If you're the IT lead, CTO, or the founder who handles procurement at a 50-to-500-person Indian company, you've probably signed at least one SaaS contract you regretted. Not because the product was bad. Because three months later you discovered an auto-renewal clause, a price hike you didn't see coming, or a data export that costs extra. The contract said one thing in the deck and something else entirely in the MSA.
The problem isn't that vendors are dishonest. It's that SaaS contracts are written to protect vendors, and most buyers in India are still treating them like software purchase orders rather than multi-year legal commitments. A 100-person company paying ₹15–20 lakh annually across its SaaS stack is exposed to real financial and compliance risk the moment it stops reading past page 2 of the agreement.
This template gives you 30 questions, grouped by category, to run through before you sign anything. Use the ones that feel obvious too. Vendors who've already answered them cleanly will do so in seconds. Vendors who get uncomfortable are telling you something.
Why Most SaaS Contracts Punish You Later
The gap between a sales deck and a master service agreement is where money disappears. Sales reps talk about uptime, support, and flexibility. The MSA talks about scheduled maintenance exclusions, credit caps at 10% of monthly fees, and termination notice windows of 90-to-180 days that must be served before a specific calendar date or the contract auto-renews for another full year.
For a mid-size Indian company, the math on a bad vendor decision compounds fast. A ₹8 lakh annual SaaS contract that auto-renews because your team missed the 30-day opt-out window costs you a full year of fees for a product you've already decided to replace. Add a price increase of 15-20% at renewal (common with US-headquartered vendors responding to rupee-dollar movement), and the original deal looks nothing like year two.
The most expensive SaaS clause isn't the price. It's the auto-renewal opt-out window — often just 15 to 30 days — that closes silently while your team is heads-down on other work.
IT leads and CTOs need to own this evaluation, not just hand it to procurement. Security posture, integration longevity, data residency under India's DPDP Act 2023, and API deprecation risk are technical judgments. Finance can flag the billing structure and GST treatment. Legal reviews indemnity and liability caps. But the person who will live with the vendor's architectural decisions is the one who should be asking the hard questions first.
Watch out: Many Indian companies first encounter data residency friction at audit time, not at procurement. By then, the contract is signed and the data is sitting in a US-East AWS region with no migration path in scope. Add data residency to your pre-signature checklist, not your post-incident review.
How to Use This Template Before Any Procurement Decision
SaaS renewal negotiation timing-3 finalists, the final negotiation before you sign, and at renewal when the vendor's terms may have changed. Each moment has a different use. At shortlist, you're disqualifying vendors with non-starters. At final negotiation, you're getting commitments in writing. At renewal, you're checking whether the deal you signed 12 months ago still reflects reality.
exit terms and liability clauses sections 1 (Security), 2 (Data Residency), and 3 (SLA). Finance owns sections 4 (Pricing) and the GST-related sub-questions. Legal reviews exit terms and liability clauses. The business owner who requested the tool should confirm that the product's data handling aligns with what they promised their own customers.
Score vendors red, amber, or green against each question. A red means the vendor's answer is a contractual dealbreaker or they refused to answer. Amber means you need a written commitment before signing. Green means you're satisfied. Any vendor with more than 3 reds should be disqualified before negotiation starts. If you must proceed, escalate those reds to your legal counsel.
You can compress this to 5 business days without skipping anything meaningful. Day 1: send the questionnaire. Day 2-3: vendor responds. Day 4: review with your team, mark reds. Day 5: send written clarification requests for ambers, and decide your negotiation positions. Most vendors with decent legal and security functions can turn around clean answers in 48 hours if they're serious about the deal.
Run a free SaaS spend audit — find every hidden subscription
Security and Compliance Questions (Q1–Q8)
Security certifications sound more reassuring than they are without context. SOC 2 Type II covers a vendor's controls over a period of time (typically 6-12 months), which is meaningfully better than SOC 2 Type I, which is a single-day snapshot. Always ask which type the vendor holds, and when the audit period ended. A SOC 2 Type II report that's 18 months old is telling you something about how seriously the vendor takes continuous compliance.
