The SaaS Vendor Risk Assessment Checklist for 2026

Every SaaS vendor you onboard is a potential liability. Data access, third-party integrations, uptime SLAs, support quality — all of it becomes your risk when you sign the contract.

Most teams handle vendor risk informally: a quick Google, maybe a SOC 2 checkbox, then an IT ticket to provision the tool. That's not risk assessment. That's risk deferral.

This checklist gives procurement teams, IT leaders, and security stakeholders a structured way to evaluate vendor risk before committing. It's designed to be completable in 1–2 hours using a combination of vendor documentation and AI research tools.

The 6 Dimensions of Vendor Risk

1. Security & Compliance — Can this vendor handle your data safely?
2. Financial Stability — Will this vendor still exist in 2 years?
3. Operational Reliability — Will the product actually work when you need it?
4. Data Practices — What happens to your data, and where does it go?
5. Support Quality — What happens when things break?
6. Contract Risk — Are the legal terms acceptable?

Dimension 1: Security & Compliance

Certifications

• [ ] SOC 2 Type II certified (not just Type I)
• [ ] ISO 27001 certified (required for EU-based teams or vendors handling EU data)
• [ ] GDPR-compliant (DPA available for EU data subjects)
• [ ] HIPAA-compliant (required if handling PHI)
• [ ] FedRAMP authorized (required for US federal contractors)

Access & Authentication

• [ ] SSO (SAML 2.0 / OIDC) supported on your plan tier
• [ ] SCIM provisioning available for automated user management
• [ ] MFA enforced (not just offered) for admin accounts
• [ ] Role-based access controls with least-privilege defaults
• [ ] Audit logs available (user actions, admin changes, data access)

Penetration Testing

• [ ] Annual pen testing conducted by independent third party
• [ ] Results shared with customers on request (or summary published)
• [ ] Bug bounty program active

Data Encryption

• [ ] Data encrypted at rest (AES-256 or equivalent)
• [ ] Data encrypted in transit (TLS 1.2+ minimum, TLS 1.3 preferred)
• [ ] Customer-managed encryption keys available (enterprise plans)

Dimension 2: Financial Stability

Company Health Signals

• [ ] Year founded (>3 years preferred for non-critical tools)
• [ ] Funding stage and last funding round disclosed
• [ ] Revenue or customer count public signals (G2, Crunchbase, LinkedIn employee growth)
• [ ] Named enterprise customers listed (social proof for enterprise-grade stability)
• [ ] No active M&A rumors that could disrupt product roadmap

Business Model Risk

• [ ] SaaS revenue model (recurring, not transactional) — lower shutdown risk
• [ ] Data export available if you need to migrate away
• [ ] No lock-in on proprietary data formats without export path

Dimension 3: Operational Reliability

Uptime & SLA

• [ ] Published SLA with defined uptime guarantee (99.9% minimum, 99.99% for critical tools)
• [ ] Compensation for SLA breaches defined in contract
• [ ] Status page publicly available (status.vendor.com)
• [ ] Average response time for incidents publicly disclosed

Incident History

• [ ] Review last 12 months of incidents on status page
• [ ] Major outages (>2hr P1) in last 12 months: how many?
• [ ] Post-mortems published for major incidents
• [ ] Communication speed during incidents (hourly updates vs. silence)

Disaster Recovery

• [ ] Recovery Time Objective (RTO) documented
• [ ] Recovery Point Objective (RPO) documented
• [ ] Backup frequency and retention period disclosed
• [ ] Geographic redundancy (multi-region) confirmed

Dimension 4: Data Practices

Data Residency

• [ ] Data storage location confirmed (US/EU/APAC)
• [ ] Data residency options available if your compliance requires a specific region
• [ ] Subprocessors list published (and reviewed)
• [ ] Third-party data sharing documented in privacy policy

AI Data Usage

• [ ] Confirm vendor does NOT train AI models on your data (check ToS carefully)
• [ ] AI feature opt-out available if needed
• [ ] AI-generated outputs clearly labeled within the product

Data Retention & Deletion

• [ ] Data deletion timeline upon contract termination documented
• [ ] Customer-initiated data deletion available
• [ ] Data export available in standard format (CSV, JSON)

Dimension 5: Support Quality

Support Coverage

• [ ] Support tier included on your plan (email-only is insufficient for critical tools)
• [ ] Defined SLA for support response time (not just "best effort")
• [ ] Dedicated account manager or CSM for your tier
• [ ] 24/7 support available for P1 incidents

Community & Self-Service

• [ ] Documentation quality: comprehensive? Recently updated?
• [ ] Community forum active (questions answered within 48hr)
• [ ] Video training or onboarding resources available
• [ ] API documentation complete and maintained

Red Flags from Reviews

• [ ] Check G2, Capterra, TrustRadius for support quality ratings
• [ ] Look for "customer support" in 1–2 star reviews specifically
• [ ] Check Reddit for "vendor name + support" threads
• [ ] LinkedIn reviews from CS team employees (morale signals)

Dimension 6: Contract Risk

Core Contract Terms

• [ ] Auto-renewal clause identified (and calendar alert set)
• [ ] Notice period for cancellation confirmed (typically 30–60 days)
• [ ] Price lock duration for multi-year deals documented
• [ ] Acceptable use policy reviewed — does your use case fit?

Liability & Indemnification

• [ ] Liability cap defined (typically 12 months of fees)
• [ ] IP indemnification included (vendor protects you from IP claims)
• [ ] Data breach notification obligation included (72hr standard for GDPR)

Termination Rights

• [ ] Termination for cause rights clear
• [ ] Termination for convenience terms documented
• [ ] Data return/deletion procedure post-termination specified

Risk Scoring: How to Use This Checklist

Assign each item a status: Pass / Fail / Not Applicable / Unknown

Decision framework:

• 0–2 Fails: Proceed with standard onboarding
• 3–5 Fails: Escalate to security/legal for sign-off; negotiate contract changes
• 6+ Fails: Do not onboard without executive approval + compensating controls
• Unknown on Dimension 1 items: Block onboarding until resolved

Automating This Process

Running this checklist manually for every vendor evaluation is unsustainable at scale. Teams evaluating 10+ tools per year should automate the research layer.

Trackr's research pipeline automatically surfaces security signals, support quality sentiment, pricing transparency, and integration depth from public sources — giving you the raw data to complete the intelligence-gathering portion of this checklist in minutes, not hours.

Start your first vendor evaluation →