- How long has the company been around? Is it well-funded or has it been acquired by an established company?
- What type of facility will host your law firm's data?
- Who else has access to the cloud facility, the servers, and the data? What mechanisms are in place to ensure that only authorized personnel will be able to access your data?
- How does the vendor screen its employees? If the vendor doesn’t own the data center, how does the data center screen its employees?
- Is the data accessible by the vendor’s employees limited to only those situations where you request assistance?
- If there are integrations with the company's product, how does the company screen the security processes of the other vendors and of the product that integrates with the software?
- If there is a problem with a product that integrates with the vendor's software, which company will be responsible for addressing the issue?
- Does the contract with the vendor address confidentiality?
- How often are backups performed? Is data backed up to more than one server?
- Where are the servers located? Will all of your firm's data always stay within the boundaries of the United States?
- What type of security is used at the data centers where the servers are located?
- What types of encryption methods are used? Is your data encrypted while in transit and while at rest?
- Are there redundant power supplies for the servers where your data is stored?
- If a natural disaster strikes one geographic region, would all data be lost or are there geo-redundant backups?
- If there is a data breach, will you be notified? How are costs for remedying the breach allocated?
- Does the contract include a guarantee regarding uptime?
- What remedies does the contract provide?
- Does the agreement with the provider contain a forum selection clause or a mandatory arbitration clause?
- What rights do you have upon termination of the contract?
- How do you retrieve a copy of your law firm's data and in what format will it be provided?
- What rights do you have in the event of a billing or similar dispute with the vendor?