- Q1. Do you hold SOC 2 Type II certification? What is the audit period covered, and can you share the report or its executive summary?
- Q2. Do you hold ISO 27001 certification? What is the certification scope and the accreditation body?
- Q3. How frequently do you conduct external penetration tests, and are executive summaries shared with customers on request?
- Q4. What access controls limit your own employees' ability to read or modify customer data?
- Q5. What is your incident response SLA? Specifically, how many hours after detection do you notify affected customers of a breach?
- Q6. Under India's IT Act 2000 and the DPDP Act 2023, do you treat Indian customer data as requiring specific breach notification to CERT-In within 6 hours of detection?
- Q7. Do you publish a sub-processor list, and will you notify us before adding new sub-processors?
- Q8. What encryption standards apply to data at rest and in transit? Is encryption key management customer-controlled or vendor-controlled?
Key takeaway: A vendor who can't answer Q1 through Q3 in writing within 48 hours doesn't have a security program mature enough for a mid-market Indian company to trust with production data.
Data Residency and Portability Questions (Q9–Q14)
India's Digital Personal Data Protection Act 2023 imposes obligations on how Indian personal data is transferred outside the country. The rules are still being finalized through subordinate legislation, but the obligations on data fiduciaries (which your company likely is) are real. Knowing where your vendor stores data at rest isn't a nice-to-have; it's a compliance requirement you may be asked to document.
- Q9. In which specific cloud regions is our data stored at rest? Is an India region (AWS ap-south-1, GCP asia-south1, Azure Central India) available, and at what additional cost if any?
- Q10. Do you transfer any Indian personal data outside India? If yes, what legal mechanism governs that transfer?
- Q11. What formats are available for full data export, and is bulk export included in our subscription tier or a paid add-on?
- Q12. After contract termination, how long do you retain our data before deletion, and in what state (accessible, read-only, archived)?
- Q13. What is your backup frequency, RPO, and RTO for our data tier?
- Q14. Will you provide a written data deletion certificate after the retention period ends?
SLA and Uptime Questions (Q15–Q19)
A 99.9% uptime SLA sounds solid until you read the exclusions. Most SaaS uptime commitments carve out scheduled maintenance windows, third-party infrastructure outages (meaning AWS or GCP going down doesn't count against the vendor), and "circumstances beyond reasonable control." After exclusions, some 99.9% SLAs effectively guarantee closer to 99.0%.
- Q15. How is uptime calculated — calendar month or rolling 30 days — and what is explicitly excluded from the calculation?
- Q16. Are service credits the only remedy for downtime, or is cash refund available? What is the credit cap as a percentage of fees?
- Q17. What does "business hours" support mean in practice? Is it US Pacific / Eastern, or IST? What is the P1 response time commitment in hours?
- Q18. What is the escalation path if a P1 ticket exceeds the SLA without resolution?
- Q19. Do scheduled maintenance windows count against the uptime SLA? How much notice do you give before planned maintenance?
The support timezone question matters more than most Indian IT leads anticipate. A US-headquartered vendor listing "24x5" support may mean their team is online 9am-5pm US Central, which is 8:30pm-6:30am IST. If your team runs incidents during Indian business hours, verify that IST-hours support is contractually committed, not just marketed.
Action: Before signing any SLA, ask the vendor for a 12-month historical uptime log and the last 3 incident post-mortems. A vendor confident in their reliability will share these without hesitation. One who won't is telling you the SLA is aspirational.
Pricing, Escalation, and Billing Questions (Q20–Q24)
Pricing conversations during sales are almost always about the first year. The renewal year is where the real terms surface. Most SaaS vendors allow themselves 10-20% price increases at renewal without requiring your consent, written into the MSA in language like "fees may increase by up to X% per renewal term." Some contracts have no cap at all.
