The mistake: A 150-person company chooses a $120K/year CRM because it's 18% cheaper than Salesforce. Eighteen months later, the integration to their ERP breaks twice, support takes 5 business days to respond, and the vendor gets acquired — contracts frozen during transition. The "savings" cost them $200K in engineering time and three months of productivity loss.
Price is one dimension. Smart vendor evaluation is five dimensions. This guide gives you a weighted scorecard you can apply to any SaaS vendor before signing — and a decision matrix for when to override the score.
The total cost of a SaaS platform is not the license fee. It is:
A vendor 20% cheaper on license fees but weak on integration ecosystem and support can cost you 2–3x more in total. The scorecard forces you to price all five dimensions, not just the invoice line item.
| Dimension | Weight | Why This Weight |
|---|---|---|
| Security & Compliance | 25% | Non-negotiable for enterprise. A single breach or compliance failure costs more than any license discount. |
| Pricing Transparency | 20% | Hidden fees, escalation clauses, and usage traps destroy budgets. Transparency predicts long-term cost reliability. |
| Support & SLA Quality | 20% | Downtime and slow support translate directly to lost revenue and engineering hours. SLA terms signal how much a vendor values uptime. |
| Integration Ecosystem | 15% | Every integration gap costs 40–200 engineering hours to build and maintain. Poor ecosystem is a hidden tax. |
| Vendor Stability | 15% | Vendor acquisitions, pivots, and shutdowns strand customers mid-contract. Stability predicts continuity risk. |
| Implementation Complexity | 5% | Real but manageable. Weighted lower because it is a one-time cost, not ongoing. |
Security is the highest-weight dimension because the downside risk is asymmetric. A vendor breach exposes your customer data, triggers regulatory fines (GDPR: up to 4% of global revenue), and generates legal liability — all in one event.
| Score | Criteria |
|---|---|
| 1–3 (Poor) | No SOC 2 certification. No published security policies. Cannot produce a penetration test report. No data encryption at rest/transit documentation. No breach notification process. |
| 4–6 (Fair) | SOC 2 Type I (point-in-time audit). Basic GDPR DPA available. Encryption at rest documented. No HIPAA BAA. No bug bounty program. Annual pen test but not shared. |
| 7–8 (Good) | SOC 2 Type II (ongoing audit, 6+ month period). GDPR DPA with sub-processor list. HIPAA BAA available. ISO 27001 or equivalent. Shares pen test results on request. Bug bounty program. |
| 9–10 (Excellent) | SOC 2 Type II + ISO 27001 + FedRAMP (if applicable). HIPAA BAA standard. GDPR, CCPA, and multi-jurisdiction compliance documented. Continuous security monitoring. Public bug bounty. Independent audits published. |
Questions to ask the vendor:
Opaque pricing is a $40K–$200K problem waiting to happen. Usage-based pricing traps, automatic escalation clauses, and vague "fair use" policies all add up to budget surprises at renewal time.
| Score | Criteria |
|---|---|
| 1–3 (Poor) | Pricing is "contact sales only." Renewal escalation clause not disclosed upfront. Usage-based billing with no cap. "Fair use" limits undefined. True-up charges applied retroactively. |
| 4–6 (Fair) | Published pricing for entry tiers but enterprise requires negotiation. Escalation clause present (typically 5–10% per year). Usage caps disclosed but enforced without warning. No price lock options. |
| 7–8 (Good) | Published pricing across tiers. Escalation clause capped at CPI or 5% (whichever lower). Usage dashboards available. True-up process clearly documented. Multi-year pricing available with discount. |
| 9–10 (Excellent) | Fully transparent pricing across all tiers. No automatic escalation (or clearly negotiable). Usage monitoring with alerts before overages. Price lock for 2–3 year terms available. No hidden fees (support, storage, API calls) at enterprise tiers. |
Contract clauses to request:
Enterprise SaaS goes down. The question is: how fast does it come back, and who is liable when it doesn't? A vendor with 99.9% uptime SLA but no financial penalty for breaching it is effectively offering a 99.9% uptime goal — not a guarantee.
