Questions to ask any provider

Please note: This site is only a guide to help people understand. Consult your IT, security and/or privacy department for clarification.

Ask these in writing and keep the answers. Ticking a box here is not saved anywhere.

SecurityWhich independent security audit reports can you share with us?A report from an outside auditor is better evidence than a promise on a web page.What admin and access controls do we get, such as single sign-on and who can see what?You need to be able to add and remove people quickly when staff or volunteers change.How fast will you tell us if our data is exposed in a breach, and how?Some laws and funders set deadlines, so you need to learn about a problem quickly.Can your support staff read our conversations, and under what conditions?People other than you may be able to see what you typed.Can you share your latest SOC 2 Type II report, and which products and dates does it cover?A Type II report tests whether controls worked over a period of time, but only for the system and dates it names.Does your ISO/IEC 27001 certificate's scope include the exact product and plan we would use?A certificate only covers the parts of the company listed in its scope, which may not include the tool you use.

PrivacyHow long do you keep what we type in, and can we change that?Data that is kept longer has more time to be leaked or requested by others.Do you use our inputs to train your models, and how do we opt out?If your inputs train a model, pieces of them could shape answers given to other people.Where is our data stored, and in which countries?Some funders and laws limit where data about your clients may be held.How do we delete our data, and how long until it is really gone?Deleting from your screen is not always the same as deleting from the provider's systems.Will you sign a business associate agreement (BAA) for the plan we would use?If HIPAA applies to you, a vendor needs a signed BAA before it handles protected health information for you.Will you sign a data processing agreement, and where will our data be stored or transferred?If the GDPR applies, the vendor's work must be set out in a contract, and moving data out of the EU needs an approved route, such as an adequacy decision or standard contractual clauses.

CostDo you have nonprofit pricing, and what proof do you need?Discounts can be large, but they often need an application and renewal.How much notice do you give before prices or plan limits change?A tool that fits your budget today may not next year.What costs extra, such as usage limits, extra storage or more admin seats?The per-person price is rarely the whole bill.Is this month to month, or are we locked into a term?A trial that auto-renews for a year can be a surprise on a small budget.

WorkflowsWhat happens to our data and history if we cancel?You want to be able to export your work and know what the provider keeps.Can we export our work in a normal file format?Being able to leave keeps you from being stuck with one tool.Does it work with the apps we already use, such as email, documents and our donor system?A tool that does not fit your daily work often goes unused.What training and support do you offer for staff who are new to this?Good onboarding helps people use the tool safely from day one.