The build-vs-buy tree closes the decision to buy and opens another one: who sells. This is where companies sign three-year contracts without reading the data export policy. The five criteria below come from contracts I reviewed during audits and from one integration mistake that cost a full quarter of migration.
Exit cost before monthly price
Ask how you leave and how much it costs. Monthly price is the easy part. What sets the five-year cost is the data export format, the egress fee and the notice period. ITIL 4 Foundation (AXELOS, 2019) treats supplier management as a contracting practice with review cycles rather than a one-off purchase. Write the export format and the migration window into the contract.
An SLA with a written consequence
An SLA with no consequence is decorative text. Write the service level in terms your system feels, following the same approach to SLIs and SLOs in Site Reliability Engineering (Beyer et al., O'Reilly, 2016): latency at a percentile, availability, support hours. Then define credits, a resolution window and the right to walk away without a penalty when the level drops.
Integration trial inside your architecture
Two weeks in a trial environment before signing. Make the vendor pass through your authentication flow, your logs and your deploy pipeline. Simon Wardley, in Wardley Maps (2020), points at hidden dependencies: the vendor that looks like a commodity today becomes a bottleneck when it sits on the path of your customer. The real trial kills half the questions in the RFP.
Who answers when it breaks
Support tier and response time, in writing. Ask for the channel name, the hours in your time zone and how many tiers exist before an engineer picks up. Schedule one test call during the pilot and measure time to first human response. Take the result into the minutes, because this is the part nobody reviews later.
A reference at your own size
Two calls with accounts of similar size. Ask about exit, about integration, and about what the vendor delivered beyond the promise. Ask the reference CTO what changed after the first year. Two 30-minute calls beat any page of vendor cases. Before the meeting, pull the vendor public incident history for the last 12 months too.