| Score | Criteria |
|---|---|
| 1–3 (Poor) | Email support only. Response time 48–72 hours. SLA: 99% uptime (87.6 hours downtime/year). No financial penalty for SLA breach. No dedicated CSM. Community forum as primary support. |
| 4–6 (Fair) | Email + chat support. Response time 12–24 hours. SLA: 99.5% uptime (43.8 hours/year). Service credit of 10% monthly fee for breach. Shared CSM. Business hours coverage only. |
| 7–8 (Good) | Chat + phone support. Response time 4 hours for P1. SLA: 99.9% uptime (8.76 hours/year). Service credit 25% monthly per incident. Dedicated CSM for enterprise. 24/5 coverage. |
| 9–10 (Excellent) | 24/7 phone + dedicated Slack channel. P1 response: 15–30 minutes. SLA: 99.95%+ uptime. Service credits 50%+ monthly for breach. Dedicated TAM + CSM. Contractual uptime guarantee with penalties. Status page with historical data. |
SLA red flags to check in contracts:
Every integration your new vendor lacks is a custom engineering project. Budget $15K–$40K per custom integration for a mid-size company (initial build + ongoing maintenance). A vendor with 20 fewer native integrations than the alternative costs you $300K–$800K over a 3-year contract.
| Score | Criteria |
|---|---|
| 1–3 (Poor) | Fewer than 50 native integrations. No public REST API (or severely rate-limited). No webhook support. Custom integrations require professional services engagement. |
| 4–6 (Fair) | 50–200 native integrations. REST API available with reasonable limits. Webhook support. Zapier/Make integration exists. API documentation is incomplete or outdated. |
| 7–8 (Good) | 200–500 native integrations. Well-documented REST and GraphQL APIs. Webhooks with retry logic. Zapier + native Salesforce, Slack, and major CRM connectors. SDK available in 3+ languages. |
| 9–10 (Excellent) | 500+ native integrations. Marketplace with partner-built connectors. Robust API with versioning and backwards compatibility. SDKs in 5+ languages. Enterprise iPaaS (MuleSoft, Workato) connectors. Developer community. |
Key integrations to audit for any enterprise SaaS:
A vendor that gets acquired, runs out of funding, or pivots away from your use case leaves you with a stranded contract. Migration from a failing vendor costs 3–12 months of engineering time and $50K–$500K depending on data complexity.
| Score | Criteria |
|---|---|
| 1–3 (Poor) | Series A or earlier, less than 18 months runway at known burn rate. No strategic investor. Founder-led with single point of failure. Product roadmap not disclosed. Revenue under $5M ARR. |
| 4–6 (Fair) | Series B–C. 18–36 months runway estimated. Institutional investors. 50–200 employees. Clear roadmap but 12-month visibility only. Revenue $5M–$50M ARR. Some customer concentration risk. |
| 7–8 (Good) | Series D+ or profitable. 200+ employees. Named strategic investors. 3-year roadmap visible. Multiple product lines (diversified). Revenue $50M–$500M ARR. Customer base >500 enterprise accounts. |
| 9–10 (Excellent) | Publicly traded or acquired by major strategic. Revenue $500M+ ARR. 1,000+ employees. Global operations. Multi-year roadmap committed. Contract includes data portability and source code escrow clause for mission-critical use cases. |
| Dimension | Weight | Score (1–10) | Weighted Score | Notes |
|---|---|---|---|---|
| Security & Compliance | 25% | 9 | 2.25 | SOC 2 Type II, ISO 27001, HIPAA BAA, FedRAMP. Industry gold standard. |
| Pricing Transparency | 20% | 5 | 1.00 | List prices published but enterprise pricing negotiated. Annual escalation clauses standard (7–10%). Add-ons multiply quickly. |
| Support & SLA | 20% | 8 | 1.60 | Premier support tier: 24/7 phone, 1hr P1 response. Standard: 2-day email. Uptime SLA: 99.9%. |
| Integration Ecosystem | 15% | 10 | 1.50 | AppExchange: 7,000+ apps. REST/SOAP/GraphQL APIs. Native connectors for every major enterprise tool. |
| Vendor Stability | 15% | 10 | 1.50 | NYSE: CRM. $35B+ ARR. 75,000+ employees. Not going anywhere. |
| Implementation Complexity | 5% | 4 | 0.20 | Complex. Typical enterprise implementation: 6–18 months, $100K–$500K SI cost. |
| TOTAL | 100% | 8.05 / 10 | Excellent platform. Key weakness: pricing opacity and implementation cost. |
Salesforce procurement verdict: Score 8.05/10 — strong buy if you have the budget and implementation resources. Primary negotiation lever: push back hard on escalation clauses and add-on pricing. Lock in a 3-year contract with a 3% annual cap and free Premier Support as part of the deal.
