The short answer
Ask how the product solves your specific problem, who will implement it and how long that takes, how it connects to your systems, how your data is protected, what support you get, what the price will be at renewal, and how you get your data back if you leave. Ask for evidence, not just answers.
Use these as a checklist. Send the ones that matter to you in writing, ask for written answers, and keep them. What a supplier tells you during the sale belongs in the contract if you’re relying on it.
The product
- Can you show us how it handles this specific scenario, using our data or something like it?
- Which customers use it the way we would, and at our size?
- What doesn’t it do well? Where do customers use something else alongside it?
- What’s on the roadmap for the next year, and what isn’t?
Implementation
- Who does the implementation: you, a partner or us? Who will be on the team?
- How long does a typical implementation take for an organisation like ours?
- What do you need from our people, and how many hours a week?
- What usually goes wrong, and how do you handle it?
Integration and data
- How does it connect to the systems we use today? Is that a standard connector, an API or custom work?
- Who maintains the integrations when either system changes?
- How do we get our data in at the start, and how do we get it all back if we leave?
Security and compliance
- Which certifications or reports do you hold, and can we see them? For example ISO/IEC 27001 certification or a SOC 2 report.
- Where will our data be stored and processed, and which subprocessors do you use?
- Who at your company can access our data, and how is that controlled and logged?
- How and how fast would you tell us about a security incident?
Support and service levels
- What are your support hours and response times, and are they in the contract?
- What availability do you commit to, and what happens if you miss it?
- Will we have a named contact after the sale?
Price, renewal and leaving
- What exactly is included in the price, and what costs extra?
- How does the price change as we grow, add users or add volume?
- How much can the price rise at renewal? Can you put a cap in the contract?
- What is the minimum term and the notice period?
- Are there any costs for leaving, and how long do we have to export our data?
References
- Can we speak to two customers like us, without you on the call?
- Can we speak to a customer who has left you?
What should you ask for in writing?
Security evidence, service levels, pricing at renewal, notice periods and exit terms. If an answer matters to your decision and it’s only been said on a call, ask for it by email.
For background on the security documents suppliers mention, see our explainers on Cyber Essentials, ISO/IEC 27001 and SOC 2, or the glossary of buying terms.