15 Questions to Ask When Evaluating HRMS Vendors

Buying HR software is one of those decisions that feels straightforward until you’re actually in the middle of it. You schedule a few demos, watch some polished presentations, receive proposals that all seem reasonable, and then realize you’re comparing platforms that look similar on the surface but are actually very different where it matters most.

The vendor evaluation process for HRMS software is where most organizations make their costliest mistakes—not during implementation, not post-go-live, but during the selection process itself. They get impressed by a slick interface, reassured by a vendor’s name recognition, or swayed by a discounted price without asking the questions that would have revealed the platform’s critical gaps before the contract was signed.

What follows is a vendor-agnostic, experience-driven guide to evaluating HRMS vendors properly. The 15 questions in this guide aren’t theoretical—they’re the questions that separate vendors who can actually deliver on their promises from those who can only sell impressively. Each question comes with context explaining what you’re really trying to uncover and how to interpret the answers you receive.

Whether you’re an HR leader at a growing Indian startup navigating your first formal HRMS purchase, a global enterprise consolidating HR systems across multiple registered entities, or a CFO trying to ensure the business gets genuine value from a significant technology investment, this guide gives you the evaluation framework to make a decision you’ll stand behind three years from now.

Why Most HRMS Vendor Evaluations Go Wrong

Before the questions, it’s worth understanding the structural reasons why HRMS selection processes produce poor outcomes so frequently.

The Demo Problem

Vendor demonstrations are controlled environments designed to show software at its best. A skilled sales engineer can make almost any platform look capable during a 60-minute demo. The features that matter most to your organization—edge case payroll scenarios, multi-state compliance configurations, specific workflow automations—rarely get demonstrated unless you explicitly request them.

The Feature List Problem

Most HRMS vendors publish comprehensive feature lists that look nearly identical. “Payroll management. Leave management. Performance reviews. Employee self-service. Analytics.” These descriptions tell you almost nothing about depth, accuracy, or compliance capability. A platform that “supports payroll” might have a payroll engine with genuine Indian statutory compliance. It might also have a basic salary calculation tool that requires manual statutory deduction inputs. The feature list doesn’t tell you which.

The Reference Problem

Vendors provide references. Those references are, without exception, their most satisfied customers—screened and prepared to speak positively. Without knowing how to extract useful information from reference conversations, you learn little beyond “yes, we like the software.”

The Price Problem

The per-employee subscription price that anchors pricing discussions is almost never the complete cost picture. Implementation fees, data migration costs, training charges, integration development, module add-ons, and support tier upgrades routinely double or triple the cost that seemed reasonable during initial evaluation.

The 15 questions that follow are structured to cut through each of these problems systematically.

Before You Start: Set Your Evaluation Framework

Define Your Non-Negotiables First

Before speaking to a single vendor, document your organization’s specific non-negotiable requirements. These should include:

Employee count today and projected over three years
Statutory compliance requirements (PF, ESI, PT, TDS for India; equivalent for global)
Number of locations and states/countries of operation
Existing systems that must integrate with the HRMS
Specific modules required at launch vs those needed in future phases
Data security and residency requirements
Budget range including implementation

This document serves as your evaluation anchor—ensuring that every vendor conversation is filtered through your actual requirements rather than the vendor’s narrative about what requirements should look like.

Build a Standardized Evaluation Scorecard

Rate every vendor against the same criteria using the same scale. This eliminates the “recency bias” problem where the last vendor you spoke to feels most impressive simply because the conversation is freshest in your memory.

The 15 Questions to Ask Every HRMS Vendor

Category 1: Compliance and Statutory Depth

Question 1: “Walk me through exactly how your system handles [specific statutory requirement] for our industry and location. Don’t tell me you support it—show me.”

What you’re really asking: Whether the platform has genuine compliance depth or surface-level compliance claims.

This is the single most important question for any organization with statutory compliance obligations. The instinct of many HR buyers is to ask “does your system support PF and ESI compliance?” The inevitable answer is yes. The better approach is to request a live demonstration of a specific compliance scenario.

