Before you sign for a compliance platform, check term length, renewal and notice terms, which frameworks and modules are included, data return and deletion on exit, subprocessors and data location, security and breach notice terms, and what support you actually get. Have counsel read the final paper; this guide only tells you what to look for.
Term and renewal
- Length. Multi year terms can lower cost and increase lock in. Match the term to your certainty about needing the tool.
- Auto renewal. Note the date and the notice period required to cancel. Put both in your calendar the day you sign.
- Change at renewal. Ask whether scope, features, or limits can change at renewal.
What is included
List every framework, module, integration, and seat limit, and have the order form say so. Check:
- Frameworks named in the order, and whether others are available later.
- Limits on users, integrations, or connected accounts.
- Whether vendor risk, training, questionnaires, or trust pages are included or separate.
- Whether an audit support or onboarding service is included.
If a feature was promised in a demo and is not on the order form, it is not part of the deal.
Data and exit
- Export formats and a deadline for return of your data on termination.
- Deletion timeline and a written confirmation.
- Access to your data after cancellation, even read only for a short window, for audit follow up questions. See compliance platform lock in for what to export.
Security and privacy terms
- Subprocessors list and a way to be told when it changes.
- Data location, if you have residency commitments.
- Breach notification time and contact.
- Right to review the vendor's own assurance reports each year.
- Data processing agreement where personal data is involved.
For the general clause list, read security exhibit clauses to ask a vendor for.
Service levels
Ask what happens when an integration breaks or the platform is down during your audit window. Many platforms promise availability but say nothing about support response during fieldwork. Ask for the support channel and hours, and whether you get a named contact.
Do not rely on promises
If a sales rep says "we will not raise the price," ask for it in the contract. If a rep says "we can add that framework next quarter," ask for a written commitment or treat it as unavailable. Roadmap statements are not terms.
Where Safeguard fits
Safeguard provides compliance and evidence automation, SBOM and dependency scanning, and policies and gates. The free scan at gold.safeguard.sh/scan lets you see output before any contract.
Quick check
Is a multi year term a good idea?
Only if you are confident you will use the tool throughout. Otherwise prefer a shorter term with clear exit rights.
Should I show the contract to a lawyer?
Yes. This guide lists topics to look for, not legal advice.
Last reviewed: 19 October 2026.
