How do I evaluate vendor security when choosing SaaS tools?

Key security questions for any SaaS vendor: Do they have SOC 2 Type II certification? Where is data stored and which sub-processors do they use? What is their breach notification policy? Do they support SSO and MFA? Is data encrypted at rest and in transit? Most vendors will share a security overview document upon request — don't skip this step for tools that will hold customer data.