Signing a contract with an ERP vendor is one of the longest-term decisions you will make in business. The average Slovak SMB stays with its ERP vendor for 7-9 years. Divorce tends to be expensive, painful, and full of lost data. That is why it is worth spending a few hours before signing to ask the right questions, and even more time carefully reading the answers.
In this article you will find 10 questions our consultants recommend to all clients. These are not “handy” questions like “What is the price?” (which any salesperson answers without hesitation), but deeper questions that separate serious vendors from those with whom you will eventually live through five years of pain.
1. “What API do you provide and what can we do through it?”
The API is the cornerstone of a modern company. If your ERP does not have a fully-featured API, you are locked in a silo and future integration with the e-shop, accounting, or payroll system will be expensive and fragile.
What to listen for in the answer:
- REST or GraphQL? (Modern ERPs typically support both)
- What operations are available? Ideal: everything you see in the UI, you can also do via the API. If the vendor says “we have an API, but only for some functions,” be careful.
- Webhooks? Event-driven integrations are the standard in 2026.
- Rate limiting and limits. How many API calls per day? Do you pay for additional ones?
- Documentation. Ask for a link, if they cannot show it to you (or it is “available only after signing”), run away.
Modulario provides a fully documented REST API with all CRUD operations, webhooks, and a free limit of 10,000 calls per day for every client.
Tip: In the contract, require a guarantee that the API will not be discontinued without 12 months’ advance notice. Some vendors in the past discontinued the old API version “immediately” and clients had 30 days to react. That is devastating.
2. “Who owns the data and how do I get it out anytime?”
Data ownership is the most important contractual question. The data you generate in the ERP, invoices, customers, warehouse, employees, manufacturing, are yours. Not the vendor’s. But that is not always clearly written in the contract.
What to listen for in the answer:
- “The data is yours” (nothing else is acceptable)
- What export formats, ideally CSV, JSON, SQL dump, plus structured PDF invoices
- How often you can export, ideally unlimited and anytime
- Whether there is an “export button” in the UI, or only on request
- Whether the export includes historical data, logs, and audit trail
Red flags:
- “Export is paid”
- “Export only after the warranty period expires”
- “Export format is our proprietary one”
3. “What is the exit strategy, what would it look like if I wanted to leave in 5 years?”
This is a question salespeople do not like to hear, which is exactly why you must ask it. A serious vendor has the exit strategy documented and can show it to you in their standard contract.
What to listen for in the answer:
- Step-by-step plan: how many days for export, format, vendor’s assistance
- Cost of migration away: ideally free in the first year, nominal fee in subsequent years
- When your data is deleted: typically 90 days after termination, but it must be clearly written
- Who signs “data has been handed over”: a handover certificate is important for your compliance
DORA and NIS2 in 2026 require financial institutions and providers of critical infrastructure to have a written exit strategy as a contract condition. Even if you are not a bank, demand it too.
4. “What is your SLA and what is the compensation for breaching it?”
The Service Level Agreement (SLA) defines how often the system must work and what you get when it does not. Many vendors offer a nice “99.9%,” but in the fine print there are exceptions (planned maintenance, force majeure, infrastructure changes) that turn the SLA into a marketing number.
What to listen for in the answer:
- Real uptime number. 99.9% = 8.7 hours of downtime per year. 99.95% = 4.4 hours. 99.99% = 52 minutes.
- What counts and what does not. Planned maintenance outside business hours is usually not counted. Fair. But “force majeure” should not include the cloud provider’s problem.
- Response time and resolution time. P1 critical issue, reporting within an hour, resolution within 4 hours? Or just “as soon as possible”?
- Compensation. Service credit (discount on the next invoice) is the standard. Concretely, at 99.8% you get 10%, at 99% you get 30%.
5. “What do you have on the roadmap for the next 18 months?”
A good vendor has a public roadmap and can show it. Not every detail, but at least the main lines of development, new modules, integrations, platform improvements.
What to listen for in the answer:
- Specificity: “Q3 2026 mobile app refresh, Q4 2026 AI reporting module” is good. “We are working on lots of things” is bad.
- Focus: Does the vendor address your sector? If you are a construction company and you only see e-commerce modules on the roadmap, you are not their target audience.
- Innovation: In 2026, the roadmap should include AI assistance, compliance improvements (DORA, NIS2), mobile-first features.
