Every CIO has a graveyard of SaaS tools nobody uses. You bought them because a demo looked slick, a VP wanted the feature, or the sales rep created urgency with an end-of-quarter discount. Six months later you're paying for seats that sit idle and an integration that never shipped.
Evaluating B2B software isn't about feature checklists from the vendor. It's about the questions the vendor hopes you won't ask. Here's the framework I use before anything reaches a signature.
Start With the Exit, Not the Onboarding
Before you evaluate what a platform does, figure out how you leave it. Vendor lock-in is the tax you pay for skipping this step.
Ask three things up front:
- Can you export all your data in a structured format (not a locked PDF report)?
- Is there a documented API, or just a UI?
- What happens to your data 30, 60, 90 days after cancellation?
If the answer to data export is vague, treat it as a red flag. A confident vendor gives you a JSON or CSV dump and an API to pull it programmatically.
import requests
# A healthy vendor lets you verify data portability BEFORE you commit.
# Ask for trial API credentials and run this against their export endpoint.
resp = requests.get(
"https://api.vendor.com/v1/records/export",
headers={"Authorization": f"Bearer {TRIAL_TOKEN}"},
params={"format": "json", "since": "2024-01-01"},
)
data = resp.json()
print(f"Exported {len(data['records'])} records")
print(f"Pagination cursor: {data.get('next_cursor', 'NONE - full dump')}")
# If this 404s or requires a 'talk to sales' call, you have your answer.
If the export path only exists behind a support ticket and a two-week SLA, assume getting your data out will be painful when it matters most.
Security: Read the Fine Print, Then Ask Harder
A SOC 2 badge on the pricing page means nothing on its own. Ask for the actual report under NDA and read the exceptions section. That's where the interesting stuff lives.
Your security minimums:
- SOC 2 Type II or ISO 27001 with a report you can actually review
- SSO/SAML available without a jump to the enterprise tier that costs 4x
- Encryption at rest and in transit, with documented key management
- Audit logs you can export to your SIEM
- Sub-processor list so you know who else touches your data
The SSO one catches people constantly. Many vendors gate SAML behind an "Enterprise" plan as a pricing lever. If security features are upsells, security isn't a priority for them.
The subprocessor question
Where does your data physically live, and who has access? A vendor that pipes your customer records through five AI subprocessors you've never heard of is a compliance problem waiting to surface during your next audit.
Integration Reality Check
The demo always shows the happy path. Your job is to find where it breaks.
Don't ask "do you integrate with X?" Ask "show me the integration working with test data." There's a large gap between a logo on an integrations page and a stable, documented API.
Check these before you believe any integration claim:
- Rate limits (and whether they'll kneecap your workflows)
- Webhook support for real-time events vs. polling only
- Sandbox environment for testing
- Whether the API is versioned and how they handle deprecation
At MICHAEL AI we build automations on top of these platforms daily. The single biggest predictor of a smooth build is a well-documented, versioned API with webhooks. The single biggest predictor of a nightmare is "we have a Zapier integration" as the only answer.
Cost: Model the Two-Year Number
The sticker price is marketing. The real cost includes:
- Per-seat creep as your team grows
- Usage-based overages (API calls, storage, contacts, whatever meter they spin)
- Implementation and migration fees
- The premium tier you'll inevitably need for the one feature you actually want
Build a spreadsheet that projects total cost at your expected scale in 24 months, not today. Then ask about price protection. A vendor that won't cap annual increases is telling you they plan to raise them.
Vendor Risk: Will They Exist in Three Years?
You're not just buying software. You're betting your operations on a company continuing to run.
Quick due diligence:
- How long have they been in business, and are they profitable or burning runway?
- What's their customer count and churn signal (check G2 review recency)?
- Is support human or a chatbot that loops forever?
- What's the actual SLA, with financial penalties for breaches?
A scrappy startup can be a great bet if the upside justifies the risk. Just make sure your exit plan (see the top of this list) is airtight, because early-stage vendors get acquired or shut down.
The One-Page Scorecard
Run every platform through the same rubric so you're comparing on merit, not on which sales rep was most charming. Score each category 1-5:
- Data portability and exit path
- Security posture and compliance
- Integration depth and API quality
- Total 24-month cost
- Vendor stability and support
Anything scoring below 3 on security or data portability is a hard no, regardless of features. Those two aren't negotiable, because they're the categories you can't fix after you sign.
The best procurement decisions are boring. You did the homework, ran the API against a sandbox, read the SOC 2 exceptions, and modeled the cost curve. No urgency, no fear of missing a quarter-end discount. Just a clear-eyed answer to one question: does this platform earn a place in the systems your business depends on?
Originally published at getmichaelai.com
Top comments (0)