Why ask these questions at all?
When you move records to cloud software, someone else runs the servers. That is often safer than a laptop under a desk, but only if the vendor does the work well and tells you the truth about it. You cannot inspect the servers yourself. Questions, written answers and a contract are your tools.
Send the same list to every vendor on your shortlist and compare the answers side by side. Ask one person who knows your work to read the answers too. A program lead may notice a gap that an IT reader misses, such as a feature that only exists on a higher plan.
Also decide before you start what would make you reject a vendor. For example, you may refuse any vendor that cannot say where data is stored, or that will not sign a data processing agreement. Deciding this first keeps a good sales demo from changing your standards.
Where is the data hosted?
- Which cloud provider and which region hold the data?
- Can you choose the region, or is it fixed?
- Are backups kept in the same place?
The location matters for law, for risk and for speed. Our article on what data residency means explains why.
How is data protected?
- Is data encrypted when it travels between the browser and the service?
- Is it encrypted when stored? Who manages the keys?
- How are files kept private, and how do download links work?
- What happens when a link is shared outside your organization?
Your staff also matter here. Ask how the vendor trains its own people, and how it limits access to production systems.
Look for plain statements. “Bank-grade security” tells you nothing; “encrypted in transit with TLS and encrypted at rest with provider-managed keys” tells you something you can check.
Who can access your data?
- How does sign-in work? Can you connect your own identity provider, and on which plan?
- Can you set roles, and can you limit what each role sees and does?
- Can the vendor’s staff see your records? When, why and with what record of it?
- Which actions are recorded in an activity log, and how long is the log kept?
Ask what the log does not cover. No product logs everything, and an honest vendor will say so.
What happens when something goes wrong?
- How are backups made, and how far back can you recover?
- How fast will the vendor tell you about a breach?
- Is there a contact for security reports?
- What does the vendor promise about uptime, in writing?
Treat any claim of “zero data loss” with care. Recovery has limits. Ask for the recovery window in days, and ask whether backups are tested. Then ask what you must do yourself: for example, keep your own export of key records on a schedule, so you are never fully dependent on one supplier.
Ask the vendor to explain its answers in plain words. If a sales contact cannot answer, ask who can, and wait for a written reply. A slow answer is information too.
Who else touches the data, and how do you leave?
- Providers. Ask for the list of sub-processors, meaning other companies that process your data for the vendor. Ask about AI providers in particular.
- Contract. Ask for the data processing agreement. See what a DPA is.
- Resale and training. Ask whether your data is sold, and whether it is used to train AI models.
- Export. Ask which formats you can export, and whether exports are limited by plan.
- Deletion. Ask how you delete records, and how long backups keep them.
How should you score the answers? Give each answer a simple mark: clear and specific, partly clear, or vague. Then add a second mark for fit with your own risks. A health program with sensitive data needs stronger answers than a training calendar. Keep the scores and the vendor’s emails together, so your board or donor can see how you chose. Check data protection law with a qualified adviser, because duties differ by country. Repeat the review when your use changes, for example when you add a new program with more sensitive data, or when the vendor adds a new feature or provider.
Where EMPOBase fits
EMPOBase is hosted on Google Cloud in the Singapore region and uses HTTPS/TLS in transit and Google-managed encryption at rest. Access to each organization’s records is restricted by sign-in and permission checks. Sign-in with your own identity provider (SSO) is on the Enterprise plan only. We do not resell customer data, and a DPA is available on request. EMPOBase does not claim certifications. If your organization needs data held in another region, raise it with us before you decide. See the security page and contact us for a questionnaire.