At closing you inherit the target's vendors and the risks that come with them. In diligence, list every vendor that touches customer data or production, check contract terms for change of control, find single points of failure and confirm how each vendor would be replaced.
Build the vendor map
Ask for a register with vendor name, service, data shared, contract end date and owner. Cross check it against cloud billing and single sign on app lists, because teams adopt tools without telling anyone.
Questions per vendor
- What data does it receive, and is any of it personal data?
- Is there a data processing agreement?
- Does the contract allow assignment on a change of control?
- What security evidence does the vendor provide, and how current is it?
- What happens to data at termination?
Look for concentration
One cloud provider is normal. One small vendor that runs authentication, billing or the core feature is a different risk. Ask what happens if it fails or raises prices, and whether an export path exists.
Include open source and AI services
Dependencies are suppliers too. Foundational libraries maintained by one person deserve a line in the register. Likewise, third party AI services that receive customer prompts or code should appear with their data handling terms, which you should read yourself.
Contract points that matter
- Change of control and assignment clauses.
- Data location and subprocessor change notice.
- Breach notification timelines.
- Termination assistance and data return.
After close
Merge the registers, retire duplicate tools and re-review vendors that handle regulated data. Move access reviews onto one calendar.
Safeguard supports vendor discovery and evidence workflows that help build the register.
Spotting shadow vendors
Shadow vendors are tools that teams bought on a card and never registered. Finding them is simple but tedious.
Compare four sources: expense reports, the single sign on application list, cloud marketplace charges and browser extension or OAuth grant lists. Any name that appears in one source but not the register goes on a follow up list.
For each, ask what data it holds. A design tool with public mockups is low risk. A support tool holding customer emails is not. Rank by data, then review the top group the way you would review a formal vendor.
Document what you find and decide at close whether to adopt, replace or remove each one. Removing quickly is usually easier before the two companies merge their tooling.
Quick check
Do we need to review every vendor?
No. Start with those that touch customer data, production or authentication, then sample the rest.
Last reviewed: 19 October 2026.