For Indian businesses, test scenarios should include:

PF calculation for an employee whose basic salary exceeds the ₹15,000 statutory wage ceiling
ESI applicability determination when an employee’s gross salary crosses the ₹21,000 threshold mid-year
Professional Tax deduction for an employee working across two different states in the same month
TDS calculation for an employee who submits investment proof declarations in February affecting the year’s accumulated TDS

For GCC-based businesses:

WPS SIF file generation for a payroll run including a mid-month joiner
End-of-service gratuity calculation for an employee resigning after 6 years and 3 months

How to interpret the response: A vendor who can demonstrate these scenarios confidently and accurately has genuine compliance depth. A vendor who says “our compliance team will configure that during implementation” has a compliance gap they’re hoping to address later—at your expense.

Red flag answer: “Our system is compliant with all applicable regulations.” This is a marketing statement, not a demonstration of capability.

Question 2: “How quickly does your system update when statutory regulations change, and what is the process for ensuring my configuration reflects those changes?”

What you’re really asking: Whether compliance is maintained proactively by the vendor or reactively by your team.

Statutory regulations change. PF wage ceilings get revised. Income tax slabs change in Union Budgets. ESI contribution rates are periodically updated. Professional Tax slabs vary by state and get revised by state governments. For global organizations, the equivalent regulatory change landscape is even more complex.

The difference between vendors on this question is significant:

Response Type	What It Means
“Updates are automatic and included in your subscription”	Strong—vendor takes responsibility for compliance currency
“We release patches that your IT team applies”	Moderate—requires disciplined update management on your side
“Our implementation team reconfigures when needed”	Weak—creates dependency on vendor professional services for routine compliance
“Compliance configuration is the customer’s responsibility”	Unacceptable—you’re buying a tool, not a compliance service

Follow-up question: “Can you give me an example of a significant regulatory change in the past 12 months and show me your documented response timeline from regulatory announcement to customer system update?”

Question 3: “What happens to our compliance obligations if we expand to a new state in India or a new country globally?”

What you’re really asking: How scalable the compliance architecture actually is.

This question is especially important for growing organizations—which most HRMS buyers are. A company with 80 employees in Mumbai today may have 300 employees across five states in three years. A startup registered as a Private Limited Company in India today may be exploring UAE or Singapore expansion within two years.

What strong answers look like:

The vendor explains a clear configuration process for adding new state-specific Professional Tax slabs, Shops & Establishments requirements, and local labor law variations
For global expansion: the vendor either has pre-built country compliance modules or a documented implementation process for adding new countries with realistic timeline and cost transparency
The vendor is honest about which countries or states are currently supported vs planned vs not supported

What weak answers look like:

“We’ll support whatever compliance you need”—without specifics about how
Vague references to “our compliance team” handling it without explaining the process or cost
Inability to confirm which specific Indian states or global countries have pre-built compliance configurations

Category 2: Implementation Reality

Question 4: “What does implementation actually involve for an organization our size, and who does what?”

What you’re really asking: The real division of labor between vendor and customer during implementation—and whether you have the internal resources to fulfill your side.

HRMS implementations routinely fail or overrun because organizations underestimate their own implementation workload. Vendors describe implementation in terms of their activities—configuration, data migration assistance, training delivery. They’re sometimes less explicit about the significant internal effort required from your side.

What you need to understand specifically:

How many hours per week will your HR team need to dedicate to implementation activities?
Who is responsible for data cleansing and preparation before migration?
Who configures leave policies, salary structures, approval workflows, and compliance parameters—the vendor or your team?
Who is responsible for user acceptance testing?
What happens if implementation runs over the projected timeline—who bears the additional cost?

Ask for a detailed implementation project plan showing each activity, its owner (vendor vs customer), estimated duration, and dependencies. This document reveals implementation reality far more clearly than any verbal description.

Question 5: “What can go wrong during implementation, and how have you handled it with past customers similar to us?”

What you’re really asking: The vendor’s self-awareness, experience with problem-solving, and honesty about risk.

This question is deliberately designed to bypass the polished sales narrative and get to something more honest. Every HRMS implementation encounters challenges. Vendors who claim otherwise are either inexperienced or not being straight with you.

Signs of a trustworthy answer:

The vendor proactively identifies common implementation risks (data quality issues, payroll parallel run discrepancies, change resistance from managers)
They describe specific situations they’ve navigated and how
They explain what early warning signs they look for and what intervention looks like

Signs of a concerning answer:

Dismissiveness about implementation risk (“our implementations always go smoothly”)
Generic platitudes without specific examples
Inability to describe how they’ve handled problems with past customers

This question also reveals how the vendor thinks about partnership vs transaction. Vendors who treat implementation as a partnership acknowledge shared risk and shared responsibility. Those treating it as a transaction focus on their deliverables and leave your risks to you.

