Before a security tool pilot starts, put these in writing: scope, what data and access the tool gets, the start and end dates, who owns the results, confidentiality terms, and what happens to your data and settings on the last day. One or two pages is enough. This is a general guide, not legal advice, so have your counsel review it.
The eight items
1. Scope. Name the repositories, environments or systems. "Our codebase" is not a scope.
2. Success criteria. Attach the criteria you agreed. If the vendor will not agree to measurable criteria, note that and decide whether to proceed.
3. Data and access. List what the tool will read, with the narrowest permission that works. For code scanning that is often a read only token on named repositories. Say whether any data leaves your environment and where it is stored.
4. Personal data. If the pilot might touch personal data, ask whether a data processing agreement is needed during the pilot too. Trials sometimes get weaker terms than the paid product, which is the wrong way round.
5. Dates. Start, end, and a check in at the halfway point. Add a rule that access ends on the end date unless both sides agree in writing to extend.
6. Results and feedback. Your findings and your configuration are yours. If you give the vendor product feedback, say what they may and may not do with it.
7. Confidentiality. A mutual confidentiality clause covering your code, your results and the vendor's non public product details. See what to share under an NDA.
8. End of pilot. Data deletion within a stated time, written confirmation, revocation of tokens, and a conversion path if you decide to buy.
Things the pilot terms should not do
- Commit you to purchase.
- Auto convert to a paid term when the trial ends.
- Grant the vendor rights to use your code or findings to train models or for marketing.
- Allow the vendor to name you as a customer.
Who revokes what
On the last day, your side should revoke tokens and remove the integration, not wait for the vendor to do it. Keep a checklist: source control app removed, API keys rotated, SSO connection removed, users deactivated, scan results exported if you want them.
When the vendor offers a standard trial agreement
Read it anyway. Many are fine. The ones to question are those that grant broad rights over your data or that convert automatically.
Try it yourself
Step through the pull request gate and note which permissions it needs, since those belong in the pilot document.
Click through it at your own pace, or open it full screen.
Quick check
Do we need a signed document for a two week trial?
If the tool reads your code or personal data, yes. A short signed document is cheap compared with the cost of an unclear data position.
Who should hold the pilot document?
The technical sponsor and legal, with a copy attached to the purchase record if you buy.
Last reviewed: 19 October 2026.
