness. Whether you could export findings and rules in time.
Negotiate before you need to
At signing, ask for a notice window you can live with, and for the vendor to send a reminder before it. Ask for caps or notice on terms changing at renewal. These are commonly agreeable when raised early, harder at the deadline.
For exit specifics see SCA exit plan and data portability.
Safeguard offers SBOM and dependency scanning, and a free scan is available at gold.safeguard.sh/scan.
Quick check
Who should own the renewal date?
Name one person in the vendor register, usually the tool's business owner, with procurement as backup.
Can we cancel an auto renewal after the window?
It depends on the contract and applicable law, so check with your legal team. Do not assume you can.
Last reviewed: 19 October 2026.