Question 6: “What does the first 90 days post-go-live look like in terms of support?”

What you’re really asking: Whether there’s a structured hypercare period or whether you’re largely on your own after launch.

The first 90 days after HRMS go-live are the highest-risk period of the entire project. Configuration issues that weren’t caught in testing surface in production. Users encounter scenarios the training didn’t cover. Payroll discrepancies from the first production run need rapid investigation. This period demands intensive support—and vendors vary dramatically in how they structure it.

What strong post-go-live support looks like:

A named implementation contact remains available for a defined hypercare period (typically 4-8 weeks post-go-live)
Elevated response SLAs for critical issues during the initial post-launch period
Structured check-in calls at defined intervals (week 1, week 2, month 1, month 3)
Clear escalation path for payroll-critical issues

What inadequate post-go-live support looks like:

Immediate handover to general support ticketing system at go-live
No differentiation between hypercare period and standard ongoing support
Response SLAs measured in business days rather than hours for critical issues

Category 3: Data, Security, and Privacy

Question 7: “Where exactly is our employee data stored, and how does that align with our data residency requirements?”

What you’re really asking: Whether the vendor’s infrastructure meets your legal and regulatory obligations around data location.

For Indian businesses, this question has become increasingly significant with the Digital Personal Data Protection (DPDP) Act. For global organizations, GDPR in Europe, PDPA in Southeast Asia, and equivalent frameworks elsewhere create specific obligations around where employee personal data is stored and how it’s processed.

What you need to know specifically:

The physical location of primary data centers (country and city level)
Whether backup data is stored in different locations—and where
Whether data is ever processed outside the primary data center location
Whether India-based or region-specific data center options are available if required
The vendor’s documented approach to cross-border data transfer compliance

For formally registered companies with specific data residency obligations: Some business registration conditions—particularly for government contractors, financial institutions, and healthcare organizations—specify where employee data must reside. Verify your specific obligations before evaluating vendor data center locations.

Question 8: “What security certifications do you hold, and can you share your most recent audit report?”

What you’re really asking: Whether security claims are backed by third-party verification or just marketing language.

Security is one of the most frequently claimed and least verified capabilities in HRMS vendor evaluation. Every vendor claims their platform is secure. The question is whether that security claim is verified by independent third parties.

Certifications that matter:

ISO 27001: Information security management system certification—the global gold standard
SOC 2 Type II: Covers security, availability, and confidentiality—particularly relevant for cloud HRMS
ISO 27701: Privacy information management—increasingly important for GDPR and DPDP compliance

The audit report request is deliberate: Vendors with genuine security postures can share recent audit summaries or attestation letters. Those without current certifications or with findings they’d prefer not to disclose will resist this request. The response to this request itself is informative.

Follow-up: “What was the date of your most recent security penetration test, and can you share the executive summary?”

Question 9: “What happens to our data if we decide to leave your platform?”

What you’re really asking: Whether data portability is genuinely supported or whether vendor lock-in is built into the model.

Data portability is among the most overlooked evaluation criteria and among the most consequential. Organizations that discover their HRMS vendor makes data extraction difficult or expensive are effectively locked into the platform regardless of performance—because leaving means losing access to years of employee history.

What strong data portability looks like:

Complete data export in standard formats (CSV, Excel, JSON) across all modules
No additional fees for data extraction upon contract termination
Documented data deletion timelines post-contract (important for data protection compliance)
Clear process for migrating historical payroll data to a successor system

What vendor lock-in looks like:

Data export available only in proprietary formats requiring vendor-specific tools to read
Professional services fees for data extraction
Retention of data for limited periods post-termination that may not cover your statutory recordkeeping obligations
Contractual provisions that complicate data access upon non-renewal

Category 4: Product Depth and Roadmap

Question 10: “Show me how [specific workflow critical to our operations] works end-to-end in your system.”

What you’re really asking: Whether the platform handles your specific operational reality or only the generic scenarios shown in standard demos.

This question requires preparation on your part—you need to identify your 5-7 most operationally critical HR scenarios before vendor conversations begin. These should be the scenarios where your current process is most painful, most error-prone, or most compliance-sensitive.

