Questions to Ask a Software Vendor About Security and Privacy

Every new tool your organization adopts becomes a place where your data lives: customer lists, donor records, invoices, messages, files. When you sign up, you are trusting the vendor to protect that information, and the people it belongs to are trusting you to choose carefully.

You do not need to be a security expert to ask good questions. Here is a plain-language list, grouped by topic, with notes on what good answers tend to look like.

Scale your questions to the risk

Not every tool needs the same scrutiny. A design app that never touches personal information needs only a quick check. A donor database, payment platform, client portal or anything holding health, financial or children's information deserves careful review. Decide which category a tool falls into before you start.

Accounts and sign-in

• Do you support two-factor authentication, and can we require it for all users? A good answer is yes to both.
• Can we give people different roles and permissions? You want to limit access by job, not give everyone full control.
• Can administrators remove users immediately and see who has access?
• Is there an activity or audit log showing who changed what?

Our comparison of two-factor authentication methods explains why sign-in security matters so much.

Protecting the data

• Is data encrypted in transit and at rest? In transit means protected while traveling over the internet; at rest means protected while stored.
• Where is our data stored? Some organizations need data kept in particular countries.
• Which of your staff can access our data, and under what circumstances?
• Which other companies process our data on your behalf? Many vendors publish a list of these service providers, sometimes called subprocessors.

Reliability and backups

• How often do you back up our data, and how long are backups kept?
• If we accidentally delete something, can you restore it?
• Do you publish a status page showing outages and maintenance?

When things go wrong

• How and when will you notify us of a security incident that affects our data?
• Have you had significant incidents before, and what did you change afterward? Openness here is a good sign.

Privacy and data use

• Do you sell or share our data with anyone other than the service providers needed to run the product?
• Do you use our data or our customers' data to train AI models? Many vendors now add AI features, so ask directly and look for a clear answer and any opt-out.
• What happens to our data after we cancel, and how is it deleted?
• Will you sign a data processing agreement if our obligations require one?

Independent checks

Some vendors undergo independent security audits, such as a SOC 2 report, or hold certifications such as ISO 27001. These provide outside assurance. Smaller vendors may not have them, which is not automatically a problem; ask what they do instead and look for a published security page.

Getting your data out

• Can we export all our data in a usable format? Our guide to checking exports before you sign up explains what to look for.

Requirements specific to your work

Some situations bring their own rules. Health care providers in the United States, for example, generally need a business associate agreement with vendors that handle protected health information. Organizations that accept cards should make sure payment tools keep card data off their own systems. If you are unsure what applies, ask an attorney or compliance advisor.

How to ask

Vendors answer security questions all the time, so asking is normal and professional. Send your questions in writing, ideally before you sign or during a trial, and ask for links to any published security or privacy pages. A short message works well: explain what kind of data you plan to store, list the questions that matter for that data and ask who to contact with follow-up questions. Keep the reply with your records. If the person you are talking to cannot answer, ask them to connect you with someone who can.

Red flags

• Vague answers, or no answers, to basic security questions.
• No two-factor authentication.
• No clear way to delete your data or export it.
• Unclear or evasive answers about AI training and data sharing.
• Pressure to sign before you can review terms.

Make it part of your process

Record the answers you receive and keep them with the contract. Revisit them yearly or when the vendor announces major changes. Add these questions to every software free trial, and for churches and nonprofits, pair them with our guide to protecting member and donor data. Careful questions now are a quiet way of caring for every person whose information you hold.