Choosing where your CRM runs is mostly decided in a sales conversation, and sales conversations are good at answering the questions you remembered to ask. The goal of this piece is to hand you the questions people tend to forget, along with a sense of what a good answer sounds like. It assumes you have already chosen a hosting model and are now comparing specific providers.

Throughout, treat verbal assurances as untrusted until they appear in a contract, a service description or published documentation. If an answer matters, get it in writing.

Start With What You Actually Need

Before talking to anyone, write down your own requirements: how many users, how critical availability is, what regulations touch your data, which integrations must keep working, and what a day of downtime would cost. Without this, you will compare providers on whatever they emphasise, usually the headline feature list.

Rank the requirements as must-have, important and nice-to-have. A provider that fails a must-have is out, however polished the demo.

Availability and Support

What does the service level agreement actually promise, and what happens when it is missed? Many agreements offer service credits rather than any real remedy, and exclude scheduled maintenance, third-party failures and sometimes entire categories of incident. Read the exclusions section first.

How is uptime measured, and by whom? Measured at the provider’s edge, at your application, or by an independent monitor? The difference matters.

What are the support hours and escalation paths? A cheerful ticket system is no help at three in the morning. Ask how severe incidents are declared, how quickly a human responds, and whether you get a named contact or a queue.

How are you told about maintenance and incidents? Look for advance notice windows, a status page, and post-incident reports that explain the cause.

Data, Backups and Recovery

This is where the largest surprises live.

Who is responsible for backups? Never assume it is included. Ask what is backed up, how often, how long copies are kept, where they are stored, and whether they sit in the same place as the live system.

Has restore been demonstrated? Ask whether the provider can show a restore test, and what recovery time and recovery point they will commit to in writing. A promise to “take backups” is not a promise to restore them in a useful timeframe.

Where will the data physically live? Location can matter for legal and contractual reasons that depend on your jurisdiction and customers. Ask about primary and backup locations and about any subprocessors involved, and have a qualified adviser check the implications.

How is data protected? Ask about encryption in transit and at rest, who at the provider can access your data and under what controls, and what independent security assessments they hold. Request the current documents rather than a summary.

Control and Flexibility

How much can you configure? Some arrangements give you full administrative access to servers and databases, others restrict you to application settings. Check that you can do what your integrations and customisations require, such as installing extensions, reaching the database for reporting, or scheduling jobs.

How are upgrades handled? Are you forced onto new versions on the provider’s schedule, or can you defer? Can you test on a separate environment first? Ask how much notice you get of breaking changes.

How does scaling work? Understand what happens when you need more capacity: is it automatic, a request, or a contract change, and how long does it take?

The Exit Plan

Ask about leaving before you arrive. It is the least pleasant topic and the most revealing.

Can you export all your data, in what format, and at what cost? A reasonable answer names a standard format, includes attachments and history, and does not depend on the provider’s cooperation at the moment you are leaving.

What are the notice period and termination terms? Look for auto-renewal clauses, minimum terms and fees for early exit.

What happens to your data after you leave? Ask how and when it is deleted, and whether you receive confirmation.

A Comparison Scorecard

Area	Question to confirm	Good sign	Warning sign
Availability	SLA remedy and exclusions	Clear, measurable, independent monitoring	Vague wording, broad exclusions
Backups	Scope, frequency, restore evidence	Written commitments and a tested restore	“Backups are available” without detail
Data location	Primary, backup, subprocessors	Documented and contractually fixed	Cannot say where data sits
Security	Encryption, access, assessments	Current documents provided	Summary slides only
Control	Admin access, upgrade timing	Matches your integration needs	Locked down beyond your requirements
Support	Hours, escalation, incident reports	Named process, post-incident reviews	Ticket queue only
Exit	Export format, cost, deletion	Standard export, no obstacles	Export only on request, unclear fees

A Hypothetical Example

Suppose a mid-sized team is choosing between two providers who both quote similar monthly costs. Provider A’s proposal lists daily backups but says nothing about where they are stored or how fast a restore would be. Provider B states in the service description that backups are kept in a separate location and commits to a restore target, though its support hours are shorter.

Walking through the scorecard, the team realises their real fear is data loss, not slow ticket replies. They ask Provider A the restore question directly and find the answer is “best effort.” That settles it. The cheaper-feeling option had the weaker commitment on the thing they cared about most.

Frequently Asked Questions

Should we ask for references from existing customers? Yes, ideally from organisations of similar size and complexity. Ask them specifically about incidents, how the provider communicated, and how upgrades went, rather than whether they are generally happy.

Is a longer contract term better? It may reduce the unit cost, but it locks you in. Balance that against how confident you are in the provider, and keep the exit terms in mind before agreeing to a long commitment.

Can we run a trial first? Where possible, run a realistic pilot with your own integrations and a masked data sample. It tends to expose limitations a demonstration never will.

Who should be involved in the evaluation? Operations or infrastructure staff, a security or privacy representative, someone who owns the integrations, and a business sponsor who understands the cost of downtime.

How do we handle legal and compliance questions? Requirements vary by jurisdiction and industry, so have qualified legal or compliance advisers review data location, subprocessor and contractual terms before signing.

Next Step

Copy the scorecard into a shared document, add your own must-have requirements as extra rows, and send the questions to every shortlisted provider in the same form. Comparing written answers side by side is far more reliable than comparing impressions from demos.