Examples of scenario-based demo requests:

For an organization using an Employee Self-Service Portal for Leave:

“Show me a leave application submitted by an employee, approved by their manager, and automatically reflected in the payroll calculation for that month—including the loss-of-pay deduction if the leave type requires it.”

For hcm software evaluation in a performance-intensive organization:

“Show me a complete performance review cycle from goal-setting through manager rating, HR calibration, and final outcome communication to the employee—and show me the audit trail of that process.”

For payroll-intensive organizations:

“Show me a mid-month salary revision, including the arrear calculation for the days already processed in the current month and how this flows into the current month’s payslip.”

The vendor’s ability to demonstrate these scenarios confidently—without needing preparation time—tells you whether the capability is genuinely in the product or whether it’s something that “can be configured” during implementation.

Question 11: “What is your product roadmap for the next 12-18 months, and how are customer feature requests incorporated into your development priorities?”

What you’re really asking: Whether the platform will keep pace with your evolving needs and whether you have any influence over its direction.

This question serves two purposes. First, it gives you visibility into where the product is heading—whether capabilities you’ll need in 18 months are on the vendor’s roadmap. Second, it reveals how the vendor thinks about customer partnership vs product dictatorship.

Signs of a customer-centric product organization:

Structured process for submitting and voting on feature requests
Regular communication of roadmap updates to customers
Demonstrated examples of customer-requested features that made it into the product
Honest acknowledgment of capabilities currently on the roadmap vs those planned for future phases

Signs of a product-centric organization (where your needs fit the product, not vice versa):

Vague references to “continuous improvement” without specifics
Inability to share roadmap details due to “confidentiality” (often a sign there’s no structured roadmap)
No mechanism for customer input into product direction

Category 5: Pricing Transparency and Contract Terms

Question 12: “Give me a complete first-year and three-year cost model including every fee we might encounter.”

What you’re really asking: The real total cost of ownership, not just the headline subscription rate.

This is the question most vendors least want to answer in detail—because the headline per-employee subscription price is almost always the most attractive number in the cost picture, and comprehensive cost transparency often reveals a significantly higher total investment.

Complete cost categories to request:

Cost Category	What to Ask About
Subscription fees	Per-employee rate, minimum user commitments, tier thresholds
Implementation fees	What’s included, what’s extra, milestone-based vs time-and-materials
Data migration	Is it included or separately charged? What’s the scope?
Training	How many sessions? On-site vs remote? Recorded materials?
Integration development	API access fees, integration development costs, third-party connector fees
Module add-ons	Which modules are in the base price vs additional subscription
Support tiers	Base support included vs premium support add-on pricing
Annual price increases	Contractual limits on year-over-year subscription price increases
Exit costs	Data extraction fees, termination notice requirements

The three-year model is deliberate: Year 1 costs include implementation, which inflates the comparison. A three-year model amortizes implementation costs and reveals the ongoing subscription and support cost structure more clearly—which is what you’ll be living with for most of the relationship.

Question 13: “What are the contractual protections if the system doesn’t perform as demonstrated or if implementation takes significantly longer than projected?”

What you’re really asking: What recourse you have if things go wrong—and whether the vendor is confident enough in their product to offer meaningful protections.

This is a question most buyers don’t think to ask—and vendors don’t volunteer the answer. The result is organizations that discover, mid-implementation, that their contract offers essentially no meaningful recourse for underperformance or timeline overrun.

Contractual protections worth negotiating:

Performance SLAs with remedies: Uptime guarantees with defined financial remedies for non-performance (not just the right to terminate)
Implementation milestone commitments: Agreed go-live dates with penalties or credits for vendor-caused delays
Feature availability guarantees: Documentation of specific features promised during the sales process as contractually committed
Compliance accuracy warranties: Vendor acknowledgment of responsibility for statutory calculation accuracy
Price lock provisions: Protection against significant subscription price increases during the initial contract term

How to interpret vendor responses: A vendor who readily agrees to document performance commitments contractually is confident in their product. A vendor who resists contractual performance commitments is not.

Category 6: References and Track Record

Question 14: “Can you provide three references from customers similar to us in size, industry, and geographic complexity—and will you give us their contact details for a direct conversation?”

