The B2B software evaluation checklist: 40 questions buyers can verify before signing

There are 40 questions worth verifying before you sign a B2B software contract, and the word verifying is the whole point: each one has a document, a clause or a demonstration behind it, so the answer arrives as evidence rather than as reassurance. They sit in eight groups of five: the contract, the money, data location, security scope, uptime and support, implementation, the vendor as a company, and getting out. This page enumerates all 40 with the proof to request for each. It is a checklist we wrote, not a survey of buyers, and no claim is made anywhere on it about how often any of these questions gets asked.

The answer, first

Use it in three passes. Before the first demo, ask the five in group one and the five in group eight, because a contract term and an exit route decide more deals than features do. Before the shortlist, ask groups two, three and four, and require the documents rather than the answers. Before signing, ask groups five, six and seven and put every answer that matters into the agreement, because an answer in an email is not a term.

One rule governs the whole list. If the answer cannot be shown to you in a document, a clause, a log or a live screen, record it as unverified. An unverified answer is not a lie, and treating it as verified is how evaluations go wrong.

The 40 questions, in eight groups of five

Group one: the contract itself.

• What is the minimum term and what is the notice period for non renewal. Ask for the clause, not the summary.
• Does it renew automatically, and at what price. Ask for the renewal and price escalation clauses together.
• Which legal entity are we contracting with, and under which country's law. Ask for the entity name as it appears on the signature page.
• Can we reduce licences at renewal, or only add. Ask for the clause that permits a reduction.
• What are the liability limits and what do they exclude. Ask for the limitation of liability clause and read the exclusions first.

Group two: the money, and what it becomes.

• What is the all in year one cost in rupees, including tax, setup and training. Ask for a written quotation with each line separated.
• Which features are excluded from our plan. Ask for the plan comparison as it will be attached to the contract, not the marketing page.
• What is the price for a user added in month seven. Ask for the pro rata rule in writing.
• What is metered, and what happens when we exceed it. Ask for the overage rate for storage, records, API calls or messages.
• Is the price locked for the term. Ask for the clause, and if there is none, ask for one.

Group three: data location and protection.

• In which country is our data stored, and in which country is it backed up. Ask for the region named in the order form.
• Will you sign a data processing agreement. Ask for their standard one and read the sub processor list.
• Who are your sub processors, and will you tell us before adding one. Ask for the current list and the notice clause.
• Is our data used to train any model, yours or a third party's. Ask for the answer as a contract term, because product pages on this subject change.
• What is your breach notification time, and to whom. Ask for the number of hours in the agreement.

Group four: security claims and their scope.

• Which certifications do you hold, and what is the scope of the certificate. Ask for the certificate itself, and read the scope statement rather than the logo.
• When was your last penetration test and who did it. Ask for the summary letter, not the full report, which you will not get.
• Do you support single sign on and multi factor authentication, and on which plan. Ask for a live demonstration on the plan you are buying.
• Can we get an audit log of administrative actions. Ask to see one on screen with a real entry in it.
• Who inside your company can access our data, and under what process. Ask for the access control policy or the relevant page of it.

Group five: uptime and support promises.

• What uptime do you commit to, and what is the remedy if you miss it. Ask for the service level agreement and check whether the remedy is a credit or nothing.
• What was your actual uptime for the last two quarters. Ask for the status page history, which is public for most serious vendors.
• What is the response time for a system down issue, by severity. Ask for the severity definitions, because that is where the commitment really lives.
• What are your support hours in Indian Standard Time, and which days. Ask for it in writing with the time zone named.
• Is support included in this price or sold separately. Ask which support plan the quotation assumes.

Group six: implementation reality.

• Who does the implementation work, and how many hours of our staff time does it need. Ask for a written plan with named responsibilities.
• What is the migration process for our existing data, and what will not migrate. Ask for a test migration of a sample of your own records.
• Can we see the product doing our own workflow, with our own data. Ask for a sandbox, not a demo script.
• What is the most common reason implementations of this product run late. Ask the implementation lead rather than the salesperson.
• What is the go live plan, and what is the rollback plan. Ask for both in one document.

Group seven: the vendor as a company.

• How many customers do you have in India, and how many of our size. Ask for a number and for two references you were not offered.
• Can we speak to a customer who is not in your case studies. Ask for one in your sector, and ask them what went wrong.
• How large is the engineering team maintaining this product. Ask because a product with two maintainers is a risk, not because the number is a score.
• Who are your two closest competitors, in your own words. Ask because a vendor who cannot describe its competitors accurately usually cannot describe itself accurately either.
• What happens to our contract if you are acquired. Ask for the assignment clause.

Group eight: getting out.

