On Monday the sales manager finds a tool that would save two hours a day. The demo is smooth, the price is fair and the free trial starts at once. By Friday, customer names, contracts and invoices are inside. Nobody asked where they are stored, who at the vendor can read them, or how to get them out again.
You do not need a procurement department for this. Five questions, answered in writing, cover most of the risk. The whole check takes less than an hour for a typical tool.
Before you start: sort the tool by what it holds
Not every tool deserves the same effort. Decide first which kind of data will go in:
- Low: public or non-sensitive material, such as a design tool used for social media posts. One quick look at the vendor's security page is enough.
- Medium: internal documents, project plans, staff contacts. Ask all five questions.
- High: customer personal data, financial records, credentials, contracts. Ask all five questions and keep the written answers.
If you are unsure, treat it as medium. Moving up later is cheaper than explaining a gap afterwards.
Question 1: Where will our data be stored?
Ask for the country or region of the servers and the name of the hosting provider. Then ask whether the data is copied elsewhere, for example for support or analytics.
Why it matters: the location decides which laws apply and sometimes which customers may legally let you use the tool. If you handle personal data of people in the EU, ask where it is processed and whether the vendor offers a data processing agreement. A vendor who cannot name a region in a simple sentence is giving you an answer too.
Question 2: Who can access it, and how do we control our own users?
There are two sides here.
The vendor's side. Which employees can see customer data, and is that access logged? A good answer is short: only support staff with a ticket, and every access is recorded.
Your side. Can you do the following?
- Turn on two-step verification for all users, not just administrators.
- Give each person their own account and a limited role.
- Remove a person in one step when they leave.
- See a list of who logged in and when.
If the tool only has one shared login, that is a finding in itself. Compare what you see with your new employee access checklist: can every item be done in this tool?
Question 3: What is backed up, and how fast can it be restored?
"We do backups" is not an answer. Ask three specific things:
- How often are backups made, and how long are they kept?
- Are they stored in a different place than the live data?
- How long does a restore take, and have they tested one recently?
Also ask what you can restore yourself. In many tools a deleted item is gone after thirty days, and a vendor-side backup does not help you recover one accidentally deleted customer. Know that limit before it happens.
Question 4: How do we leave, and how do we get our data out?
This is the question most people skip, and the one that matters most when the relationship ends. Ask:
- In which format can we export everything, and is it complete, including attachments and history?
- Is the export free, and how long does it take for the amount of data we expect?
- After we cancel, how long does the vendor keep our data, and how is it deleted? Can they confirm in writing?
- What happens to our data if the vendor is sold or closes?
Do not rely on the answer alone. Run a test export in the first week, open the file and check that it is readable. A button that produces an empty file is better discovered on day five than in year three.
Question 5: What happens when something goes wrong?
Ask how you will be told about a security incident and how fast. A reasonable vendor can name a contact, a time frame and a channel. Also check the ordinary side of support:
- Is there a real person to contact, and in which hours and language?
- Is there a public status page showing past outages?
- What response time is promised for a serious problem, and is it in the contract or only on the website?
Look at the status page history. Three outages in a month tell you more than any promise.
Where to find the answers
Start with the vendor's own documents: security page, privacy policy, terms of service, data processing agreement and status page. Whatever is missing, send as a short email with the five questions and ask for a written reply. The speed and clarity of the reply is also a signal. If a vendor needs three weeks to describe backups, support will probably be similar.
Keep the check light. A certificate or an audit report from the vendor is useful, but it does not replace your questions: it says how the vendor runs its own systems, not whether the tool fits your use.
Record the result on one page
For each tool, keep a single page:
| Item | Entry |
|---|---|
| Tool and owner | Name of the tool and the person responsible |
| Data kept inside | Low, medium or high, with examples |
| Answers 1–5 | One line each, with the date and where the answer came from |
| Open points | What was not answered and who follows up |
| Review date | When to look again, usually after a year |
The owner is a person, not a team. When the tool changes its terms or has an incident, that person is the one who reads the notice.
Common mistakes
- Starting the trial with real data. Use sample records until the questions are answered.
- Checking only the price. A cheap tool without an exit costs more than an expensive one with a clean export.
- Trusting the marketing page alone. Ask for the answer in an email or a contract.
- Forgetting the departing staff. The account of someone who left last year is still a way in.
- Never reviewing. Terms, owners and data locations change. Put the review date in the calendar.
How to start
- List the tools your team has adopted in the last year and mark which hold medium or high data.
- Take the most important one and send the five questions this week.
- Run a test export and a test restore of one item.
- Fill in the one-page record and name the owner.
- Use the same list before the next purchase, and share the page with whoever signs the order.
Summary
Adopting a tool means handing it a part of your business. Five questions about data location, access, backups, exit and support take under an hour and turn a hopeful decision into an informed one. Write down the answers, test the export early and set a review date. If an incident ever comes, the post-incident review will start from facts, not guesses.
Sources
- Our related articles linked above.
- The questions are common practice for small companies and are offered as a practical guide. They are not legal advice or a compliance audit. No client results or market figures are claimed in this article.
