Inspection software holds an unusual combination of sensitive material: the documented condition of pressure equipment, findings that could be discoverable in litigation, site layouts and photographs, and records a regulator may rely on. When the security team reviews a vendor in this category, the generic SaaS questionnaire misses the parts that matter. This checklist covers the ground that actually decides whether the system can be trusted with an integrity program.
Identity and access
- SSO via your identity provider. SAML or OIDC federation against your existing IdP, so joiners, leavers, and contractor offboarding follow your directory, not a vendor user list someone forgets to prune. Ask specifically how a terminated contractor's access dies.
- MFA enforcement. Enforceable by policy, not merely available. Field tablets shared across a crew deserve their own hard look: how are individual identities maintained on shared devices, and what does a sign-off mean if the login is communal?
- Role-based access control at working granularity. Roles should distinguish who can record data, who can accept or sign, who can administer, and, for multi-site companies, who can see which sites. A contractor technician should be able to enter readings without being able to browse the fleet. Ask to see the role matrix, not a paragraph about it.
Isolation and integrity
- Tenant isolation. For multi-tenant SaaS, ask the architecture question directly: how is your data isolated from other customers, at the database and application layers, and how is that isolation tested? A vendor should be able to explain their model, whether shared-schema with enforced scoping or dedicated schemas, and what prevents cross-tenant queries. Vague answers here are disqualifying.
- Audit trail immutability. For a system of regulatory record, the audit trail is a security control. Signed records should be uneditable, corrections should create attributed revisions rather than overwrite history, and the trail itself should not be deletable by any customer-side administrator, including yours. Ask what a malicious admin could erase.
- Offline device security. Field capture means data at rest on tablets in trucks. Ask about device-level encryption, what a stolen tablet exposes, and whether unsynced data can be remotely revoked.
Data rights and residency
- Export as a contractual right. You should be able to extract all of your data, records, history, attachments, audit trails, in documented formats, on your own initiative, without professional services. Test the export during the pilot, not during the divorce.
- Data residency. Know which jurisdictions your data is stored and processed in, including backups and support access. For some operators this is regulatory, for others contractual, but it should never be a surprise. Ask where support engineers sit and what they can see.
- Retention and deletion. What happens to your data after termination, on what timeline, with what certification of destruction.
Posture, honestly stated
Ask for the vendor's security attestations and read them rather than the sales summary. SOC 2 reports, where a vendor holds or is pursuing one, describe scope and exceptions that matter more than the logo on the website; verify the current status and scope directly with the vendor, and treat any certification claim you cannot verify as unmade. Ask also about penetration testing cadence, vulnerability disclosure handling, and breach notification commitments in the contract.
Run the review against the pilot
Paper answers are the weakest form of evidence. The strongest security review runs the checklist against a live pilot: provision a user through your SSO, attempt cross-role access, edit a signed record and inspect the trail, run the export, pull the tablet's storage. An hour of adversarial testing outweighs fifty questionnaire pages.
At intelliSPEC this checklist reflects how we expect to be examined: SSO and role-based access, tenant isolation, an immutable audit trail, and export rights are design commitments, and our SOC 2 posture is exactly the kind of claim we would tell you to verify with us directly rather than accept from a blog. Bring the adversarial hour. It is the fairest test there is.