| Dimension | Weight | Score (1–10) | Weighted Score | Notes |
|---|---|---|---|---|
| Security & Compliance | 25% | 9 | 2.25 | SOC 2 Type II, ISO 27001, FedRAMP High, HIPAA. Government-grade compliance. |
| Pricing Transparency | 20% | 3 | 0.60 | No published pricing. Full "contact sales." Aggressive escalation (10–15% standard). Module sprawl — each workflow costs extra. |
| Support & SLA | 20% | 8 | 1.60 | 24/7 enterprise support. Dedicated TAM at higher tiers. 99.95% SLA. Strong incident response. |
| Integration Ecosystem | 15% | 8 | 1.20 | Store with 500+ apps. Strong ITSM ecosystem. APIs well documented. Weaker outside IT workflows. |
| Vendor Stability | 15% | 10 | 1.50 | NYSE: NOW. $10B+ ARR. One of the most stable enterprise SaaS vendors in existence. |
| Implementation Complexity | 5% | 3 | 0.15 | Very complex. Most implementations require certified ServiceNow SI. 12–24 month implementation common. |
| TOTAL | 100% | 7.30 / 10 | Excellent platform, serious pricing and complexity concerns. |
ServiceNow procurement verdict: Score 7.30/10. The platform is best-in-class for large enterprises (2,000+ employees) but dangerously opaque on pricing. Engage an independent ServiceNow pricing consultant before signing — vendors in this market routinely achieve 25–40% discounts off initial quotes.
| Dimension | Weight | Score (1–10) | Weighted Score | Notes |
|---|---|---|---|---|
| Security & Compliance | 25% | 7 | 1.75 | SOC 2 Type II, GDPR DPA available. No FedRAMP or HIPAA BAA (not appropriate for healthcare). Good for most commercial use cases. |
| Pricing Transparency | 20% | 7 | 1.40 | Fully published pricing by contact tier. Escalation tied to contact list growth (a usage trap — pricing can 3x as marketing grows). Annual escalation around 5%. |
| Support & SLA | 20% | 6 | 1.20 | Enterprise tier: phone + priority support. Professional tier: email + chat. No formal SLA with financial penalty. 99.9% uptime target (not guaranteed). |
| Integration Ecosystem | 15% | 8 | 1.20 | 1,400+ native integrations. Strong Salesforce connector. Native ops for marketing stack (Segment, Intercom, etc.). APIs well documented. |
| Vendor Stability | 15% | 9 | 1.35 | NYSE: HUBS. $2.5B+ ARR. Profitable. Strong growth trajectory. Not going anywhere. |
| Implementation Complexity | 5% | 8 | 0.40 | Relatively easy to implement. Self-serve setup possible. Professional implementation available at $5K–$20K. |
| TOTAL | 100% | 7.30 / 10 | Strong mid-market fit. Watch contact-based pricing at scale. |
HubSpot procurement verdict: Score 7.30/10. Excellent fit for companies under 500 employees. The key risk is contact-based pricing — as your marketing database grows, costs can triple without a contract cap. Negotiate a flat-fee structure or a contact cap with annual true-up at renewal, not a per-contact pricing model.
The scorecard is a guide, not a mandate. Three situations where you should override the quantitative score:
If your use case requires HIPAA BAA and a vendor scores 7.5/10 but doesn't offer a BAA — they are disqualified regardless of score. No exceptions. Compliance is binary for regulated data.
Some tools have network effects so strong that the switching cost is permanently prohibitive. Salesforce's AppExchange ecosystem, for example, creates deep integration lock-in. If your entire industry uses one platform, your customers, prospects, and partners all have integrations with it. A category-leader scoring 6.5/10 may still be the right choice because the switching cost to a 7.5/10 competitor exceeds the gain.
If your team's best engineer or sales leader knows one platform deeply and would struggle to adopt an alternative, account for productivity loss. Switching from a 7/10 platform your team knows to an 8/10 platform they don't know can cost 6–12 months of reduced output. The score doesn't capture human capital risk.
The scorecard is also your negotiation framework. Once scored, you know where your vendor is weak — and weak spots are leverage.
Copy this table into a spreadsheet for your own vendor evaluations. Score each vendor 1–10 per dimension, multiply by weight, sum for total.
| Dimension | Weight | Vendor A Score | Vendor A Weighted | Vendor B Score | Vendor B Weighted | Notes |
|---|---|---|---|---|---|---|
| Security & Compliance | 25% | |||||
| Pricing Transparency | 20% | |||||
| Support & SLA Quality | 20% | |||||
| Integration Ecosystem | 15% | |||||
| Vendor Stability | 15% | |||||
| Implementation Complexity | 5% | |||||
| TOTAL | 100% | __ / 10 | __ / 10 |
Interpretation guide:
Never miss a renewal: Get email reminders before each contract renews → Track renewals free
See what rising SaaS prices cost your team →
Run free audit tool30 tools, instant cost breakdown, shareable reports