Before buying a SaaS tool, ask five questions: what data will it hold, how do users log in, who can see your data on their side, how do they handle incidents, and how do you leave. Match the depth of checking to the data. A scheduling tool needs a glance. A tool holding customer data deserves evidence.
Start with the data, not the questionnaire
Decide what the tool will touch. Public marketing content, internal documents, customer data, credentials and source code sit at very different levels. Most tools do not need the longest questionnaire.
Five questions for any vendor
- Does it support single sign on and enforce MFA?
- Where is data stored, and can you delete it on request or at exit?
- What is the incident notice commitment, in hours or days?
- Do they publish a security page, a recent third party report or a vulnerability disclosure contact?
- Which subprocessors do they use?
Do not accept a logo wall as evidence. A named report, a dated policy or a trust page you can read is better.
What the FTC advises
The FTC small business guidance on vendor security says to include security provisions in contracts, make specific standards non negotiable, and define how vendors may use, share, keep and delete data. It also says not to rely on a vendor's word alone: confirm compliance and consider a third party assessment.
It recommends limiting vendor access to only what is needed and only for as long as needed. It suggests technical safeguards like strong encryption, strong unique passwords and MFA.
Scope the access you grant
Many incidents involve a vendor integration with more access than it needs. When connecting a tool to source control or your identity provider, read the permission screen. Choose read only scopes when possible, and note the integration in your inventory with an owner.
Record the decision
Keep a short note per vendor: data class, checks done, approver, review date. When a questionnaire arrives from your own customer, you will be glad it exists.
Revisit on a trigger
Re-check when the vendor is breached, when you expand what data it holds, or at renewal.
Common pitfalls.
Common mistakes: letting the person who wants the tool decide alone, treating a long questionnaire as proof of safety, and forgetting to check what happens at exit. Ask early how you export your data, how long the vendor keeps it after cancellation and how deletion is confirmed. Also look at who at the vendor can see your data, and under what process. For a small purchase, ten minutes on these points beats an hour on a form.
Keep the same short form for every purchase, so that the work gets faster each time and the records stay comparable.
Quick check
Do we need a SOC 2 report from every vendor?
No. Ask for it when the tool holds sensitive data. For low risk tools, a clear security page and SSO support may be enough.
Sources
Last reviewed: 19 October 2026.
