Buying construction software is usually a conversation about features: estimating, job costing, scheduling, field reporting. Security tends to appear at the end, if at all, often as a checkbox on a form the vendor filled out themselves. Yet once the software is in place, it holds your bids, payroll, bank details, owner contracts and sometimes subcontractor tax information. A weak vendor is a weak spot in your business.
You do not need to be a technical expert to vet a vendor. You need a short list of questions, a willingness to ask them in writing, and the discipline to notice when answers are vague.
Access and Identity
Start with how people sign in, because this is where most incidents begin.
- Does the platform support multi-factor authentication for every user, and can an administrator require it?
- Does it support single sign-on with Microsoft 365 so that when you disable an employee's account, access ends everywhere?
- Can you define roles with limited permissions, such as read-only for owners' reps or project-specific access for subcontractors?
- Is there an audit log of who logged in, who exported data and who changed permissions, and how long is it kept?
If a vendor cannot require MFA, treat that as a serious finding. If the audit log is missing or minimal, you will struggle to investigate anything later.
Your Data
- Where is the data stored, and who at the vendor can see it?
- Can you export all of your data in a usable format at any time, and what does that cost?
- What happens to your data if you cancel? How long is it kept, and is it deleted on request?
- Is data encrypted in transit and at rest?
The export question matters more than most buyers realize. A system you cannot leave is a system that holds you hostage at renewal time, and a system you cannot export from is difficult to restore if something goes wrong.
Backups and Availability
Ask what the vendor backs up, how often, and how quickly they can restore. Ask whether those backups protect against their failures only, or whether you can recover a record you deleted by mistake. Many cloud vendors protect their infrastructure but leave accidental deletion and bad imports to you, so find out what your own responsibility is.
For accounting and payroll systems, ask what the plan is for an outage during a pay run or a month-end close.
Incident Handling
Every vendor will eventually have an incident. What you need to know is how they behave.
- Do they commit in the contract to notify you of a breach affecting your data, and within what timeframe?
- Do they have a written incident response plan, and when did they last test it?
- Who is your contact during an incident, and is there a way to reach a person outside business hours?
Third Parties and Integrations
Modern construction software connects to accounting, payroll, document storage and dozens of add-ons. Ask which third parties the vendor shares your data with, how integrations authenticate, and whether you can see and revoke each connection. An integration that holds permanent, broad access is a quiet risk.
Compliance Where It Applies
If you handle defense work, ask whether the vendor can support your obligations for controlled unclassified information, since a cloud service that stores such data may need to meet specific requirements. If you are a utility or serve one, ask how the vendor treats access by its own staff and subcontractors. Do not accept a logo or a generic claim; ask what exactly is covered and request documentation such as an independent audit report summary.
How to Judge the Answers
Good vendors answer plainly, sometimes with documentation and sometimes with an honest limitation. Warning signs include:
- Answers that restate the question without detail
- Refusal to put security commitments in the contract
- No way to export your data
- Pressure to skip review because a discount ends Friday
Put the questions in an email, keep the answers, and have whoever manages IT review them before the contract is signed. Have the contract reviewed for liability, data ownership and termination terms.
Getting a Second Opinion
Ironfield Cyber supports Procore, Sage, Viewpoint, Autodesk and Microsoft 365 for contractors and energy companies. If you are weighing a new platform or a renewal, we can help you build the question list and review the vendor's answers before you commit.