When Connectors Outnumber Contracts: A Pre-Renewal Audit for UK SaaS Estates
Photo: TheAHL, CC BY 2.0, via Wikimedia Commons
Integration debt is the accumulated cost of connections that work well enough to avoid attention. It appears as point-to-point connectors, scheduled CSV exports, spreadsheet handoffs and a middleware platform that nobody wants to touch because it keeps the estate running. It rarely appears on a renewal schedule. Yet it determines how easily an organisation can change supplier, consolidate systems or respond to a data request.
A pre-renewal audit does not need to become a consultancy engagement. It can be an afternoon exercise with a register, a few interviews and access to the contract. The objective is not to document every field mapping. It is to expose the dependencies that would make a renewal decision expensive.
Why the renewal is the right moment
Renewals are when commercial leverage is highest and when exit terms can still be negotiated. They are also when assumptions are most likely to be repeated. A system that is renewed without an integration review tends to carry its hidden dependencies into another term. The five checks below are designed to prevent that.
Check 1: Map the undocumented connections
Start with a simple register: source system, target system, data exchanged, owner, authentication method, frequency and business criticality. Then ask system owners, finance teams and service desk staff how data actually moves. The official architecture diagram will show the sanctioned integrations. The operational reality may include manual uploads, shared mailboxes, webhooks and spreadsheet reconciliations.
Anything without a named owner is debt. Anything that relies on a personal login is a risk. Anything that has no documented purpose should be challenged. The register does not need to be perfect; it needs to be honest enough to support the renewal conversation.
Check 2: Test key-person dependency
Most fragile estates have one person who understands the middleware, the connector credentials or the peculiarities of a data feed. The audit should ask what happens if that person is unavailable for two weeks. Are there runbooks? Are credentials held in a shared vault? Are alert routes documented? Can another team member diagnose a failed job?
Record the dependency by role rather than by name. The output should be a short list of knowledge gaps and a decision about whether they are acceptable. A renewal is a good time to require vendor documentation or managed support if the internal dependency is too concentrated.
Check 3: Review iPaaS licensing creep
Integration platform as a service can be licensed by connectors, operations, tasks, API calls, environments or named users. Renewal quotes often bundle additional capacity because the estate has grown quietly. Compare current consumption with entitlement. Identify unused connectors, duplicate middleware and sandbox environments that no longer serve a purpose.
Ask whether adding a new connector or increasing volume will move the organisation into a higher tier. Licensing creep is easier to challenge before signature than after. The aim is to match entitlement to actual use, with a small allowance for planned change rather than a buffer for undocumented growth.
Check 4: Read the exit and data-export clauses
An integration is only as good as the exit path. Can all data be exported in a usable format? Are attachments, metadata and audit logs included? How long does export take, and what does it cost? What happens to connector configurations and mappings on termination? Does the vendor deactivate integrations promptly, and can the organisation obtain evidence of deletion?
These questions should be answered before renewal, not during a termination dispute. Where possible, test a sample export. A clause that promises export in a standard format is weaker than a tested export that the receiving system can actually ingest.
Check 5: Run a breakage test
A breakage test is a controlled exercise in a non-production environment. Disable a connector, rotate a credential, simulate a schema change or pause a scheduled job. Observe what alerts fire, who responds, what documentation exists and how long recovery takes. This is not a penetration test. It is a test of operational readiness.
Schedule it outside a change freeze and record the findings. The value lies in discovering which integrations fail silently, which owners are unaware and which recovery steps exist only in someone's memory.
Turning findings into renewal terms
The audit should produce a register, a short risk list and a set of renewal requirements. These might include named integration owners, documentation commitments, export testing, licence caps, notice periods for connector changes and a funded exit plan. UK organisations with regulated data should also confirm how integration logs and metadata are handled under the contract.
The result is not a perfect architecture. It is a clearer picture of what the renewal is actually buying. That is usually enough to prevent the most expensive surprises.
