Why Your CFO Should Be Asking About Vendor Lock-In
Five questions to ask any vendor before signing — and what exit-ready architecture actually looks like.
Five questions to ask any vendor before signing — and what exit-ready architecture actually looks like.
Why this is a finance problem
Lock-in does not show up on a P&L until you try to leave a vendor and find out what it costs. By the time it shows up, the choice was made years earlier — usually by a department head selecting a tool, not by finance evaluating optionality. CFOs who are not asking lock-in questions during procurement are abdicating a real cost-of-capital decision to whoever happens to be on the buying call.
The five questions
(1) What is the data export format and is it complete? (2) What is the API contract for migrating live data, including history? (3) What are the contractually-guaranteed retention and deletion timelines? (4) Is there a portable data model documented anywhere? (5) What does it cost to leave — including penalties and termination clauses? Most vendors handle 1 and 2 unevenly and 3, 4, 5 not at all.
What exit-ready looks like
Your data lives in a warehouse you control, with vendors as upstream sources rather than systems of record. Your integration layer uses your own contracts, not the vendor's. Your team owns the auth boundary. The replacement-cost line for any single vendor in your stack is six figures or less. None of this requires "no SaaS" — it requires architectural discipline at procurement.
How to apply this in renewals
At every renewal cycle, the team that owns the tool answers a single question: if we had to leave in six months, what would it cost and what would break? When the answer is unknown, that is the work for the quarter. When the answer is "millions of dollars and 18 months", that is a board-level conversation about derisking.