Several beliefs about buying security tools are common and wrong: that a trial needs no paperwork, that a certificate means the tool is safe, that an NDA covers personal data, that a vendor will accept unlimited liability. Here are seven, with what is actually true. This is general information, not legal advice.
Myth 1: A free trial needs no paperwork
Fact. If the tool reads your code or personal data, terms apply from the first day. A trial often has terms that are weaker than the paid ones, and can convert automatically. See what to put in writing before a pilot.
Myth 2: An NDA protects our data
Fact. An NDA covers disclosure of confidential information. It does not set security standards or handle personal data. For personal data, GDPR Article 28 expects a binding contract with a processor, which is a DPA. See the NDA guide.
Myth 3: A security certificate means the tool is safe
Fact. An audit report or certificate describes a scope at a time. Read the scope, the dates and the exceptions. See how to read a vendor SOC 2 report and checking an ISO 27001 certificate.
Myth 4: The vendor will accept liability for any breach
Fact. Nearly every software contract caps liability. You can negotiate carve outs for data protection and confidentiality, but not usually unlimited exposure. See liability limits in security contracts.
Myth 5: A pilot proves the tool will work for us
Fact. A pilot proves what it tested. A curated demo repository tells you about the demo. Use your own code and success criteria agreed before the start. See pilot, proof of value or proof of concept.
Myth 6: We can leave whenever we want
Fact. Contracts commonly renew automatically and require notice before a deadline. Your export and deletion rights may only exist if you wrote them in. See renewal notice dates and delete or return clauses.
Myth 7: Procurement just slows things down
Fact. Procurement catches duplicate tools, missing vendor registrations, budget gaps and renewal terms. Involve it at shortlist stage, and it speeds the paperwork instead of blocking it.
How to use this list
Pick the three myths your team is most likely to believe and add them to your purchase checklist as questions to answer. For a first look at what a tool finds, a free scan at gold.safeguard.sh/scan on a public repository involves no private data and no contract work.
Sources
Quick check
Is a security certificate proof of safety?
No. It describes a defined scope assessed at a point in time or over a period.
Who should read the trial terms?
Whoever owns the pilot, and legal if code or personal data is involved.
Last reviewed: 19 October 2026.
