The SaaS Stack Checklist
Use these questions before you sign with any business software vendor. They cover the places where costs and risks usually hide: pricing, security and compliance, integrations, contract terms and rollout. The checklist is based on common procurement and security practice, not on any one vendor.
Keep a copy and get updates
Leave your email and we'll send occasional software buying guides. Free, unsubscribe anytime.
1. Pricing traps
List prices rarely match the invoice. Ask these before you compare plans side by side.
Is the advertised price billed annually or monthly?
Many pricing pages show the per-month equivalent of an annual commitment.
What counts as a billable seat, contact, record or credit?
Usage metrics differ between vendors, so the same team can cost very different amounts.
Which features you need sit only in a higher tier?
SSO, audit logs, API access and advanced permissions are often reserved for upper plans.
Are there onboarding, implementation or premium-support fees?
One-off and support fees can outweigh the first year's licence.
What happens when you exceed a limit?
Check whether overages are billed automatically, throttled or force an upgrade.
Is the introductory discount tied to a longer term or a renewal price?
First-year discounts often disappear at renewal.
Are taxes, payment-processing or transaction fees extra?
Commerce and payments tools may add per-transaction charges on top of the plan.
2. Security and compliance (SOC 2 and beyond)
Ask for evidence, not marketing claims. Most vendors share reports under NDA through a trust center.
Does the vendor have a current SOC 2 Type II report, and what period does it cover?
Type I checks control design at one point in time; Type II tests controls over a period.
Which trust services criteria are in scope?
A SOC 2 report may cover security only, or also availability, confidentiality, processing integrity and privacy.
Is the product you will use actually in the audit scope?
Reports sometimes cover only part of a vendor's platform.
Do they hold ISO/IEC 27001 or sector certifications you need (e.g. HIPAA support, PCI DSS)?
Regulated data needs specific commitments, often a signed agreement such as a BAA.
Is SSO (SAML/OIDC) and SCIM provisioning available on your plan?
Central sign-in and automatic deprovisioning reduce account sprawl when people leave.
Where is data stored and processed, and who are the sub-processors?
Data residency and sub-processor lists matter for GDPR, customer contracts and audits.
Will they sign a data processing agreement (DPA)?
A DPA sets out processing purposes, security duties and breach-notification terms.
How are encryption, backups and incident notification handled?
Look for encryption in transit and at rest, tested backups and a defined notification window.
3. Integrations and data
A tool that can't exchange data with the rest of your stack creates manual work.
Are the integrations you need native, or do they rely on a third-party connector?
Connector-based integrations can add cost, delay and another vendor to manage.
Is there a documented public API, and on which plans?
API access and rate limits often vary by tier.
Does it support webhooks or event streams?
Real-time events avoid polling and keep systems in sync.
Can you export all of your data in a standard format at any time?
Easy export protects you if you switch vendors.
How does it handle duplicates, field mapping and sync conflicts?
Two-way syncs fail quietly when ownership of a field is unclear.
Is there a sandbox or test environment?
Testing integrations away from live data reduces risk during rollout.
4. Contract terms
Read the order form and master agreement before you sign, not at renewal.
Does the contract auto-renew, and what is the cancellation notice period?
Notice windows of 30 to 90 days before renewal are common and easy to miss.
Is there a cap on price increases at renewal?
Without a cap, renewal pricing is at the vendor's discretion.
Can you reduce seats or downgrade mid-term?
Many contracts allow increases but not decreases until renewal.
What uptime does the SLA promise, and what are the remedies?
Service credits are usually the only remedy, and often must be claimed within a set time.
How and when is your data returned or deleted when you leave?
Agree on format, timeline and certification of deletion up front.
What are the liability caps and indemnities?
Caps tied to fees paid may be low compared with the impact of a data incident.
Who can change the terms, and how are you notified?
Online terms that change unilaterally can alter your obligations mid-contract.
5. Rollout and adoption
Software only pays off if your team uses it.
Who owns the tool internally after purchase?
A named owner keeps configuration, access and renewals under control.
What does onboarding include, and how long does it take?
Ask for a written plan with milestones rather than a promise.
Can you run a time-boxed trial or pilot with real workflows?
A pilot with your own data reveals gaps a demo won't.
What will you measure to decide whether the tool worked?
Agree success criteria before rollout so the renewal decision is based on evidence.
This checklist is general guidance, not legal or security advice. Check vendor documents and, for contracts or regulated data, ask your legal or security adviser.