Before signing for an application security tool, procurement should confirm six areas in writing: how the vendor may use your data, its own security duties, service levels, how cost changes at renewal, how you can terminate, and what you can export. Most regrets trace to terms nobody read before the pilot turned into a rollout.
Data use
- Does the contract allow the vendor to use your code or findings to train models or improve products? If so, can you opt out?
- Is customer data segregated, and where is it stored?
- What is the retention period, and how is deletion confirmed after termination?
Vendor security duties
Ask for the vendor's own assurance documents, such as an independent audit report if they have one, and read the scope and the period covered. Note whether a report is complete or in progress. Check breach notification timing and the right to receive a summary after an incident. Request the subprocessor list and a notice process for changes.
Service levels
- What availability is promised, and what remedy follows a miss?
- What are support hours and response targets by severity?
- What happens to your pipelines if the service is unavailable? Confirm in the product settings whether checks fail open or closed.
Cost behaviour
Do not bury this one. Understand the pricing unit, whether it is developers, repositories, scans or something else, and how the unit is counted. Ask what happens if usage grows by half in a year, whether there is a cap on renewal increases, and what happens to unused volume. Compare these in a table across vendors using the same assumptions.
Termination and exit
- Notice period and auto-renewal terms, with the date in your calendar.
- Right to terminate for repeated service level failure or a security incident.
- Export of findings, inventories, policies and audit logs in open formats.
- A fixed period during which data stays available for retrieval.
Liability and indemnity
Liability caps often sit well below the cost of an incident. Legal may negotiate, but it helps to know which exposure you are accepting. Do not assume a security vendor's cap is higher than other software vendors'.
Keep a decision record
Store the signed contract, the data flow diagram, the pilot results and the named owner together. At renewal, you will want to compare what was promised with what happened.
Where Safeguard fits: it provides SBOM and dependency scanning, policies and gates, and compliance and evidence automation; the free scan at https://gold.safeguard.sh/scan needs no contract to try.
Quick check
What clause is most often missed?
Auto-renewal notice dates and export rights. Both are easy to forget until they matter.
Should we ask about model training on our code?
Yes. Ask for a clear statement of what the vendor does with your data, and get it in the contract.
Last reviewed: 19 October 2026.
