Before buying an SCA tool, ask how you would leave. Confirm you can export findings, SBOMs, suppression decisions, policies and audit history in open formats, and that the contract says what happens to your data after termination. Lock-in rarely shows up on day one. It shows up at renewal.
Why exit planning belongs in the evaluation
Switching tools is common as teams grow or needs change. The pain is not the new setup. It is losing the history that explains past decisions: why a finding was accepted, who approved an exception, when something was fixed.
If that history lives only inside one vendor's database, you will either start over or keep paying to look at it.
What to export
Check each item against a real export, not a brochure.
- Findings with status. Open, fixed, suppressed, accepted, with timestamps.
- Suppression and exception records. Reason, approver, expiry date.
- SBOMs. In standard formats, for every project, with history if possible.
- Policies and rules. Ideally in a readable form that you could recreate elsewhere.
- Audit logs. Who did what and when.
- Configuration. Which repositories, branches and schedules were scanned.
Ask whether exports are available through an API, in bulk, and without extra charge.
Check the formats
Open formats help. SBOMs in CycloneDX or SPDX can be read by many tools. Findings in a documented JSON or CSV structure can be loaded elsewhere. Vulnerability exploitability statements in a standard exchange format are useful too, because they carry your no-impact decisions with them.
Proprietary exports are not necessarily a dealbreaker, but find out how hard conversion would be. Ask a team that has left what it was like.
Contract questions
- What is the data retention period after termination, and how do I request deletion?
- Will you provide an export during the notice period?
- Are there any fees for export or for a final read-only period?
- Does the agreement restrict using exported data with another tool?
Reduce lock-in yourself
Some protection is in your control. Keep policies as code where the tool allows, so rules live in your repository. Store SBOMs in your own artifact storage as well. Track exceptions in your ticketing system too, with a link back, so decisions survive a tool change. Avoid building workflows that only make sense inside one interface.
Test the export in the trial
Do it before you sign. Export your trial data, open it, and see whether another person could understand it without the vendor present. An hour of checking now is worth more than a clause later.
Where Safeguard fits: Safeguard provides SBOM and dependency scanning, and you can try it first with the free scan at gold.safeguard.sh/scan. Ask about exports during any evaluation, as you would with any vendor.
Quick check
What is the most commonly lost data when switching?
Suppression and exception history. It records your reasoning, and it is the hardest part to recreate from scratch.
Last reviewed: 19 October 2026.
