Access and responsibilities
Confirm how users are invited, which roles are available and how access is removed when responsibilities change.
Organisation boundaries
Ask how records are associated with your organisation and how access is scoped across users, locations and subscriptions.
Backups and recovery
Confirm backup frequency, retention and the recovery process as part of the actual service agreement. Do not infer commitments from a general feature list.
External services
Identify data shared with any configured integrations and confirm the purpose, destination and responsibilities before enabling them.