What you’re really asking: Whether the vendor has genuine experience with organizations like yours—and whether they’re willing to let those organizations speak freely.

Reference management is a practiced art in enterprise software sales. Vendors maintain short lists of their best customers who are primed and willing to speak positively. To make reference conversations genuinely useful, you need to approach them strategically.

How to extract genuine insight from reference conversations:

Ask references:

“What were the two or three things that went worse than expected during implementation, and how did the vendor respond?”
“If you were making this decision again knowing what you know now, what would you do differently?”
“What capabilities do you wish the platform had that it currently doesn’t?”
“How responsive is support when you have a critical issue?”
“Has the platform ever had an issue that affected payroll accuracy? How was it handled?”

These questions bypass prepared positive narratives and surface honest assessments—including the nuances that distinguish excellent from acceptable vendor relationships.

The direct contact requirement is important: References provided only as managed introductions through the vendor’s customer success team are not the same as direct conversations. Insist on direct contact details.

Question 15: “What is your customer retention rate, and how many customers have left your platform in the past two years?”

What you’re really asking: The single most honest indicator of whether existing customers are satisfied enough to stay.

Customer retention rate is the metric that cuts through all marketing claims, reference curation, and demo polish. If a vendor’s existing customers are staying, that’s a genuine signal of delivered value. If customers are leaving at meaningful rates, that’s a signal worth investigating regardless of how impressive the sales process was.

What constitutes strong vs concerning retention:

90%+ annual retention: Strong—suggests high customer satisfaction and delivered value
80-90% annual retention: Moderate—some churn that may reflect normal contract ends or competitive losses
Below 80% annual retention: Concerning—indicates meaningful dissatisfaction in the existing customer base

Expect resistance to this question. Most vendors will not volunteer specific retention figures. Responses like “we have very high customer satisfaction” without numbers, or “our customers are our biggest advocates” without data, should be noted. Press for specifics: “Can you share your actual renewal rate for the past 12 months?”

If a vendor genuinely has strong retention, they’ll share it. If they don’t, their evasion tells you something important.

Building Your Vendor Comparison Framework

After completing evaluations using these 15 questions, organize your findings into a structured comparison:

Vendor Scorecard Template

Evaluation Category	Vendor A	Vendor B	Vendor C
Compliance depth (Q1-Q3)	/10	/10	/10
Implementation capability (Q4-Q6)	/10	/10	/10
Data security and privacy (Q7-Q9)	/10	/10	/10
Product depth and roadmap (Q10-Q11)	/10	/10	/10
Pricing transparency (Q12-Q13)	/10	/10	/10
Track record (Q14-Q15)	/10	/10	/10
Total Score	/60	/60	/60

Weight categories based on your organization’s priorities. An organization with high compliance complexity should weight Questions 1-3 more heavily. An organization with significant integration requirements should weight product depth questions accordingly.

Red Flags That Should Stop Your Evaluation

Some vendor behaviors during the evaluation process are significant enough to warrant removing the vendor from consideration regardless of other strengths:

Resistance to scenario-based demos: A vendor who insists on controlling the demo agenda entirely and won’t demonstrate your specific scenarios is hiding something
Inability to provide references with direct contact details: Suggests the reference program is more managed than genuine
Vague or evasive answers to compliance specifics: Compliance depth is either there or it isn’t
Pressure tactics around pricing deadlines: “This price is only valid until end of month” is a negotiating tactic, not a genuine constraint—and vendors who use it are signaling how they’ll behave post-sale
Resistance to contractual performance commitments: Confidence in a product is demonstrated by willingness to stand behind it contractually
Unwillingness to discuss retention rates: Companies with high customer satisfaction don’t hide their retention data

The Business Registration and Compliance Connection

For organizations evaluating HRMS vendors in the context of a new business registration—whether launching a Private Limited Company in India, a Free Zone company in the UAE, an LLC in the US, or any other registered entity globally—the vendor evaluation timeline matters as much as the vendor selection itself.

The moment a company is formally registered and hires its first employee, statutory compliance obligations begin. Payroll must be processed correctly, statutory deductions must be calculated accurately, and in many jurisdictions, government filings must be submitted within defined timelines.

Organizations that begin their HRMS evaluation before or during the company registration process—rather than months after they’ve already started hiring—avoid the period of manual compliance management that invariably creates errors, missed deadlines, and records that need retroactive correction when the system eventually goes live.

