Buyer’s glossary
35 terms you’ll meet on pricing pages, security questionnaires and contracts — explained in plain English, with links to the reviews and tools where they matter.
#
- 3-2-1 backup rule
- Keep three copies of important data, on two different types of storage, with one copy off-site or in the cloud. Backup software →
A
- Annual billing
- Paying for a year of a subscription up front, usually at a discount to the monthly price. Advertised “per month” prices are often the annual rate divided by 12.
- API
- Application programming interface — a documented way for software to exchange data with other software. A public API lets you connect a tool to others even when no ready-made integration exists.
- Auto-renewal
- A contract term that renews a subscription automatically at the end of each period unless you cancel within a notice window.
B
- BAA (business associate agreement)
- A contract required under HIPAA before a vendor can store or process protected health information on behalf of a US healthcare provider or its partners.
- Business VPN
- A service that encrypts traffic between staff devices and company resources or the internet, often with central admin controls. Business VPNs →
C
- Churn
- The share of customers or subscribers who cancel in a period. For buyers, high vendor churn in reviews can signal poor support or value.
- CRM
- Customer relationship management software: a shared database of contacts, companies and deals, with tools for tracking sales activity. CRM software →
D
- Data export
- The ability to download all of your data in a standard format (such as CSV or JSON). It determines how hard it is to leave a vendor later.
- DPA (data processing agreement)
- A contract that sets out how a vendor processes personal data on your behalf. Required under GDPR when a vendor handles personal data of people in the EU or UK.
E
- EDR
- Endpoint detection and response — security software that monitors laptops and servers for suspicious behaviour and helps you investigate and contain attacks. Endpoint security →
F
- Freemium
- A pricing model with a free plan that has limits on users, features or usage, and paid plans that remove those limits.
G
- GDPR
- The EU General Data Protection Regulation. It applies to businesses anywhere that handle personal data of people in the EU, and the UK has an equivalent law.
H
- HIPAA
- The US Health Insurance Portability and Accountability Act. Among other things, it sets rules for protecting patient health information, including what vendors must agree to.
I
- Integration
- A ready-made connection that moves data between two tools, such as syncing invoices from a CRM into accounting software.
- ISO/IEC 27001
- An international standard for running an information-security management system. Certification is granted by an accredited auditor and covers a defined scope.
L
- LLM
- Large language model — the type of AI model behind chat assistants and writing tools. Output can be wrong, so facts should be checked.
M
- MFA (multi-factor authentication)
- Signing in with something you know (a password) plus something you have or are (an app code, security key or fingerprint). It blocks most account takeovers.
- Migration
- Moving your data, settings and workflows from one tool to another. Effort depends on data volume, export formats and how many integrations need rebuilding.
O
- Onboarding fee
- A one-off charge for setup, implementation or training, separate from the subscription price. Often only disclosed in a quote.
P
- Password manager
- An app that creates, stores and fills unique passwords for every account, protected by one strong master password and MFA. Password managers →
- Per-seat pricing
- Pricing charged per user (seat) per month or year. Total cost rises with headcount, so check the price at your expected team size. Seat cost calculators →
- POS
- Point of sale — the hardware and software used to take payments in person, often combined with inventory and reporting.
- Price lock
- A contract promise that your price won’t rise for a set period, or that renewals are capped at a stated percentage.
R
- RFP (request for proposal)
- A document that lists your requirements and asks vendors to respond in a consistent format, so you can compare them fairly. Requirements builder →
- Role-based access control (RBAC)
- Permissions assigned by role (such as admin, editor, viewer) rather than person by person, so access is consistent and easy to revoke.
S
- SaaS
- Software as a service — software you rent by subscription and use in a browser or app, with the vendor running the servers.
- SLA (service level agreement)
- A vendor’s written commitment on uptime or support response times, usually with service credits if it is missed.
- SOC 2 Type II
- An independent audit report on how a service provider’s security controls operated over a period of time (typically 6–12 months). Type I covers a single point in time.
- SSO (single sign-on)
- Signing in to many apps with one company identity (for example via SAML or OpenID Connect). It lets you remove a leaver’s access everywhere at once.
- Sub-processor
- A third party a vendor uses to process your data, such as its cloud host. Reputable vendors publish a list and notify customers of changes.
T
- TCO (total cost of ownership)
- The full cost of a tool over time: subscription, add-ons, onboarding, training, admin time and switching costs — not just the sticker price. SaaS TCO calculator →
U
- Uptime
- The share of time a service is available. 99.9% uptime still allows roughly 8.8 hours of downtime a year. Downtime cost calculator →
- Usage-based pricing
- Pricing tied to consumption — such as messages sent, storage used or AI credits — rather than seats. Costs can be harder to predict.
Z
- Zero trust
- A security approach that verifies every user and device on every request, instead of trusting anything inside the office network.
Missing a term? Suggest one.