Approving a new SaaS tool: a 10 minute security checklist

To approve a new SaaS tool quickly, answer six questions: what data goes in, how people sign in, what permissions it asks for, whether you get logs, how you leave, and who owns it. If any answer is bad for the data involved, escalate to a fuller vendor review instead of approving.

Why a short path matters

If approval takes weeks, teams sign up anyway with a company card and a personal login. That is how shadow tools appear. A ten minute path for low risk tools keeps people inside the process, and saves the heavy review for the tools that need it.

The six questions

1. What data will go into it? Public or marketing content is low risk. Customer data, personal data, credentials, source code or financial records are not. Data class decides everything else.
2. How do people sign in? Look for single sign on through your identity provider and multi factor authentication. If the tool only offers passwords, it needs a password manager and a note in the record.
3. What access does it request? For tools that connect to email, drive, source control or cloud accounts, read the permission screen. A scheduling tool that asks for full mailbox control is asking for too much. Prefer read only and narrow scopes.
4. Can you see what happens? An exportable audit log is the minimum for anything holding sensitive data.
5. How do you leave? Can you export your data in a normal format and delete the account and data on request?
6. Who owns it? A named person who will remove access when staff leave, and who will review it each year.

Quick red flags

• No clear company behind the product, or no contact for security reports.
• No published information on where data is stored.
• A free tier that trains on or reuses your uploaded data, where the terms allow it.
• Wants an administrator login to a system it does not need to administer.
• An AI feature that sends your content to other parties without a clear statement of what happens to it. Read the data terms for the specific plan you are buying.

Decide and record

Outcomes: approved, approved with conditions such as no personal data, or needs full review. Write the answer, the owner and the date in a register. That register is also what you consult when a vendor reports a breach, so you can see quickly whether you were affected.

Safeguard's vendor and trust features can hold this register, but a shared sheet is enough to begin with.

Review the register once a year. Tools get abandoned, owners leave, and the plans you approved change. Ask each owner whether the tool is still used and still needs the same data. Cancel what is dead, since an unused account that holds old data and has an old administrator is a quiet source of exposure.

Quick check

Last reviewed: 19 October 2026.