The IT Review Your Spend Tool Has to Pass

The demo went well. The category managers want it. Finance approved the budget. Then the email arrives.

"Looping in our security team before we go further."

For most spend tools, this is where momentum dies. Not because the answers are bad. Because nobody prepared them. The procurement champion forwards questions to the vendor, the vendor sends documents back, and three weeks pass while a cybersecurity engineer waits on a pen test report.

I have sat in a lot of these reviews over the last few months. The questions are almost always the same. That is good news. It means they can be answered before anyone asks.

Here are the eight I hear most, and what a good answer looks like.

1. What data leaves our network, and what stays?

This is always the first question, and it should be.

Spend analysis needs supplier invoices, purchase orders, line items, and vendor details. It does not need engineering drawings, sales data, employee records, or bank account numbers.

A good answer is a field list, not a promise. Ask the vendor for the exact extract template before the call. Your IT team can scope the connection to those fields and nothing else.

2. Whose data sits next to ours?

Security teams want to know whether your spend data shares databases or models with other customers.

A good answer is isolation by design. No cross customer data. No cross customer benchmarking. SpendCraft isolates every customer workspace.

If a vendor offers industry benchmarks built from other customers' spend, ask the obvious follow up. How does your data feed theirs?

3. Where is the AI, and does it touch the numbers?

This question is newer. It is now on every review.

AI governance committees want to know which parts of the product use a language model, and whether any figure a CFO will see came out of one.

A good answer separates the two clearly. In SpendCraft, deterministic logic produces every number, including every savings range. Proprietary AI classifies, narrates, and drafts suggestions, and each suggestion cites the metric behind it. I wrote up the full architecture in How SpendCraft Thinks About AI.

4. Is our data used to train anything?

Ask this directly. Then ask for the answer in writing.

"We do not" on a sales call is not the same as a clause in the data processing agreement. A good answer points to the contract language. If the vendor cannot point to it, that is your answer.

5. What independent evidence can you show?

Self attestation does not clear a security review. Independent evidence does.

A good answer is a current report your team can read under NDA. SpendCraft is SOC 2 Type II, completes independent third party penetration testing every year, and aligns with the NIST AI Risk Management Framework.

Ask any vendor for the report date, not just the name of the certification.

6. How does it connect, and can it write back?

IT teams worry about two things here. How much work the connection takes. And whether the tool can change anything in the ERP.

A good answer gives you options. File extracts, a staged copy in your data warehouse, or a direct connector. Your choice. The connection should be read only, with no write back to your systems, and it should run on a schedule your team controls.

Most teams I work with start a pilot on a single file extract. They connect live systems once the pilot proves out.

7. How do our people sign in?

Nobody wants another password list to manage.

A good answer is single sign on with your existing identity provider, included rather than sold as an add on. SpendCraft includes SSO on every plan.

8. What happens to our data if we leave?

This one gets skipped. It should not.

Your classified spend data is an asset. You should be able to take it with you. A good answer covers export formats, deletion timelines, and confirmation that deletion happened.

The review is not the obstacle

Starting it late is.

The teams that get to live data fastest do four things.

They bring IT in on the first call. Security questions asked early shape the pilot. Asked late, they stall the contract.

They send the documents before the meeting. SOC 2 report, pen test summary, extract template, connection options. The engineer reads first and asks second.

They scope by fields, not by systems. "These forty fields from AP and PO" is far easier to approve than "access to the ERP."

They pilot on a file and connect later. A one year extract lets procurement prove value while IT reviews the live connection in parallel.

None of this is complicated. The questions are known. The answers should be too.

The Savings OS.