Key takeaways
- Cover security, privacy, reliability, integration and exit before signing
- Ask where data is stored, who can access it and whether it trains AI models
- Get answers in writing and put key commitments in the contract
Security
- Is data encrypted in transit and at rest?
- How is administrative access to production systems controlled and logged?
- What security testing is performed, and how often?
- How are vulnerabilities reported and fixed?
- What independent attestations exist, and which are in progress?
Privacy & data
- Where is data stored and processed?
- Which sub-processors are used?
- How are data subject requests (access, correction, deletion) supported?
- Is our data used for any purpose beyond providing the service, including AI training?
- What are the retention and deletion practices?
Reliability
- What availability commitments are made, and how are incidents communicated?
- How often are backups taken and restores tested?
- What are the recovery time and recovery point objectives?
- How are updates scheduled around academic peaks?
Integration & exit
- Which integration methods are available (API, webhooks, exports)?
- Does it support our identity provider for single sign-on?
- Can we export all our data in open formats at any time?
- What assistance is provided if we leave?
Frequently asked questions
Which cloud question matters most?
Data protection and exit: where data is stored, who can access it and how you get all of it back if you leave.
Should answers be in writing?
Yes. Ask for written answers and put key commitments into the contract.