SaaS Vendor Due Diligence Checklist

A convincing demo answers whether software can do something. Vendor due diligence asks whether your business can depend on it, operate it and leave it with its data intact.

Research basis: official cloud security guidance and an original ChoiceRidge purchasing worksheet. Sources checked November 2, 2026. This guide does not certify, rank or report hands-on testing of any supplier.

Start with the business process and its failure cost

Write down the workflow the product will own, the data it will hold and the people who will administer it. Separate a tool used to draft optional reports from a system that routes live orders. The second needs a stronger recovery demonstration because a failure can stop work downstream.

Choose the scope before sending a questionnaire. Specify the plan, region, integrations and access model you intend to buy. An answer about an enterprise edition is not evidence that the same capability exists in the entry plan. Assign a business owner who can accept the operational consequences and a technical owner who can verify implementation details.

Use an evidence register instead of a yes/no questionnaire

The NCSC cloud security principles provide a useful foundation for examining a provider and the evidence behind its claims. They cover issues including resilience, customer separation, supply chains, identity and audit information. Provider selection and secure configuration are separate responsibilities.

Our worksheet below translates those concerns into purchasing tasks. Its fields, decision rules and examples are ChoiceRidge editorial recommendations, rather than a certification scheme.

• Requirement: the exact outcome needed, such as exporting tickets with attachments.
• Evidence: a dated document, plan-specific response or reproducible demonstration.
• Scope: the edition, environment and account role to which the answer applies.
• Status: verified, documented but untested, unanswered or failed.
• Owner and next action: who resolves the gap and when the answer is needed.

Keep “unanswered” separate from “failed.” An unanswered requirement is uncertainty to resolve; a demonstrated failure is evidence that the current proposal does not meet it. Neither should silently become a pass.

Six checks to complete before committing

1. Account control and user access

Ask how administrators, ordinary users and integrations receive access. Demonstrate adding a user, restricting their role and removing them. Identify who owns the primary account and how the business regains control if that person leaves. Confirm the actual plan includes the authentication and administration options you require.

2. Data handling and supplier dependencies

List the data categories entering the service and where exports or connected systems send them. Request the provider’s relevant data handling and supplier documentation. Record unresolved questions for the appropriate specialist rather than treating a marketing badge as an answer. Do not upload live customer data merely to discover how a trial behaves.

3. Recovery and business continuity

Separate a provider’s service availability from your ability to recover a deleted record or repair an incorrect bulk update. Ask what can be restored, by whom and with what restrictions. Define how staff will work during an outage and how queued work will be reconciled afterward. A provider backup may not give your administrator a usable record-level restore.

4. Logs, support and incident ownership

Locate the activity history available to your team. Check whether important configuration changes, failed integrations and administrator actions are visible, exportable and retained long enough for your process. Record the support route and escalation contact. Keep response targets separate from promises to resolve an incident within a fixed time.

5. Total cost and commercial assumptions

Build a quote using your expected users, usage, add-ons, implementation work and support tier. Show what changes if volume doubles or a required feature needs a higher plan. Date every price and keep negotiated terms with the decision record. Use the SaaS Cost Calculator to organize assumptions; it does not verify a provider’s quote.

6. Export and exit

Ask for a sample export and inspect its contents before purchase. Check whether identifiers, relationships, files and history survive. Confirm how long you retain access after ending the subscription and whether assistance or extraction has a separate charge. Use our SaaS exit strategy guide to turn the answer into a rehearsal.

Worked example: selecting a helpdesk

Hypothetical scenario: a small commerce team is replacing a shared inbox. Its non-negotiable requirements are restricted agent access, reliable ticket assignment and export of conversations with attachments.

The demo shows ticket routing, but the export contains only ticket summaries. The team records routing as demonstrated and export completeness as failed for the proposed workflow. It asks whether another supported export route includes messages and files, then tests that route with synthetic tickets. A lower subscription price cannot compensate for losing records the business needs.

If the second export works but takes manual steps, the owner can accept that overhead, budget it and assign a review date. If no workable route exists, the team revises its requirement or removes that proposal from the shortlist. It does not average the critical failure away in a weighted score.

Finish with a decision that another person can review

Write one paragraph explaining the intended use, evidence collected, unresolved gaps, accepted tradeoffs and conditions for proceeding. Attach the quote and register. For optional capabilities, use the Software Comparison Scorecard after checking mandatory requirements separately.

Reopen the decision when a major integration changes, ownership changes, a required capability moves plans or the renewal quote materially changes. Assign a review date appropriate to the workflow’s importance. More paperwork is useful only when it changes a decision or makes a responsibility clear.

Sources, method and limitations

The NCSC principles inform the security topics in this guide. The checklist and helpdesk example are an original editorial framework and a fictional scenario. We have not audited a supplier, inspected private assurance reports or verified a particular product’s controls. Specialist contractual or security review may be needed for your intended use.

ChoiceRidge and Vantevion have common ownership. No Vantevion product is evaluated here. Read How We Make Money and our methodology for the site’s editorial and commercial policies.

Explore all software buying guides and research →