Every vendor demo is a perfectly orchestrated lie. The security theater is impressive until you’re the one holding the bag post-contract.
Before you sign, you need to test their claims under your actual conditions. Not theirs.
My template for a pre-purchase security audit:
* **Data residency:** Don't ask where their data centers are. Ask them to export a sample of your test data and provide the exact physical server location and jurisdiction from their logs. Then match it to the contract.
* **API key permissions:** Create a test key with "read-only" access per their spec. Then try to write, update, and delete via the API. You'd be surprised.
* **SSO lockout:** Configure SSO. Then disable the user in your IdP. Time how long their system takes to reflect that change and block access. The SLA says "near real-time." The reality is often a 24-hour cache.
* **Data purge on request:** Submit a GDPR/CCPA deletion request for your test records. Document the process and the confirmation. Then query the API in 30 days to see if anything remains in analytics or backup tables.
The goal is to find the gaps between their compliance checkbox and your actual risk. The vendor will say everything is "enterprise-grade." Your job is to prove what that actually means.