Ask a compliance automation vendor how it collects each piece of evidence, which access it needs, whether your auditor can work inside it, what you can export, and what happens at renewal. Written answers to those five areas will tell you more than any live demo, and they give you something to compare.
Evidence questions
- For my stack, which controls are tested automatically and which need manual input? Ask for the list, not a percentage.
- How is each automated test run, and how often? Hourly, daily, or only when someone clicks a button?
- Is evidence stored with a timestamp and the source system named?
- What happens when an integration breaks? Do I get an alert, or does a stale green status stay on the dashboard?
- Can I attach my own evidence to a control, and is it versioned?
The fourth question matters most. A connection that silently stops syncing is worse than no connection, because it looks like proof.
Integration and access questions
- What exact permissions does each integration request, and are they read-only?
- Can I limit the integration to specific accounts, projects, or organisations?
- Does the platform store credentials, or use short-lived tokens?
- Is there an integration for the tool I use that is not on the popular list, or an API I can use myself?
Least privilege applies to the tool you buy to monitor your least privilege. If the vendor wants broad write access to do a read-only job, push back.
Auditor questions
- Can my auditor be given read-only access, and what do they see?
- Can samples be requested and answered inside the tool?
- Which audit firms have worked with exports from this platform? You can ask your own auditor whether they have a preference or concerns.
- Does the platform produce the report, or does the auditor? It should be the auditor. A platform cannot issue an attestation.
If a vendor implies it can make you compliant by itself, treat that as a warning. Compliance depends on what you operate, and an independent auditor forms the opinion.
Data and exit questions
- Who owns the data I enter, and in what formats can I export it?
- What happens to my data if I cancel? For how long is it retained, and how is it deleted?
- Can I export evidence with its original timestamps and history?
- Where is data stored, and which subprocessors touch it?
Contract questions
- What is the term length, and what changes at renewal?
- Which items are included and which are separately licensed (additional frameworks, vendor risk, training, security questionnaires)?
- What does onboarding include, and is there a named contact?
Do not ask for a price in the first call. Ask for a full list of what is included, then ask for pricing against that list so you compare like with like.
How to use the answers
Put the vendors side by side in a table with one row per question. Mark any answer you could not get in writing. Then check the gaps against what your team can actually do: a gap in a feature you would never use matters less than a gap in your auditor's workflow.
For the checks that apply to any tool you are about to buy, see vendor security checks before buying SaaS as a startup.
Where Safeguard fits
Safeguard provides compliance and evidence automation as part of its platform. If you want to test how evidence for your code dependencies looks, the free scan at gold.safeguard.sh/scan needs no setup.
Quick check
Should I ask a vendor whether it makes me SOC 2 compliant?
Ask instead what it automates and what remains your work. An independent auditor issues the report, not the tool.
What is the single most useful question?
What happens when an integration fails. The answer shows how honest the dashboard is.
Last reviewed: 19 October 2026.
