Questions to Ask a Software Vendor
For an IT manager, an operations lead, a business analyst running the evaluation, or an owner replacing a system that no longer fits: questions to ask a software company before you sign for its product, whether that is an HRMS, a CRM, an accounting package or a web analytics tool. The 65 questions follow the order a purchase usually takes: product fit first, then what your IT team needs to know about hosting, security and access, then data and integrations, rollout and support, three year cost, and the contract and the way out. Privacy, payroll and contract rules differ by country, so where a note touches them, check the vendor's answer with your own adviser.
Want questions from the whole vault instead? Try the random question generator.
The questions
Each question, and why to ask it
Fit
Which of the features you've shown me are live today, and which are on the roadmap?
Why ask it
Demos routinely blend shipped functionality with prototypes and planned work, and roadmap items slip or get cancelled. Ask for the distinction in writing, and treat anything not yet released as absent when you compare vendors.
Can you show me the workflow that matters most to us, using our data?
Why ask it
Send a sample file a week ahead with the awkward records left in: the part-timer on two contracts, the order with a partial refund. Your own process run through the product shows the gaps a scripted walkthrough steers around, and a vendor who will not attempt it has told you something as well.
In that demo, what was configuration and what would need custom development?
Why ask it
'We can do that' covers both a setting an administrator switches on and a services project with its own invoice. Go through what you saw item by item and have each marked as one or the other, with a price beside anything custom.
Which plan or edition includes everything we saw today?
Why ask it
The account a vendor presents from is usually on the top tier. Go back through the screens you liked and have each one matched to a plan, because the plan named in your quote may not include the feature that won the room.
What do customers like us typically struggle with in this product?
Why ask it
Every product has a known weak area, and a vendor who names theirs and explains the workaround is more trustworthy than one who claims none. Sales engineers are often franker on this than account executives.
If we customise it, do our changes carry through your upgrades?
Why ask it
Fields and workflows built with the vendor's own tools are usually carried forward by each release, while bespoke code can need retesting or rework every time, at your cost. Find out who does that retesting, and whether any customer is stuck on an old version because of what was built for them.
Which of our written requirements does it meet as delivered, which need a workaround, and which does it not meet?
Why ask it
Send the numbered list a week ahead and ask for one of those three answers on every line. A business analyst can then trace each gap back to the process it touches, which holds up better in a steering meeting than an impression of the demo.
Which reports can our own staff build, and which would need your services team?
Why ask it
Have someone on your side build one real report in a trial account with no help: headcount by department in an HRMS, open orders by customer in an ERP. A report that needs the vendor's consultants is a recurring cost and a wait every time the question changes.
What can a user do from a phone, and what only works on a desktop?
Why ask it
Ask to see the app on an actual phone, on the tasks your least desk-bound people do: approving a request, looking up a record, logging a job. A mobile version that only displays data pushes those people back to paper.
Can someone who uses a screen reader or only a keyboard do their work in it?
Why ask it
In software every employee has to use, one screen that cannot be reached without a mouse shuts a colleague out of their own payslip or leave request. Many vendors publish a conformance report you can request. Which standard you are required to meet depends on your country and sector, so check that with your HR or legal lead.
Which countries, languages and currencies does the product support in full today?
Why ask it
'Supported' can mean a translated menu or a complete set of local tax, payroll and reporting rules, and those are far apart. Name every place you operate and ask for a customer running it there. The rules themselves differ by country, so confirm the detail with whoever handles compliance for you locally.
Who is a customer at our size and in our industry that I can call?
Why ask it
A reference from a much larger organisation tells you little about the support and onboarding you would receive. Someone who has been live for at least a year is the one to hold out for, because by then they have been through a renewal, an upgrade and a few bad tickets.
Which customers have left in the past year, and what did they move to?
Why ask it
Where departing customers went matters more than how many left: if they all moved to one competitor, that competitor does something this product does not, and you have just found the bid you are missing. Expect deflection, and note whether you get a name or only a category.
Can we run a paid pilot with a real team before committing?
