How to audit a SaaS vendor's security and continuity claims

A vendor claim becomes useful when you can name the evidence, its date, and who owns the next test. Encrypts data, backs up daily, and follows best practices are starting points. They are not yet answers.

Check ownership before security paperwork

A buyer can survive a vendor change only if the buyer controls the accounts that keep the product alive. Check the domain registrar, DNS, cloud billing, repositories, app stores, email provider, analytics, payment account, backup destination, and recovery contacts.

Do not accept a shared spreadsheet of passwords as ownership. The buyer should have named administrator accounts, MFA, recovery access, and billing control. The vendor can keep the access needed to operate the system, but it should not be the only party able to recover it.

A backup claim needs a restore

A successful backup job proves that a job wrote something. It does not prove that the data can rebuild the product within the time the business expects. Ask for the last isolated restore date, duration, errors, data checks, and the person who signed off.

Claim: Daily backups are recoverable
Evidence supplied: Job history, 30 days
Restore result: Not supplied
Status: Needs evidence
Next test: Restore latest backup into isolation
Pass condition: App starts, record counts match, owner signs result

Keep Needs evidence separate from Failed. The vendor may have a valid restore record in another system. The finding stays open until that record is inspected or the test is run.

Trace data instead of reading one policy

A privacy policy describes intent. A data-flow map describes the product. Pick one user action, such as uploading a support attachment, and trace where the data enters, which service receives it, where it is stored, which region holds it, who can access it, when it is deleted, and what remains in backups.

Repeat the trace for authentication, payments, analytics, support, email, and AI features. This catches vendors that are missing from the policy and retention promises that have no deletion job behind them.

Inspect AI tools as permissions

An AI feature is not only a model choice. List what the agent can read, write, approve, spend, delete, or send. Check whether values such as refund amount, recipient, and record ID are constrained by server-side policy or copied from model output.

• Require human approval for high-impact actions and unusual amounts.
• Use least-privilege tools instead of one broad administrator token.
• Log the user request, model action, tool input, result, and approver.
• Test prompt injection through every untrusted input the agent reads.
• Keep a kill switch that does not depend on the agent working correctly.

Make the exit plan executable

Ask the vendor to show how the buyer would export data, deploy the current version, rotate vendor credentials, change billing, and contact users during an incident. A contract clause promising handover is useful. A dated runbook and a buyer-owned account are stronger evidence.

List the people and services whose disappearance would stop recovery. A bus factor of one, an undocumented deployment, or a backup stored in the vendor's account belongs in the continuity section even when the product is secure against external attackers.

Record each claim the same way

1. Copy the exact claim and where the vendor made it.
2. Name the evidence required to support it.
3. Record what was inspected and the date.
4. Choose Observed, Needs evidence, Not applicable, or Failed.
5. Set severity from business impact, not from how hard the fix looks.
6. Write the next test or fix and assign an owner.

Know when to bring in a specialist

Use a qualified penetration-testing firm for a dedicated attack simulation. Use the relevant certification or assurance provider when procurement requires a formal attestation. Use counsel for legal interpretation. A vendor security and continuity audit can organize the evidence and reveal which specialist job is actually needed.

Start with the five claims that would hurt most if false. Put them into the record above, then compare your gaps with the synthetic sample report. If the decision needs independent evidence, the Deep Audit covers security, recovery, data flows, and dependencies in four days from $999.