Due diligence on a SaaS vendor

Seat price, onboarding, migration, premium support, sandbox environments and overage charges are often quoted separately, and the ones that grow are rarely the ones in the headline.

An uncapped renewal on a product your team has standardised on is a price you no longer negotiate.

Notice periods that expire before you would normally review the contract are how a one-year commitment becomes three.

A pilot that cannot touch real data tests nothing you care about.

A status page with history is a standing, checkable claim. A number in a slide is not.

Marketing pages promise 99.9%; contracts often promise nothing. Where an SLA does exist, the remedy is usually a service credit worth a fraction of your loss — which is worth knowing before rather than after.

Incidents are normal. Published post-mortems tell you whether the vendor learns, and a vendor that writes them is telling you it has an engineering culture that can.

Planned downtime excluded from the SLA can make a poor availability record look spotless.

An ISO 27001 certificate covers a defined scope, which is sometimes a head office and not the product. Certificates are checkable against the registrar; logos are not.

Type I says controls were designed on one day. Type II says they operated over a period. They are routinely quoted as if they were the same thing.

Cadence and independence matter more than the result. A vendor that tests annually with a named third party is making a standing commitment.

These are frequently real but reserved for the top tier, which changes the price you are actually comparing.

It tells you whether a researcher who finds something has somewhere to send it, which is the difference between a quiet fix and a public one.

If the vendor processes personal data on your behalf you need one, and if data leaves your jurisdiction you need a lawful basis for the transfer.

A sub-processor is a supplier you did not choose but remain accountable for. The notice period is what gives you the chance to object.

Regional pinning is often available but not default, and not always for backups and logs as well as primary storage.

Your own regulatory clock starts when you become aware. A vendor's notification timeline sets it.

Deletion from the live system is not deletion from backups, and the gap is usually where the honest answer lives.

An export that requires a support ticket is an export the vendor can slow down at the exact moment you need it fast.

If you build on it, the deprecation notice period is the real measure of how much rework the vendor can force on you and when.

Backups nobody has restored are a belief, not a control.

The contracting entity is sometimes not the company whose brand you are buying, and filing history is free to check.

Ownership changes reset roadmaps, support and pricing. You will not always get an answer, but the way it is declined is informative.

A public changelog with dates is a running record of whether the roadmap you were shown is being built.

Coverage that does not overlap your working day is the most common unpleasant surprise in the first month.

A reference at a different size solves a different problem than the one you are about to have.

Almost no vendor says yes, and the reaction to the question tells you a great deal. Where a vendor does say yes, take it — it is the most useful call you will have.

References are prepared to praise. They are rarely prepared for a specific question about failure, and that is where the useful answers are.