In this guide 6 sections
Put six questions to each vendor. Where does your data physically sit? Which of their staff can see it? Which sub processors touch it? What is deleted when you leave? How quickly do they report an incident, and what export format do you receive? Record the answers in a processor register, one entry per vendor.
Where does the data sit and who can see it?
Ask for the hosting country and the cloud provider by name, because a CRM that says “secure cloud” has told you nothing at all. A reply naming a region such as Mumbai or Frankfurt and a provider such as AWS can be checked, compared with the contract and written down.
Then ask about people. Can support engineers open your customer records, and is every such visit logged with a name and a reason? Does a ticket from you open the door, or can anyone on the vendor’s team browse?
A good vendor answers in a sentence or two. A vague reply is itself information, and it should go into your notes beside the date.
- Hosting country and cloud provider
- Roles inside the vendor with access to your records
- Whether support access needs your approval
- Whether access is logged and reviewable
- Encryption at rest and in transit
Which sub processors are involved?
Most software vendors rely on other companies, such as an email sender like SendGrid, an SMS gateway, a payment processor and an analytics script. Each one may receive your customers’ details. Get the full list in writing.
Find out how they warn you of a new addition. Some vendors publish a changelog page and email subscribers before the change takes effect. Others alter the list quietly, and you learn about the new party only from a breach notice months later.
Check where those sub processors are located too. The chain is only as careful as its weakest link.
What happens to the data when you leave?
This question matters most and gets asked least. What can you export, in which file format, and how long does the export take? A CSV of contacts with the notes and tags attached is useful. A proprietary dump that only their own software can read is a lock.
Get deletion terms in writing. When your contract ends, how many days pass before your records leave their live database, and how long do backups keep them?
Request a deletion confirmation as well. You will want something to file.
- Export format: CSV, JSON or SQL dump
- Time from request to export
- Days until live data is deleted
- Backup expiry period
- Written confirmation of deletion
How fast will they tell you about an incident?
You want a stated notification window and a named channel. An email to a role mailbox beats a banner on a status page that nobody refreshes. Confirm who at your end receives the message, and check that this person still works for you.
Ask about their last incident. Vendors that have handled one usually describe what they changed afterwards. A vendor claiming none has ever happened deserves a second look.
Also find out what they hand over during an incident: access logs, the list of affected records, a timeline of events.
Write the answers into a processor register
Create one row per vendor. Record the data they hold, the purpose, hosting location, sub processors, deletion terms, incident window, export format and renewal date. Date the entry. Name the person who asked the questions, so that a later reader knows whom to call.
Compare the answers against the signed contract. If the contract says one thing and the account manager said another, ask for the contract to be amended before you renew.
Run the questions on your existing vendors first, starting with whichever holds the most customer records.
Vendor question sheet and processor register
A two-part one-page worksheet. The top half lists the six questions, each with a blank answer line. The bottom half is a register row with columns for vendor, data held, purpose, location, sub processors, deletion terms, incident window, export format, renewal date and reviewer.
Open a blank worksheet to printQuestions owners ask
Which vendors should I ask first?
Begin with the ones holding the most customer records or the most sensitive details. That usually means the CRM, billing system, payroll provider, marketing email tool and web host.
What if the vendor will not answer?
Note the refusal in the register. A vendor unwilling to describe where your data sits or how it is deleted is a risk to weigh before you renew.
Is a vendor’s security certificate enough?
A certificate helps, but it does not answer your questions about deletion, export or notification speed. Ask those separately and keep the replies.
How often should we repeat these questions?
Once a year and at every renewal. Repeat sooner when the vendor changes ownership, hosting provider or sub processors.