Why ask it
A short pilot with actual users surfaces problems no evaluation matrix will, and willingness to offer one signals confidence in the product. If the answer is no, ask what the exit terms are in the first ninety days instead.
IT and security
Is the product hosted by you, run in our own cloud account, or installed on our servers?
Why ask it
Each model moves different work onto your IT team: when you host it, patching, backups and upgrades are yours. Find out which model most customers run and whether the others receive the same releases on the same day.
Can we see your most recent independent security audit and penetration test summary?
Why ask it
Which document to expect varies by region and industry: a SOC 2 report, an ISO 27001 certificate, or a scheme particular to your sector. Read the date and the scope before anything else, since a report on another product in the vendor's range does not vouch for the one you are buying.
Is our data encrypted in storage and in transit, and who holds the keys?
Why ask it
Most vendors will say yes to the first half, so the second half is where they differ. Have them explain whether their support staff can read your records, how that access is approved and logged, and whether holding your own keys is possible on the plan in your quote.
Does it connect to our single sign-on, and are accounts created and removed automatically?
Why ask it
Automatic provisioning means a leaver loses access the day IT disables them, with no separate list to remember. Name your identity provider, ask for the setup guide, and check which plan the feature sits on, because it is sometimes held back for the higher ones.
How fine are the permissions, and can we watch an admin edit a role?
Why ask it
In an HRMS, salary, sick leave and disciplinary notes should not be open to every manager with a login, and other systems have their own equivalents. Field-level control and a 'view as this user' check are the two things to look for on that screen.
What audit log shows who viewed or changed a record, and how long is it kept?
Why ask it
When a pay rate or a bank detail changes and nobody remembers doing it, this log is the only witness. Check that it records viewing as well as editing, that your admin can search it without raising a ticket, and that it can be exported.
Who are your subprocessors, and where will our data be stored?
Why ask it
The other companies that handle your records, and the countries they sit in, can change which privacy rules you have to meet and what you have promised your own customers. Get the list, how changes to it are announced and whether you can object to one, then pass it to whoever handles privacy for you.
How often is our data backed up, and when did you last test a full restore?
Why ask it
A backup nobody has restored is an assumption. Two numbers make the answer concrete: how many hours of work could be lost, and how long it would take before your staff could log in again.
What uptime do you commit to, and what happens when you miss it?
Why ask it
A published availability figure without a remedy is marketing rather than a commitment, and service credits are usually small. The figure to compare is the uptime actually delivered over the past twelve months, and whether it sits on a status page anyone can open.
Have you had a breach or serious outage, and how did you communicate it?
Why ask it
A vendor that has been running for some years has probably had one, so what you are judging is how fast customers heard and whether a written account followed. Ask to see the notice that went out or the status page entry for it. A flat 'never' from a company that old deserves a second question.
If our data were exposed, how quickly would you tell us, and is that period in the contract?
Why ask it
Your own deadline for telling customers, employees or a regulator depends on where you and they are, and the vendor's notice has to fit inside it. Get that deadline from your privacy or legal lead before the call, then compare.
Which AI features are in the product, and is our data used to train them?
Why ask it
Find out whether each feature can be switched off for your account and whether records leave the vendor's environment to make it work. Ask for the answer in the data terms, not in an email, since a release note can change what a feature does.
Which browsers, devices and operating systems do you test against?
Why ask it
This is the dullest of the IT questions until a locked-down laptop or an old warehouse tablet cannot open the product. Send your device list ahead and ask what is tested on each release, which is a narrower claim than what ought to work.
How do updates reach us, and can we defer them?
Why ask it
A release you cannot postpone can break an integration or leave your training screenshots out of date overnight. Three details settle it: the length of the warning, whether a test environment gets the release first, and whether that environment is in your price.
Data and integrations
How does this integrate with the systems we already run?
Why ask it
Name each system and its version, then sort the answers into three kinds: a connector the vendor maintains, an API your own developers would build against, or a middleware tool bought separately. A connector that many customers already run is a safer bet than one the vendor offers to build for you.
What does each integration cost to set up, and what does it cost each year after that?
