What to Ask a Software Company About Data Security Before You Sign

When you buy a CRM or an AI agent, you are handing over more than a project. You are giving another company access to information your customers trusted you with. If that information leaks or gets corrupted, your name is on the apology letter, not theirs.

You do not need to be technical to ask good questions. A handful of plain ones, asked before you sign, will protect the business and tell you a great deal about how the supplier actually works day to day. The answers matter, but so does the way they are given.

Most UK organisations that process personal data need to pay the data protection fee and register with the Information Commissioner's Office. A software company building systems that hold customer records is processing personal data. You can search the ICO's public register yourself in a couple of minutes, so there is no reason to take anyone's word for it. NTSF is registered with the ICO.

Certification is the next question. Cyber Essentials is a government-backed scheme that checks the basics are in place: firewalls, secure settings, controlled access, malware protection and keeping software up to date. IASME Cyber Assurance goes further, looking at how a business manages risk, handles incidents and runs security as an organisation rather than as a set of settings.

Here is our honest answer. We are working towards Cyber Essentials and IASME Cyber Assurance. We are not certified yet, and we will not tell you otherwise.

Ask whether fixes are made directly on the live system. If the answer is yes, your real customer records are the test bed. A bad change can corrupt data or expose it, and you will find out when a customer does.

You do not have to copy this exact process. What you want to hear is that testing happens somewhere other than your live data, and that a named person signs off before anything changes.

Problems do not keep office hours. Ask who would notice an attack, a crash or a security weakness at 3am on a Sunday, and how. A small supplier saying "we check it in the morning" is an honest answer, but it is worth knowing before you sign.

We run NTSF on our own AI agent, Jarvis. Alongside handling WhatsApp, drafting emails, managing the calendar and reconciling our finances, it watches security around the clock.

Plenty of businesses still collect ID, insurance certificates and contracts as email attachments. Those files then sit in inboxes indefinitely, get forwarded on, and are hard to account for later. Ask your supplier how documents get into the system.

For PM+, a surveying business we work with, compliance documents such as DBS checks and insurance are collected through secure links that expire after 48 hours. Subcontractors upload what is needed, and nothing is left floating around in email.

AI agents raise a newer question. If a supplier is building you an agent that can read your CRM, ask whether it can change records on its own. Our view is that it should propose changes and a person should confirm them first. That is how the agents we build work.

A good answer is short and specific. It names a process, a person or a status, and it admits gaps. A vague answer, or one that changes the subject to features and price, is the warning sign. You do not need to judge the technical detail. You only need to notice whether the supplier can explain it plainly.

We are happy to be asked every one of these. If you would like to put them to us in person, that is exactly what our free initial consultation is for.