6. “How do you handle security and where is it audited?”
Security in 2026 is not an optional feature. If a vendor does not have at least basic certifications and processes, you walk away.
What to listen for in the answer:
- Certifications: ISO 27001 is the minimum today. SOC 2 Type II is a plus. ISO 27701 (privacy) is a bonus.
- Penetration tests: at least once a year by an external firm, report on request (at least the management summary).
- Encryption: AES-256 at rest, TLS 1.3 in transit.
- MFA: mandatory for admins, recommended for everyone.
- Backups: the 3-2-1 rule (3 copies, 2 media, 1 off-site). RPO and RTO in hours, not days.
- Incident response: 24-hour notification to customers, 72-hour NIS2 notification to authorities.
7. “How many clients from my sector / my size use your system?”
References are gold. An ERP that works well for a marketing agency can be hell for a manufacturer, and vice versa. Ask specifically.
What to listen for in the answer:
- The vendor willingly provides 3-5 reference contacts from your sector and size.
- Ideally, some are available for a direct phone call, not just a written reference.
- When you call, ask: “What annoys you most about the system?” and “If you had to decide again, would you buy again?“
8. “What does a typical onboarding and implementation look like for companies my size?”
Bad implementation will ruin even the best system. Good implementation will save even an average system.
What to listen for in the answer:
- Length: 2-8 weeks for SMB, 3-6 months for mid-sized companies. Anything shorter or longer requires explanation.
- Phases: kick-off, data migration, configuration, testing, training, go-live, stabilization.
- Team: project manager on your side + consultant on the vendor side + technical specialist. If everything rests on one person, it will not be good.
- Methodology: Agile with 2-week sprints or waterfall. Both work with proper management.
- Pricing: fixed or T&M? Fixed gives predictability, T&M gives flexibility. Hybrid (fixed for stable parts, T&M for customization) is ideal.
9. “What do you do when a customer requests a customization that is not on your plan?”
An excellent question that reveals the vendor’s culture. Some ignore (rigid monolith), others “we will program it for you” everything (but then you have a custom version that cannot be upgraded).
What to listen for in the answer:
- Product roadmap: if the request is relevant for multiple clients, it goes onto the roadmap (3-12 months).
- Customization through configuration: a good modern ERP has rich configuration, custom fields, custom workflows, custom reporting, without touching code.
- Plugin / script: for specific needs, the option to write a custom plugin or script (or via a partner).
- Hard-coded customization: a last resort, only when there really is no other way, and the contract must specify how it is maintained through upgrades.
10. “What happens if your company goes bankrupt or someone acquires you?”
An uncomfortable but key question. Your ERP is critical infrastructure, if the vendor falls, you fall too.
What to listen for in the answer:
- Financial stability: ask for the last 2 financial statements (they are in the Commercial Bulletin, so it is not a problem to show them).
- Number of employees and year founded. If the vendor has 3 employees and a year on the market, that is a different risk than 50 people and 10 years.
- Escrow: some vendors offer source code escrow, in case of bankruptcy you have rights to the source code. Recommended for critical systems.
- M&A scenario: what happens if a larger company acquires them? A guarantee of product continuity for at least 36 months is a fair requirement.
Bonus, how to verify the answers
Hearing the answer is not enough. You must verify it. Four techniques that work:
- Trial or sandbox. Minimum 14 days, ideally 30 days with real data.
- Proof of Concept (PoC). For important integrations, request that the vendor shows a working PoC even before signing.
- Technical due diligence with your own IT or external consultant. 4-8 hours of work, 500-1,500 EUR, can save tens of thousands.
- Reference visit. Spend half a day at an existing client. You see the system in production, talk to users, feel the reality.
Conclusion, honesty over sales talent
When selecting an ERP, do not start with trust, start with questions. A vendor who honestly answers even uncomfortable questions (what happens if I go bankrupt, what does the exit strategy look like) is more reliable than one who turns everything into a “marketing video.” The ten questions above will help you, in a single 90-minute meeting, understand who you are dealing with.
If you want to be sure you are entering the contract with eyes open, download our detailed checklist with space for notes, we prepared it for exactly these ten areas. If you are interested in how Modulario answers these questions, book a 45-minute demo, you will get the answers in writing and signed.