Why ask it
A connector can be a line on the quote, a partner's separate subscription or a services estimate. Get both figures per connection, and ask who repairs it when the system on the other end changes.
For data held in two systems, which one is the master for each field?
Why ask it
If both systems can edit an employee's address or a customer's email, they will disagree sooner or later. Settle which side wins field by field, and have the vendor show what happens to the losing edit.
When an integration fails overnight, who finds out, and how?
Why ask it
A sync that stops without a sound is worse than none, because people go on trusting the numbers. Look for an error queue your admin can open and an alert that reaches a named person. With an HRMS feeding payroll, that is the gap between a quiet fix and a wrong pay run.
What are the API rate limits, and which objects are not exposed?
Why ask it
An integration that passed testing can hit the limit the first time a month-end batch runs, and a record type missing from the API has to be keyed by hand for as long as you own the product. Have your developer read the API documentation before you sign. If there is none to read, that is an answer too.
Who migrates our data, and what usually goes wrong?
Why ask it
On the first half, pin down whether historical records come across, what happens to attachments and audit history, and how long the last few migrations of roughly your size took. The honest answer to the second half is often the state of the customer's own data, and cleaning that is a job you can start this month.
Can we run a trial migration on a sample of our own records before we sign?
Why ask it
A few hundred real rows, the messy ones included, show which of your fields have no home in the new system. Ask what format the vendor needs and whether the test is charged for.
Who owns the data we enter, and what may you do with data about how we use the product?
Why ask it
Look for a line saying your records are yours and the vendor holds them only to provide the service. Usage data and anything derived from it is where terms vary most, so have your lawyer read that clause for what it means where you are.
How would we find, export or delete one person's records if they asked us to?
Why ask it
Privacy laws in many places give employees and customers some right to see or erase what is held about them, and which rights apply depends on where those people are. Have the vendor do it on screen for one test record, then explain what happens to the copies in backups and logs.
Can we get our data out in a usable form, on demand?
Why ask it
An export that produces flat spreadsheets with the attachments and the links between records stripped out is not a way out. Have the vendor run a full export from a test account while you watch, then check whether your admin can do the same without a ticket or a fee.
Rollout and support
What does implementation involve, and how much of it is our work?
Why ask it
Vendors quote their own hours and leave out your staff's time for data cleanup, configuration decisions and testing, which can be the larger share. A useful measure is how long a customer like you took from signature to the day every team was working in it.
Who does the implementation, you or a third party partner?
Why ask it
Reseller and partner-led implementations vary widely in quality, and the vendor may take no responsibility if it goes badly. Find out who you would escalate to when it does.
Who will be our named contacts during implementation, and how many other projects are they running?
Why ask it
A project manager spread across a dozen accounts replies on their timetable and not yours. Ask for names before signing, and for what the vendor does if one of them leaves halfway through.
What should we have ready before kickoff?
Why ask it
Vendors know which customer-side jobs stall a project: a clean data file, agreed approval rules, a named administrator. Having that list before the contract starts lets you begin the slow items while the paperwork is still moving.
Can we go live with one team or one module first?
Why ask it
A phased start limits the damage from whatever testing missed. Ask too whether the licences for later phases can begin when those phases do, so you are not paying for seats nobody can use yet.
How do you define go-live, and what do we sign off before the last implementation invoice?
Why ask it
'Live' can mean one person has logged in or every team is working in the product. Tie it to tasks you can test yourself, and ask whether any payment waits until they pass.
What training is included for administrators and for everyday users, and what will someone hired next year use?
Why ask it
A launch-week webinar does nothing for the person who joins in eight months. Check for recorded lessons and help inside the product, and whether extra live sessions are billed per head or per session.
What support is included in this price, and how fast were first responses last quarter?
Why ask it
Base support is often email only during one time zone's business hours, with anything faster sold separately. A target response time is a promise, while last quarter's median, on tickets of the severity you would raise, is a record.
Who looks after our account once the contract is signed, and can we meet them before then?
Why ask it
The salesperson who answered every email usually hands over to an account or customer success manager carrying many customers. Meeting that person before you sign shows whether what you were told during the sale has reached them.
