What should we check before buying another software tool?

Why does every new tool seem to make things worse?

Because each one arrives to fix a single problem, and nobody asks how it will fit with the rest. The booking system fixed bookings. The CRM fixed sales. A rota app fixed the rota. Each was a sensible purchase on its own, and together they leave a gap between every pair of them.

Somebody fills that gap. They read a screen in one tool and type it into another, export a file on Friday and import it on Monday, and keep a spreadsheet in the middle because two of the systems never quite agreed. Your most expensive integration has a salary.

So the question to ask before buying the next tool is not only whether it does the job. It is whether it will talk to what you already have, whether you can leave it later, and whether it will look after the data you put in it.

What should you check about the tools you already run?

Start with a page, not a demo. Draw every system the business uses as a box, and draw a line wherever data moves between two of them. Label each line with how it moves today: typed by hand, exported and imported, or connected properly.

The lines marked "typed by hand" are where the new tool will either help or add another one. Take that drawing to every supplier conversation and ask the questions below.

Question for the supplier	Why it matters	A good answer
Does it have an API, and what can it read and write?	Without one, a person becomes the connection	Published documentation you can read before you buy
Can it import from the systems we already use?	Otherwise the first month is spent retyping	A named import route, not "our team can help"
Can we export all our data, in a standard format, whenever we like?	You will leave one day, or need the data elsewhere	Yes, without a support ticket or a fee
Which system holds the master copy of each record?	Two systems both owning a customer means two truths	One owner per type of record, agreed before go live
Who looks after the connection when it breaks?	Links fail when a field is renamed or a login changes	A named person, and an alert when it stops

We wrote separately about stopping the same data being typed into three systems. This is the same problem caught one step earlier, before you sign.

What does the NCSC say to check?

The National Cyber Security Centre publishes a lightweight approach to cloud security written for checking an online service before you use it. Its guidance on choosing a cloud provider recommends it for smaller organisations looking to do some due diligence in their online services, and for larger ones that are not putting sensitive data in the service.

It covers 4 areas: data encryption, authentication and access control, security logging and incident management, and governance. The NCSC says it deliberately chose questions you can answer without in depth research or talking to the provider directly, and that you should expect a good service to answer yes to all of them.

A few of those questions matter more than people expect.

First, whether any APIs the tool offers are protected by authentication. An API is how your other tools will talk to this one, so it is also a door into your data.

Then whether two factor authentication can be made compulsory for every user, rather than left for each person to switch on.

Where your data will be processed and stored, and in what country the company and any providers handling your data are legally based. The supplier should be able to tell you.

And whether the service keeps security logs and will make them available to you.

None of this needs a security team to get started. The NCSC expects most of it to be answered from the supplier's website or by asking their support staff. It even treats how easy the answers were to find as a question in its own right.

Does data protection law come into it?

Yes, if the tool will hold personal data about customers, staff or anyone else, and plenty of business tools do.

The ICO explains when a contract is needed. Every time a controller, which is your business, uses a processor to handle personal data on its behalf, there must be a written contract binding the processor. Whether a supplier counts as a processor depends on what it does. The ICO's own example is a company supplying software and data analysis to a school: for the software provision it is not a processor, but for the data analysis it is.

Where a supplier is a processor, the ICO lists what the contract must include. One term deserves particular attention when you are buying. At the end of the contract the processor must, at your choice, delete or return all the personal data it has been processing for you, and delete existing copies unless UK law requires them to be kept. It covers personal data only, and only at the end, so it does not replace the export question in the table above.

The ICO notes that this guidance is under review following the Data (Use and Access) Act, so check the current version before relying on it. Ask the supplier for its data processing terms before you sign.

Where do people get this wrong?

Buying from the demo. A demo shows the tool on its own, full of tidy sample data. It never shows the gap between that tool and your accounts package, because the supplier does not know your accounts package exists.

Trusting the badge. The NCSC is plain that it is the evidence presented with standards and certifications that gives you confidence, not the fact that a service holds one. Its guidance also says that if a provider is unwilling or unable to provide evidence of independent validation, you are relying on the honesty, accuracy and completeness of what the supplier tells you.

Not reading how the terms can change. The same guidance says a provider may occasionally update its terms, and that you should be comfortable with how much notice it must give and that it commits to telling you when changes are announced.

Then there is the shortest route to a tool nobody can leave: setting it up under one person's login. Make sure the business owns the account, holds the admin rights and knows where the data export lives.

When is this not the answer?

When the problem is the process, not the tool. If nobody agrees how bookings should work, a new booking system will record the disagreement more neatly. Write the process down first. That is the part of the job we do as business analysis and solution design.

When a tool you already pay for does the job. Check the features list of what you have before buying something new. A setting nobody switched on is cheaper than a subscription.

When the data is sensitive. The NCSC says that for more sensitive workloads, such as large amounts of personal data or commercially sensitive information, you should do a more thorough analysis using the full 14 cloud security principles. If that applies to you, a security professional and proper data protection advice are worth paying for before you buy, not after.

And when the honest answer is to connect two tools you already have. Sometimes the right purchase is no purchase at all, just a short piece of process automation between systems that already work.

Where do you start?

Draw the page. Every system, every line, every place a person carries data between them. Then take the next software decision to that page before you take it to a demo.

If the page shows more hand typed lines than you expected, tell us what's stuck and we'll map the quickest fix. We will tell you straight whether you need a new tool, a connection between the ones you have, or nothing new at all. Time to talk yet?