- Q20. Is the year-one price locked for the contract duration, and if not, what is the maximum allowable annual price increase written into the agreement?
- Q21. How are seat overages handled mid-contract? Are we billed at the contracted per-seat rate or a higher true-up rate?
- Q22. Do you issue GST-compliant invoices with our GSTIN, and are those invoices ITC-eligible under Indian tax law? Do you handle reverse charge scenarios for imports of services?
- Q23. Is INR billing available, or is the contract denominated in USD? If USD, who bears the currency conversion risk?
- Q24. Which discounts from the sales negotiation are written into the contract versus discretionary concessions that disappear at renewal?
GST treatment is a genuinely complex area for many global SaaS vendors selling into India. Under Section 13(12) of the IGST Act, import of software services is subject to 18% GST under reverse charge for Indian businesses. If the vendor doesn't issue a GST-compliant invoice, your finance team ends up doing manual reconciliation every month, and you lose input tax credit you're entitled to.
Key takeaway: The price you're quoted is rarely the price you'll pay in year two. Get a written cap on annual increases in the contract, not just a verbal commitment from the sales rep.
Exit, Termination, and Lock-in Questions (Q25–Q30)
Exit terms are the most commonly skipped section of any vendor review, and the most expensive to ignore. By the time you need them, you're already in a situation with time pressure and switching costs.
- Q25. What is the required notice period to cancel, and by what date before the renewal must notice be served to avoid auto-renewal?
- Q26. How is the auto-renewal clause structured? What is the opt-out window, and is email notice sufficient or must it be sent via registered post or specific contact?
- Q27. What happens to our active integrations and API keys on the contract end date? Is there a grace period for migration?
- Q28. Will you provide a written data deletion certificate confirming all our data has been purged after the retention period?
- Q29. What are the financial implications of termination for convenience versus termination for cause, and under what conditions can we invoke termination for cause?
- Q30. Can we export custom fields, configured workflows, and automation rules in a format importable by a competitor product?
Q30 is the lock-in question most vendors won't volunteer an honest answer to. Products that have invested heavily in proprietary workflow builders often store those configurations in formats that are technically exportable but practically unusable anywhere else. Ask specifically whether a named competitor product can import the export file.
Watch out: Auto-renewal opt-out windows as short as 15 days exist in several well-known SaaS contracts. Missing that window on a ₹12 lakh annual contract means you're locked in for another year. Set a calendar reminder 90 days before every renewal date, without exception.
Where Easexpense Fills the Gaps Your Template Can't
A due diligence template is only useful if you know which contracts to run it on. Most IT leads at 100-200 person Indian companies are surprised by how many active SaaS subscriptions exist that nobody formally approved. Shadow IT — tools signed up by individual team members using a credit card or UPI — doesn't show up in any procurement register until the invoice hits.
For over 30 top SaaS vendors in our marketplace, we've already mapped the standard renewal windows, GST invoicing status, and common contract gotchas. That context means you're not starting from scratch on each evaluation.
Our AI CIO flags renewal dates 60 days out, which gives your team meaningful time to decide before an opt-out window closes. It also tracks seat utilization continuously, so you know before a true-up conversation whether you've been over-licensed or under-licensed relative to your committed seats.
Consolidated GST invoicing eliminates the per-vendor monthly reconciliation problem. Instead of chasing 15 different vendor invoices with varying GST compliance quality, finance sees one clean invoice with all sub-items, each properly categorized for ITC claims. For a company spending ₹20 lakh annually on SaaS, the recoverable GST credit alone is worth the overhead of getting this right.
Before you run this template on new vendors, it's worth knowing exactly what you're already paying for. The fastest way to surface your current stack (including the shadow IT your finance team doesn't know about) is a free spend audit that reads your Gmail or Outlook invoice history and maps every recurring subscription.