What administration will this need from us once it's running?
Why ask it
Many products quietly require a part-time internal owner for permissions, configuration and reporting, and that cost never appears in the quote. The reference customer is the best source on this: who does the job there, and how many hours a week it takes.
Cost
What is the total cost for three years, including everything that isn't in the licence fee?
Why ask it
Implementation, training, premium support, integrations, sandbox environments and per-transaction fees can all sit outside the subscription line. One three year figure, itemised year by year, is what lets you put two vendors side by side.
Which services are fixed price, and which are billed by the hour?
Why ask it
A fixed price leaves the risk of an overrun with the vendor, and hourly billing leaves it with you. For hourly work, ask for the estimate, the rate and how the estimate held up on the last comparable project.
What would it cost if we bought only the modules we need on day one?
Why ask it
Bundles look cheaper per module and commit you to things nobody asked for. Price the day-one set alone, then find out what adding a module later costs and whether today's rate would be held.
Who needs a paid seat: approvers, read-only users, people who log in once a month?
Why ask it
An HRMS may be priced per employee whether or not that employee ever logs in, while other tools charge only for the people doing the work. Ask how this vendor counts, since that definition can move the total further than the per-seat rate does.
How does the price change as we add users, records or volume?
Why ask it
Pricing tiers create sudden jumps, and per-seat models get expensive at exactly the point where you can no longer work without the tool. Have the quote rerun at double your current size, and again at half.
What happens if we exceed our seat or usage limits mid-term?
Why ask it
Overage terms decide whether growth is a conversation or an automatic bill. Ask about mid-term true-ups, whether seats can be reduced at renewal, and what happens if your headcount falls.
How much of this quote is a first-year discount, and does it carry into renewal?
Why ask it
A discount that disappears in year two is a price rise on a delay. Ask for the list price, the discount and the basis for the renewal price on one page.
What is the most our price can rise at renewal, and how much has your list price gone up in the past three years?
Why ask it
With no cap in the contract, the renewal price is whatever the vendor's list price has become by then. A cap is easier to win while the vendor still wants your signature than in the month the renewal falls due.
What costs do customers most often fail to see coming in the first year?
Why ask it
Put this near the end of the pricing conversation, plainly. A rep who names storage overages, an extra environment or a paid connector has handed you the lines missing from your comparison sheet.
Contract and exit
Which documents make up the contract, and can we have all of them before the final price discussion?
Why ask it
An order form usually points to terms of service, a data processing agreement, a service level document and policies kept on a web page that can be edited. Collect the full set early so legal review is not squeezed into the last week of the vendor's quarter.
Which contract terms are you able to change?
Why ask it
Liability caps, notice periods, price protection and data terms are frequently negotiable while the standard order form implies they are not. Asking directly tells you how much room exists before you spend legal time.
Can the promises made during the sales process be attached to the order form?
Why ask it
Many contracts state that they are the entire agreement, which can leave emails and slide decks with little weight; your lawyer can say how that works where you are. List the promises you are relying on, roadmap dates included, and ask for them as an appendix.
What notice stops an automatic renewal, and what is the last date we can give it?
Why ask it
Some contracts want notice months before the term ends, a date that is easy to miss when the buyer has moved on to other work. Put it in a shared calendar on the day you sign.
Can we leave early if the product does not do what was agreed, and what would we owe?
Why ask it
The useful detail is what counts as a failure and what follows: a period to fix it, a refund, a right to walk away. How far any of that can be enforced depends on the contract and the law where you are, which is a question for your own lawyer.
What happens to our contract and our price if your company is acquired?
Why ask it
A new owner can retire a product or fold it into a larger one. Ask whether your terms carry over unchanged and whether a sale would give you a right to leave, then see whether the vendor will write either down.
What happens to our data if we leave or if you go out of business?
Why ask it
Three dates belong in the contract: how long after the end you can still download your records, when they are deleted from live systems, and when they are gone from backups. With a small or young vendor, ask as well how long its current funding lasts and whether source code escrow is on offer.
Will you help us move to another product at the end, and what would that cost?
