Blog · November 4, 2026
How to ask a vendor for the proof you actually need
Before you buy, ask for the evidence that matches the risk: validation, references, retention details and handover terms. A clear request saves time on security, finance and implementation later.
Ask for proof that matches the decision
When a vendor is selling software, services, or AI support, the weakest part of the conversation is often the first answer: “Yes, we can do that.” That tells you almost nothing about where your data goes, who can see it, what happens if you leave, or whether the numbers can be trusted.
If you approve IT, security or spend, ask for proof in four plain buckets:
- Validation — Ask how they show the tool works in practice. That can mean a demo using a realistic scenario, sample outputs, or a description of how they test changes before release. If AI is involved, ask what is drafted by the system and what must be checked by a person.
- References — Ask for references that are close to your use case, not just any happy customer. You want to know whether the vendor has handled the same kind of data, the same volume, the same approval path, or the same integration pressure.
- Retention and access — Ask where data is stored, where it is processed, whether prompts or uploads are kept, who can access them, and how long they remain available. If the vendor cannot answer plainly, that is a gap, not a detail.
- Handover terms — Ask what happens when the relationship ends. You need export formats, handover support, deletion timing, and any dependencies you would have to rebuild. If the answer is “we can discuss that later,” write it down as unresolved.
A useful request is specific and short:
- what data the vendor will receive;
- whether it will touch external AI or search providers;
- what audit trail is available for actions and decisions;
- what can be exported on exit;
- what the customer must do to take over cleanly.
For finance approvers, add one more line: ask how the vendor separates estimates from facts, and whether any figures in the proposal come from code, from a model, or from the vendor’s judgement. That distinction matters when you are deciding what to fund.
For security approvers, ask for the retention policy in writing and the deletion path for both live data and backups. For IT, ask who owns setup, change control and support after go-live. For all three groups, the test is the same: can the vendor show exactly what is in place, and what is not?
That is the point of the conversation. Not “trust us.” Show us.
If you want a cleaner way to structure those questions before you buy, talk to Ultima Serve. We help you get to the answer without dragging the decision out longer than it needs to be.