The 15 questions in this guide apply equally whether you’re a startup evaluating your first HRMS or an established enterprise replacing a legacy platform. But for newly registered companies, these questions should be asked before hiring begins—not after the first payroll cycle has already been processed manually.

Conclusion

Evaluating HRMS vendors is not a process where impressive demos and compelling sales conversations should do most of the work. It’s a process where structured, specific, and sometimes uncomfortable questions should drive the decision—questions that reveal compliance depth rather than assuming it, that expose implementation reality rather than accepting optimistic projections, and that uncover total cost rather than anchoring on headline subscription prices.

The 15 questions in this guide aren’t designed to make vendor conversations adversarial. They’re designed to make them productive—to surface the information you genuinely need to make a confident decision that holds up three years into the relationship, not just three weeks after signing.

The organizations that invest properly in vendor evaluation—who ask hard questions, demand scenario demonstrations, pursue genuine references, and negotiate contractual performance commitments—make HRMS selections they don’t regret. Those that prioritize speed or comfort in the evaluation process often find themselves managing a difficult platform migration 18 months later, at significantly more cost and disruption than a thorough upfront evaluation would have required.

Take the time to do this right. Your employees, your compliance posture, and your business performance over the years ahead depend on it more than most technology decisions you’ll make.

Frequently Asked Questions (FAQs)

How many vendors should we include in our HRMS evaluation process?
Three to five vendors is the optimal range for most organizations. Fewer than three limits competitive leverage and may mean you’re missing better options. More than five creates evaluation fatigue and makes it difficult to conduct the deep, scenario-based evaluation that genuinely differentiates vendors. Start with a longer market scan to create a longlist, then narrow to three to five based on basic fit criteria before investing in structured evaluations using the 15 questions in this guide.
How long should a thorough HRMS vendor evaluation take?
For mid-sized organizations, allow 8 to 12 weeks from vendor shortlisting through contract signing. This timeline accommodates structured demos with real scenarios, reference conversations, contract negotiation, and internal stakeholder alignment. Compressing this timeline under pressure—end-of-quarter budget deadlines or urgent implementation needs—consistently produces worse selection outcomes. If a vendor is applying significant time pressure, that pressure should be treated as a negotiating tactic rather than a genuine constraint.
Should we involve IT in the HRMS vendor evaluation process?
Absolutely, and from the beginning—not just at the security review stage. IT’s involvement is critical for evaluating integration capability with existing systems, assessing data security architecture, understanding implementation infrastructure requirements, and reviewing contractual data handling provisions. Organizations that involve IT only at the contract review stage often discover integration or security requirements that require renegotiation or, in some cases, vendor reconsideration.
How do we evaluate HRMS vendors for Indian statutory compliance specifically?
Request live demonstrations of the specific compliance scenarios most relevant to your organization—PF calculation at and above the ₹15,000 basic wage ceiling, ESI threshold management, state-specific Professional Tax configuration, and TDS computation with various declaration scenarios. Ask explicitly about how the vendor handles regulatory updates when the Union Budget changes income tax provisions or when EPFO revises PF parameters. Verify that compliance configuration for all states where you have employees is included in the base subscription rather than charged as additional configuration work.
What is the most important factor when choosing between similarly priced HRMS vendors?
When vendors are similar in price and broadly comparable in features, compliance depth and post-implementation support quality become the decisive differentiators. Compliance depth—verified through scenario demonstrations, not feature claims—determines whether the system actually protects your organization from legal and financial risk. Post-implementation support quality determines your experience for the years after the sales team hands you over to the customer success team. References from existing customers are your most reliable source of honest insight into both.
Is it reasonable to negotiate HRMS contract terms, or are vendor contracts typically non-negotiable?
Most HRMS vendor contracts are negotiable, particularly around pricing, implementation terms, performance SLAs, data portability, and annual price increase caps. The degree of negotiating leverage depends on your organization’s size, the competitive dynamics of your evaluation (vendors who know they’re in a competitive evaluation are more flexible), and timing relative to the vendor’s sales quarter end. At minimum, always negotiate explicit data portability provisions, performance SLA remedies, and contractual limits on year-over-year subscription price increases—these protect your interests throughout the contract term and are frequently omitted from standard vendor agreements.