Why ask it
Transition help, such as an export in the format the next system imports or a few weeks of read-only access, is cheap to agree before you sign. After you have given notice, you are asking a favour.
Evaluating a Software Vendor
Practical guidance for the conversation itself
Prepare Before the Demo
Write Down the Three Things It Must Do
A short list of must-haves stops a polished demo from redefining your requirements for you. Everything else is a preference, and preferences should not drive a three year commitment.
Bring Real Data and a Real Task
Ask the vendor to walk through the specific process that is painful today, using a sample of your own records. This is the fastest way to find the workaround you would live with daily.
Include the People Who Will Use It
Software chosen only by managers tends to be quietly abandoned by the team expected to use it. Put two eventual users in the demo and let them ask their own questions.
Compare Total Three Year Cost, Not Monthly Price
Build one table per vendor covering licence, implementation, training, integrations, support tier and internal staff time. Differences in monthly price often reverse entirely at the three year line.
Fitting the List to Your Purchase
Split the Groups Among the People Who Can Check the Answers
Fit belongs to the people who will use the product every day, IT and security to whoever runs your systems, Data and integrations to the owners of the tools it has to connect to, Rollout and support to the project lead, and Cost with Contract and exit to whoever signs. One person asking all six groups ends up nodding at answers they have no way of testing.
IT Questions for an HRMS or Payroll Vendor
An HR system holds salaries, bank details, identity documents and sometimes health information, so the IT and security group carries more weight than it would for a project tracker. Add three checks of your own: which roles can see pay, how the feed to payroll or the bank is secured and reconciled, and where employee data is stored for each country you employ people in. Payroll, tax and privacy rules differ by country and sometimes by state, so ask the vendor how the product handles yours and confirm it with your payroll provider or adviser.
If You Are the Business Analyst on the Project
Your work with the vendor is turning requirements into answers that can be compared. Number each requirement, send the list ahead, and record every reply as meets, meets with a workaround, needs custom work or does not meet, with the name of the person who said it. Bring the process owner to the demo for the gaps, since they are the one who decides whether a workaround is tolerable.
Before Selecting a Web Analytics Tool
Most of the list applies as written, and a few points sharpen. Under Data and integrations, find out whether reports are built on every visit or on a sample, whether you can export the raw event data, and how long history is kept on the plan in your quote. Under Cost, a price set by pageviews or events means one busy campaign can move you up a tier. Consent and cookie rules differ by country and sometimes by state, so have the vendor show how the tool behaves when a visitor declines tracking, and check that against your own privacy advice.
For a Renewal, Start at the Back
If you already run the product, skip most of Fit and open with Cost and Contract and exit. You hold your own record of outages, slow tickets and price rises by now, so the vendor's account of those matters less than it did the first time round.
Sequences That Work
Testing the Fit
- 1Which features are live today versus on the roadmap?
- 2Can you run our workflow with our data?
- 3What do customers like us struggle with?
- 4Who at our size can I call?
Testing the Commercials
- 1What is the three year total, itemised?
- 2How does the price change as we grow?
- 3What is the most the price can rise at renewal?
- 4Which contract terms can you change?
Testing the Exit
- 1Can we export everything, on demand, without a fee?
- 2What happens to our data after cancellation?
- 3What notice do we have to give, and when?
Common Pitfalls
Buying the Roadmap
Committing on the basis of features due next quarter leaves you paying for something that may never ship. Score vendors only on what you could use next week.
Letting the Evaluation Run Out of Time
An end-of-quarter discount shortens the time you have to check anything, and it is often still on offer the following week. If a price expires in forty eight hours, that is information about the vendor.
Ignoring the Cost of Leaving
Data that cannot be exported cleanly turns every renewal into a foregone conclusion. Establish the exit route before you migrate anything in.
Skipping the Reference Call
Fifteen minutes with an existing customer can change a decision, particularly on support quality and how the implementation really went. Ask them what they wish they had known.
Forgetting Who Will Administer It
A product with no internal owner drifts: leavers keep their logins, roles pile up, and nobody remembers why a setting was changed. Name the person before you sign.