Why the questions matter
When you move a business process into a cloud product, the vendor becomes the custodian of that data. Under the Privacy Act 2020, your business is still responsible for personal information it holds, including information held on your behalf by a service provider. If the vendor is careless, your clients' details are exposed and you are the one who has to explain it.
Small businesses rarely have the leverage to negotiate contracts, but they can choose. Asking a short set of questions during evaluation separates products built with security in mind from ones that treat it as an afterthought. It also gives you a record that you took reasonable care, which may matter to insurers, auditors or clients asking about your suppliers.
Sign-in and account control
Ask whether the product supports multi-factor sign-in and whether you can make it mandatory for all your users, not just optional. Ask whether it supports single sign-on with Microsoft Entra ID or Google, so staff use their work accounts and access is removed when someone leaves. Find out whether there are separate administrator roles, so not everyone can change settings or export everything. Ask what audit logs are available to you: can you see who signed in, from where, and who viewed or exported data? If something goes wrong, those logs are how you work out what happened. A product with no customer-visible logs leaves you blind.
Where data lives and who can see it
Ask which countries your data is stored and processed in, including backups and support access. Many products used in New Zealand store data in Australia, the United States or Europe. That can be perfectly acceptable, but you need to know, particularly if clients or contracts set expectations. Ask whether vendor staff can access your data, under what circumstances, and whether that access is logged. Ask about subcontractors too. Most software companies rely on other providers for hosting, email delivery, analytics and increasingly AI features. A reputable vendor will publish a list of these and explain whether your data is used to train AI models, and whether you can opt out.
Protection, backup and breach response
Ask whether data is encrypted while it travels and while it is stored, how often it is backed up, how long backups are kept and how quickly they could restore if their platform failed. Ask whether they hold an independent security certification or audit report, such as ISO 27001 or SOC 2, and whether they will share a summary. Certifications are not perfect, but they show someone outside the company has checked.
Ask how and how quickly they will notify you of a breach affecting your data. You may have obligations to notify affected people and the Privacy Commissioner if a breach is likely to cause serious harm, so you need the vendor to tell you promptly and with enough detail to act.
Getting out again
Ask how you export all your data, in what format, and whether attachments and history are included. Ask what happens to your data after you cancel: how long it is kept, and whether they can confirm deletion. A product that makes exporting hard is a product that will be hard to leave, and price rises are easier to swallow when leaving is difficult. Test the export during your trial rather than trusting the documentation. Export a sample, open it, and check that it contains what you would need to move to another system or satisfy a records obligation.
Weighing the answers
No small-business product will answer every question perfectly, and that is fine. Weigh the answers against the sensitivity of the data. A team lunch-ordering app needs less scrutiny than a client portal holding identity documents. Write the answers down, keep them with your supplier register and revisit them at renewal. Be wary of vendors who refuse to answer, point to a marketing page full of adjectives, or say security is handled by their hosting provider and leave it there. That provider secures the data centre, not the application or how your data is handled inside it.
A useful habit is to keep a short template of these questions and send it to every vendor you shortlist, so answers can be compared side by side. Put the replies in the same folder as the contract and the supplier register entry. When a client or insurer later asks how you vet your software suppliers, you can show them the process and the answers rather than describing it from memory.
In short
- Your business stays responsible for personal information held by a cloud vendor.
- Require enforceable multi-factor sign-in, single sign-on support and audit logs.
- Know where data and backups are stored and whether it is used to train AI.
- Test exporting your data during the trial, before you commit.