Due Diligence Questions to Ask Any CRM Vendor
Before you hand a vendor every merchant file you own, ask the questions you would want answered if something went wrong. Here is the list.
Choosing a CRM usually starts with the demo: the pipeline view, the dialer, how fast a broker can log a call. Those matter. But the moment you migrate, that vendor holds every application, statement, recording and commission record your business has. The questions that protect you are rarely the ones covered in a sales demo.
Due diligence does not have to be a formal security audit. For most funding shops, it is a structured conversation with clear written answers on five topics: how your data is separated from other customers, how it is backed up, who can access it, how you get it out and what happens when the relationship ends.
Use the questions below with any vendor, including us. A good vendor will answer them plainly. Vague answers are information too.
Pre-flight summary
- Ask how your data is isolated from other customers, including competitors on the same platform.
- Understand backup frequency, separation, restore testing and retention.
- Know who at the vendor can access your data and whether that access is logged.
- Test exports for completeness before you depend on them.
- Get exit and deletion terms in writing, and have counsel review the contract.
Leg 01Isolation: is our data separate from everyone else's?
Many software products store many customers' data in shared infrastructure, separated by software rules. That can be done well, but you should understand how. In funding, the stakes are specific: other shops on the same platform may be your direct competitors.
FundPilot gives each company an isolated workspace, which is one approach. Whatever vendor you evaluate, ask them to explain theirs in plain language.
- How is our data separated from other customers' data?
- Could a configuration mistake expose our records to another customer, and what prevents it?
- Are files such as statements and recordings stored with the same isolation as database records?
- Is any customer data used to train models or build features for other customers?
Leg 02Backups: what happens on the worst day?
Ask about backups as if the worst has already happened: a server failure, an accidental bulk delete by one of your own managers, or ransomware. You want to know how much data you could lose and how long it would take to get back.
Ask how often backups run, where they are stored, whether they are kept separate from the main system, and when a restore was last tested. Ask whether they can restore a single deleted deal or only an entire system. And ask how long backups are kept, because that interacts with your own retention policy: deleted records may persist in backups for a period, which counsel may want to know about.
Leg 03Access: who at the vendor can see our files?
Someone at every vendor can, in principle, reach customer data. The question is who, under what circumstances, and whether it is recorded. A support engineer troubleshooting your account may need temporary access; a sales rep never should.
On your side, check that the product gives you the controls to run a tight shop: two-factor sign-in for every user, role-based access so investors and partners see only their slice, and an audit trail of exports, downloads and changes. Ask whether the vendor's own access to your workspace appears in that trail.
Finally, ask about security incidents. How would the vendor tell you if something went wrong, how quickly, and what information would they share? Your own obligations to merchants and funders may depend on getting that information promptly, so counsel should see the answer.
The questions that protect your business are rarely the ones covered in a sales demo.
Leg 04Export: can we get everything out, in usable form?
Data you cannot export is data you do not fully control. Ask exactly what an export includes. Contacts and deals are easy; the real test is everything else: documents with their deal associations, call recordings and transcripts, text history, notes, commission ledgers, syndication participations and audit logs.
Ask in what format each comes out, whether you can run an export yourself at any time or must request it, and whether exports cost extra. Consider a hypothetical test: request a sample export of ten closed deals and check that a person who has never seen your CRM could reconstruct each deal from what you receive.
Leg 05Exit: what happens when the relationship ends?
Nobody signs up planning to leave, which is exactly why exit terms get skipped. Get these answers in writing before you migrate.
- How much notice is required to end the agreement?
- How long will our data remain accessible after notice, so we can export it?
- Will the vendor help with the export, and on what terms?
- When and how will our data be deleted, including from backups?
- Will we receive written confirmation of deletion?
- Are any of our phone numbers, domains or branded assets tied to the vendor, and can we take them with us?
Leg 06Bringing it together
Collect the answers in one document, and compare vendors on the same questions rather than on whichever topics each demo emphasized. Have qualified counsel review the contract language around data ownership, confidentiality, breach notification and termination, since those terms carry legal weight that a sales conversation does not.
FundPilot deployments start with discovery and include migration and launch, so these questions come up early in our process anyway. If you want to run through this list against FundPilot specifically, a walkthrough is a good place to do it.
Questions from the floor
Do small funding shops really need vendor due diligence?
Yes, though it can be light. A small shop holds the same kinds of sensitive data as a large one: identity documents, bank statements and recordings. A one-page list of written answers about isolation, backups, access, export and exit takes a few hours to collect and can save a painful surprise later. Funders may also ask how you chose your systems.
What is a red flag in a vendor's answers?
Watch for answers that stay vague after a follow-up question, refusal to put commitments in writing, exports that leave out documents or recordings, extra fees to retrieve your own data, or uncertainty about who internally can access customer records. Any one of these may have an explanation, but each deserves a direct question before you sign.
Should a lawyer review our CRM contract?
It is sensible to have qualified counsel review terms covering data ownership, confidentiality, security incident notification, limitations of liability and termination. Those clauses decide what happens if something goes wrong, and they can interact with your own obligations to merchants and funders. A short review before signing is far easier than a dispute afterwards.
How do we test a vendor's export before committing?
Ask for a trial export of a small, representative sample, such as ten closed deals with documents, recordings and commission records attached. Check whether every item came through, whether the relationships between them survived, and whether the format opens in ordinary tools. If a vendor cannot or will not provide a sample, consider what that implies for the day you need everything.
General information only — not legal, tax or financial advice. Rules for telemarketing, texting, recording, disclosures and data retention vary and change; confirm current requirements with qualified counsel.
Connecting flights