The Full 30-Question Template (Printable Reference)
Below is the complete list, grouped by category, for use as a working document in vendor conversations. Mark each question red, amber, or green based on the vendor's response. Questions marked with (★ Non-negotiable) are the ones where a red answer should stop the deal.
Security and Compliance
- Q1. SOC 2 Type II: certification held, audit period, report availability. (★ Non-negotiable)
- Q2. ISO 27001: scope, accreditation body, expiry date.
- Q3. Penetration testing frequency and summary sharing. (★ Non-negotiable)
- Q4. Internal employee access controls for customer data.
- Q5. Incident response SLA and breach notification timeline. (★ Non-negotiable)
- Q6. CERT-In breach notification compliance under DPDP Act 2023. (★ Non-negotiable)
- Q7. Sub-processor list and change notification policy.
- Q8. Encryption standards at rest and in transit; key management model.
Data Residency and Portability
- Q9. Cloud regions for data at rest; India region availability and cost. (★ Non-negotiable)
- Q10. Cross-border data transfer mechanisms for Indian personal data. (★ Non-negotiable)
- Q11. Export formats available; whether bulk export is included in tier.
- Q12. Post-termination data retention period and data state.
- Q13. Backup frequency, RPO, and RTO for contracted data tier.
- Q14. Written data deletion certificate after retention period. (★ Non-negotiable)
SLA and Uptime
- Q15. Uptime calculation method and explicit exclusions. (★ Non-negotiable)
- Q16. Credit structure: credits vs. cash refunds; credit cap percentage.
- Q17. Support timezone, P1 response time in IST hours. (★ Non-negotiable)
- Q18. Escalation path for SLA breaches on P1 tickets.
- Q19. Scheduled maintenance: notice period and SLA impact.
Pricing, Escalation, and Billing
- Q20. Price lock duration; maximum contractual renewal increase. (★ Non-negotiable)
- Q21. Seat overage true-up rate and billing cadence.
- Q22. GST-compliant invoicing with GSTIN; ITC eligibility; reverse charge. (★ Non-negotiable)
- Q23. INR billing availability; USD contract currency risk allocation.
- Q24. Contractual vs. discretionary discount treatment at renewal.
Exit, Termination, and Lock-in
- Q25. Cancellation notice period; opt-out deadline relative to renewal date. (★ Non-negotiable)
- Q26. Auto-renewal clause structure; acceptable notice method. (★ Non-negotiable)
- Q27. Integration and API key status at contract end; migration grace period.
- Q28. Written data deletion certificate. (★ Non-negotiable)
- Q29. Termination for cause vs. convenience: triggers and cost implications.
- Q30. Portability of custom configurations and workflows to competitor products.
Before running this list on any new vendor, take 30 seconds to connect your work inbox to our spend audit. It surfaces every SaaS your company is currently paying for, including the ones nobody formally approved, so you know exactly what's already in the stack before adding something new.
Key takeaway: 10 of these 30 questions are non-negotiable dealbreakers. A vendor who won't answer them in writing shouldn't be in your final shortlist, regardless of how good the product demo looked.
Frequently asked questions
What is a SaaS vendor due diligence template and when should I use one?
A SaaS vendor due diligence template is a structured checklist of questions covering security posture, SLAs, data handling, pricing escalation terms, and exit rights that you use to evaluate any software vendor before signing a contract. Use it at the shortlist stage when you've narrowed down to 2-3 finalists, so you can disqualify vendors with non-starters before wasting time on full negotiation. Run it again at renewal, because pricing caps, support terms, and data residency commitments sometimes change between contract cycles. The goal is to surface contractual risk before it's legally binding, not during an incident or a renewal dispute.
Which questions in a SaaS vendor evaluation matter most for Indian companies?