• How do we export all of our data, in which formats, and does it include attachments and history. Ask for an export from the trial account so you have seen the file.
• Is there a charge for the export or for assistance with it. Ask for the number or the clause saying there is none.
• How long do you retain our data after termination, and will you delete it on request. Ask for the retention period and the deletion confirmation process.
• Do we keep read access during the notice period. Ask for the clause, because losing access on day one of a transition is a real failure mode.
• Will the export load into another product without rework. Ask for the field list, and check one competitor's import requirements against it.

How it was measured

It was not measured, and that sentence is the most important one on this page. The 40 questions were assembled rather than surveyed, from three sources we can name.

• The buying conversations behind this product, where the same clauses and documents come up repeatedly.
• The failure modes recorded in our own audit work, which is where groups two, three and eight come from. A vendor that cannot produce a price, a data region or an export is a vendor whose answers you cannot check.
• The shape of what assistants actually reward, which we do have dated evidence for. Across the whole September 2026 aiknowsus.com capture, the domains cited most often were the assistants' own documentation and the vendors' own websites, with a single well known review site far down the list. So the documents you request are also the documents worth publishing.

The method if you wanted to turn this into a survey. Recruit buyers who have signed in the last twelve months, ask which of the 40 they actually verified before signing, and report each as a count of buyers over the total number of buyers interviewed, never as a bare percentage. Publish the recruitment method and the exclusions. Until somebody does that, the only honest count on a page like this is the count of questions.

What the numbers were

40. Eight groups, five questions per group, every one enumerated above and every one paired with a document, a clause, a log or a demonstration. That is a count of a checklist and it is complete: if you count the list items above you get forty.

No buyer survey exists behind this page, as of 29 September 2026. There is no percentage of buyers who ask any of these, no ranking of the eight groups by frequency, and no claim about the most common concern. The order is our judgement of what decides deals, and it is labelled as judgement.

The dated evidence we do hold, and what it supports. Three results bear directly on this checklist, all from our own programmes.

• On 6 August 2026 the prices on the clawlaw.in pricing page appeared only after scripts had run, so a crawler received no prices at all, and the prices the assistants quoted had come from an app store listing instead of the company's own site. Claude's run recorded it. That is group two, failing in public.
• The same day, ChatGPT noticed that the website and the app store listing carried different plan names and different prices for the same product, and said so inside its answer.
• On 6 August 2026 a headline figure on that site could not be true, and when Claude checked it against public numbers it advised a buyer against the product, after which the company's accurate claims stopped counting for that answer. That is the strongest argument we have for verification as a habit, from either side of the table.

What this cannot tell you

• It is not a survey and must not be quoted as one. Nobody has counted how often buyers ask these.
• It is not legal advice. The contract questions tell you which clause to read. A lawyer tells you what it means for you.
• It is not sector specific. Regulated sectors have requirements this list does not carry, and your compliance team should add them.
• It does not rank the groups. Five per group is for evenness, not importance.
• It cannot replace a reference call. The single most useful thing on this page is the request for a customer who is not in the case studies, and no checklist substitutes for that conversation.

Sources and change log

Sources. The 40 questions are our own, assembled from buying conversations and from the failure modes recorded in the clawlaw.in programme of July to September 2026 and the aiknowsus.com audit of September 2026. The three dated results quoted are from those records, and all three concern public pages and listings, so a reader outside this company can check them.

Change log. 29 September 2026: first published with 40 enumerated questions in eight groups of five, the evidence to request for each, and the statement that no buyer survey sits behind it. If we later run the survey described above, the counts and denominators will be added here and this entry will stay.

Common questions

Forty questions will annoy a vendor. Which ten matter most?

The five in group one and the five in group eight. Term, notice, entity, licence reduction, liability, then export, export cost, retention, notice period access and portability. A good vendor answers all ten in a single email, and how quickly they do it tells you most of what you need to know.

What if the vendor will not give us the certificate or the test letter?

Mark it unverified and price the risk. A certificate with a narrow scope is common and reasonable, and a refusal to show the scope is not the same thing. The ones worth worrying about are the vendors who send a logo instead of a document.

We are a small buyer. Will they negotiate any of this?

More than most small buyers expect, particularly on notice periods, price locks and export assistance, because those cost the vendor little. Ask in writing, ask early, and ask for one change at a time.

Should a vendor publish the answers to these publicly?

Yes, and it is the cheapest advantage available in a B2B category. Across our September 2026 capture the pages most often cited were official documentation and vendors' own sites. A vendor whose site answers group two, group three and group eight in plain text is a vendor an assistant can describe, and a vendor a buyer can shortlist at nine in the evening.

Is a checklist like this useful when the product is cheap?

Groups one, three and eight still are, because the cost of a bad exit is not proportional to the licence fee. Skip group seven for a small purchase and keep the data and contract questions.

What to do first

Send groups one, two and eight to your current shortlist today, as fifteen numbered questions in one email, and ask for documents rather than answers. Then record each reply as verified or unverified in a single sheet. The pattern of who answers with a clause and who answers with a paragraph is usually clear before you finish reading.