A cloud software buying checklist should fit on one page. Before you pay for any online tool, ask five things. Where will our data sit? Can we take it out? What happens when the service goes down? Who has checked its security? How do we leave if it stops working for us?
Small firms often pick software by price and screenshots. The contract is read last, if at all. That order is backwards. A tool you cannot leave or recover your files from costs more than its monthly fee. The five checks below take about an hour. They are worth doing for payroll, accounting, customer records and file storage.
1. Ask where your data will be stored
Ask the vendor which countries hold your data and your backups. A sales page may say only "the cloud". Get a straight answer in writing.
Location matters because rules follow the data. Singapore's Personal Data Protection Act says an organisation that moves personal data out of the country must make sure the receiving party gives it a comparable standard of protection. If your customers are in Singapore, the Act covers the names and contact details you store, even when the servers are abroad.
Also ask who else can see the data. Does the vendor use sub-contractors? Does it tell you before it changes data centres? A good vendor answers these in a plain list.
Sources: Personal Data Protection Commission Singapore, Advisory Guidelines on Key Concepts, chapter on the Transfer Limitation Obligation (revised 27 July 2017), pdpc.gov.sg.
2. Check that you can export your data
Test the export button before you buy. Most vendors give a free trial. Add a few sample records, then export them. Look at the file. You want a common format such as CSV, not a locked format that only the vendor can open.
Then read the contract for three points. Do you own the data you put in? Is there a fee to export it? How long do you have to download it after you cancel? Thirty days is common. Some vendors delete files sooner. If the contract is silent, ask by email and keep the reply.
Keep your own copy as well. Export key files each month, even when all is well. A backup you never use is cheap. A lost customer list is not.
3. Read the uptime promise closely
Vendors often quote uptime as a percentage. A figure of 99.9 percent sounds near perfect. Over a month, it still allows about 43 minutes of downtime. A figure of 99 percent allows more than seven hours. Do the sum for your own business. Could you cope with that gap on your busiest day?
Ask how the vendor measures uptime and whether planned maintenance is left out. Ask what you get if it misses the target. Many agreements offer only a small service credit, not a refund for lost sales.
Check for a public status page too. A vendor that posts past outages openly is usually easier to trust than one that says it never has any.
4. Look for security certificates you can verify
A security certificate is an outside check that a vendor follows set rules. It does not promise that nothing will ever go wrong. It does show that someone independent looked.
Three names come up often. ISO/IEC 27001 is an international standard for managing information security. The 2022 edition was published on 25 October 2022, and firms certified to the older 2013 edition get a three-year transition. So ask which edition a vendor holds and when its certificate runs out.
SOC 2 is a report from a licensed accountant under the American Institute of CPAs framework. It covers areas such as security, availability and confidentiality. A Type 1 report looks at controls on one day. A Type 2 report tests them over a period of months, so it tells you more. Ask for the report and read the scope and any noted exceptions.
In Singapore, the Cyber Security Agency launched the Cyber Essentials and Cyber Trust marks on 29 March 2022. Cyber Essentials is aimed at smaller firms and covers basic hygiene. Cyber Trust is a higher level for firms with greater risk. Both are voluntary, and they certify the organisation's practices, not a single product.
Whatever the badge, check the certificate number and the issuer. Ask what it covers. A certificate for one office does not cover the product you are buying.
Sources: ISO/IEC 27001:2022 transition notes at cloudsecurityalliance.org; AICPA SOC suite of services at aicpa-cima.com; Schellman, SOC 2 Type 1 and Type 2 overview (2015), schellman.com; Cyber Security Agency of Singapore press release, 29 March 2022.
5. Agree the exit terms before you sign
Plan the exit on day one. Ask what notice you must give. Check whether the contract renews on its own, and how far ahead you must cancel to stop it. Auto-renewal on an annual plan is a common trap for small firms.
Ask how the vendor helps you move. Will it hand over data in a usable format? Will it keep your account open for a short period while you switch? Is there a charge for that help? Write the answers into the contract if you can.
Finally, ask what happens if the vendor is sold or closes. You cannot control that. You can make sure your data is exported and your login details are recorded somewhere you control.
A one-page checklist to print
Copy these lines into a note and tick each one before you sign. Data: countries named, sub-contractors listed. Export: tested in the trial, format open, no hidden fee. Uptime: percentage converted to hours, status page found, credit terms read. Security: certificate or report requested, edition and scope checked. Exit: notice period, auto-renewal, hand-over help and deletion date all in writing.
If a vendor will not answer two or more of these in writing, treat that as your answer. Plenty of others will.
Sources: https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/the-transfer-limitation-obligation---ch-19-(270717).pdf; https://cloudsecurityalliance.org/blog/2023/03/15/how-to-prepare-for-iso-iec-27001-2022; https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services; https://www.schellman.com/blog/2015/06/soc-2-type-1-type-2-overview/; https://www.csa.gov.sg/news-events/press-releases/csa-launches-new-cybersecurity-certification-programme-to-recognise-enterprises-with-good-cybersecurity-practices/