Data residency and GST invoicing are the two areas where Indian companies face friction that their US or EU counterparts don't encounter in the same way. Under India's DPDP Act 2023, cross-border transfers of Indian personal data carry compliance obligations that many US-headquartered SaaS vendors haven't fully addressed in their standard contracts. Separately, GST-compliant invoicing with your company's GSTIN is required to claim input tax credit, and many global SaaS vendors still issue invoices through their Irish or Singaporean entities that don't qualify for ITC under Indian law. At 18% GST on ₹20 lakh of annual SaaS spend, the unclaimed ITC is ₹3.6 lakh per year. These questions belong at the top of your list, not buried in a later diligence round.
How do I evaluate a SaaS vendor's security posture without a dedicated security team?
Three requests surface most meaningful risk without requiring a security specialist on staff. First, request the vendor's most recent SOC 2 Type II report (specifically Type II, covering a period of time, not just a point in time), and check the audit period end date. Second, ask for the date of the last external penetration test and whether the executive summary is shareable with prospective customers. Third, request the sub-processor list and ask whether you'll be notified before any new sub-processors are added. A vendor who declines to share any of these three is not mature enough for production data. One who shares them willingly and clearly has invested in compliance as an operational discipline, not just a sales checkbox.
What SLA terms should I push back on when negotiating a SaaS contract?
The most commonly buried SLA traps are uptime exclusions and credit caps. Most vendors exclude scheduled maintenance windows, third-party infrastructure outages, and "force majeure" from their uptime calculations, which can effectively reduce a 99.9% SLA to something much lower in practice. Credit caps are typically set at 10-30% of monthly fees regardless of actual revenue impact from downtime. Push to negotiate credits as a percentage of annual contract value rather than monthly fees, try to have scheduled maintenance count against the SLA commitment, and confirm that support response times are explicitly referenced in IST hours rather than US Pacific or Eastern time. Getting any of these in writing at initial negotiation is far easier than trying to renegotiate mid-contract.
How much notice do I need to cancel a SaaS contract before auto-renewal?
It varies considerably by vendor, and the variation is wide enough to matter. Most mid-market SaaS products require 30 to 60 days written notice before the renewal date, but enterprise products sometimes require 90 to 180 days. What compounds the risk is the opt-out window itself, which can be as short as 15 to 30 days — meaning you must send cancellation notice before a hard calendar date or the contract auto-renews for a full additional term. Missing that window on a ₹10 lakh annual contract means you're locked in for another year with no legal recourse in most jurisdictions. The safest practice is to set calendar reminders 90 days before every renewal date in your SaaS register, well before the earliest possible opt-out deadline.
Can I get my data back after cancelling a SaaS subscription?
Most vendors offer a 30 to 90 day post-termination window to export your data before deletion, but the terms vary significantly. The critical questions are the export format (CSV is a minimum, but you want structured JSON or API access for anything more complex than flat records), whether bulk export is included in your subscription tier or costs extra, and whether the vendor will issue a written data deletion certificate confirming purge after the grace period. Without a deletion certificate, you have no way to verify your data has been removed from the vendor's systems, which creates a compliance gap under both the DPDP Act and any sector-specific regulations your company may be subject to. Get the deletion certificate commitment in writing before you sign, not after you decide to leave.
How do I find out which SaaS tools my company is already paying for before evaluating new vendors?
The fastest method is to connect your company's Gmail or Outlook inbox to an AI-based discovery tool that reads invoice and receipt emails and flags every recurring subscription. This surfaces both the tools your finance team knows about and the shadow IT that individual employees signed up for using a personal card or a team card, often without formal approval. Running this audit before any new vendor evaluation prevents you from purchasing something you already own in another part of the organization, or adding a tool that duplicates an existing contract you're still paying for. At companies with 50 or more employees, it's common to find 5-10 duplicate or abandoned subscriptions representing ₹2-5 lakh in annual waste. Knowing the full picture before you add new vendors is the most basic form of procurement hygiene.