Technology vendors, IT contractors and grant requirements reuse a small vocabulary of roughly 40 terms. Non-technical leaders can learn them in an afternoon and use the matching vendor questions to judge whether answers about security, reliability, data and cost are reasonable.
A plain-English glossary of 40 tech terms leaders actually hear, from MFA and SSO to uptime and encryption, with vendor questions to ask for each.
By Editorial teamPublished Last updated 13 min read
Technology vendors, IT contractors and grant requirements use a small vocabulary over and over, and most of it can be learned in an afternoon. This glossary covers roughly 40 terms that non-technical leaders actually encounter in buying decisions, security conversations and budgets. Each definition includes a question to ask when the term comes up, because the point is not academic knowledge, it is knowing whether a vendor’s answer is reasonable.
What are the security and access terms leaders encounter most?#
Security and access terms appear in almost every technology contract, and a vague answer here costs the most. This section defines MFA, 2FA, SSO, password managers, encryption, endpoints, firewalls, VPNs, zero trust, phishing and ransomware, the vocabulary that surfaces in security reviews and vendor conversations. Each definition ends with a question to ask, so leaders can test whether a vendor’s answer is reasonable.
MFA (multi-factor authentication): Requiring a second proof of identity, such as a phone prompt or code, in addition to a password. Example: a staff member enters their password, then taps “approve” on their phone before email opens. Ask a vendor: “Is MFA included at no extra cost, and can we enforce it for all users?”
2FA (two-factor authentication): The two-step version of MFA, often used interchangeably with it. Example: a bank texts a code after you type your password. Ask: “Does your product support 2FA apps like authentication codes, not just SMS?”
SSO (single sign-on): One login that grants access to multiple tools, so staff sign in once instead of memorizing many passwords. Example: logging into Microsoft 365 also unlocks the company’s project tool. Ask: “Do you support SSO with our existing identity provider, and does it cost more?”
Password manager: Software that stores and autofills unique passwords so people stop reusing weak ones. See How to Set Up a Password Manager for Your Team for a rollout plan. Ask: “Can we share credentials across a team and revoke access when someone leaves?”
Encryption: Scrambling data so it is unreadable without a key, whether stored (at rest) or sent (in transit). Example: a stolen laptop’s files are useless if the drive is encrypted. Ask: “Is data encrypted both at rest and in transit, and who holds the keys?”
Endpoint: Any device that connects to your network, such as laptops, phones and printers. Example: a lost tablet is an endpoint, and its security settings matter as much as the server’s. Ask: “Does your pricing cover endpoints per device or per user?”
Firewall: A filter that decides what traffic may enter or leave a network. Example: blocking unexpected overseas connections to your office file server. Ask: “Is a firewall included in your internet or security package, or do we buy one separately?”
VPN (virtual private network): An encrypted tunnel that connects a remote device to a network as if it were in the office. Example: a volunteer checking the donor database from a coffee shop through the VPN. Ask: “Do we still need a VPN if our tools are cloud-based, or is it only for remote access to internal systems?”
Zero trust: A security approach where no device or user is trusted automatically, and every request is verified. Example: a staff laptop must prove itself even when already inside the office network. Ask: “Which of your features support this approach, and what is our realistic first step at our size?”
Phishing: Fraudulent messages that trick people into revealing credentials or sending money. Staff training is the main defense, and How to Recognize Phishing and Train Your Staff covers it in depth. Ask: “Does your email platform flag suspicious external senders out of the box?”
Ransomware: Malware that encrypts your files and demands payment to restore them. Example: a shared drive becomes unreadable and a ransom note appears. Ask: “If ransomware encrypted our data in your system, what would our recovery path be?”
How do vendors describe software and service delivery?#
Software and service delivery terms describe how software is sold and where your data lives. This section defines SaaS, cloud computing, on-premise software, hosting, APIs, integrations, migrations and onboarding. These words determine whether you rent or own, where your records physically sit, and what happens when data must move between systems. Each definition includes a question that reveals hidden costs or limits.
SaaS (software as a service): Software you rent through a browser rather than install on a server, paying per user per month. Example: Google Workspace or a donor management platform. Ask: “What is our data export path if we cancel, and is it self-service?”
Cloud computing: Running software or storing data on someone else’s servers, accessed over the internet. Example: files synced across staff devices without an office server. Ask: “Where are our servers physically located, and does that matter for our compliance needs?”
On-premise / on-prem: Software installed on computers you physically control. Example: an accounting program installed on the office desktop. Ask: “What ongoing maintenance does on-prem require that a hosted version would not?”
Hosting: The service of storing and running your website or app on a provider’s machines. Example: your site lives on a host’s servers, not the office closet. Ask: “What are the renewal rates, not just the first-year promotional price?”
API (application programming interface): A standard way for two programs to exchange data without human involvement. Example: new donors entered in your website form appear automatically in your CRM. Ask: “Do you have a public API, and are there limits on how much data we can move per day?”
Integration: A pre-built connection between two tools that makes them share data. Example: an email newsletter tool that pulls lists from your donor database. Ask: “Which integrations are supported today versus ones we would have to build ourselves?”
Migration: Moving data, settings and history from one system to another. Example: shifting ten years of donor records from spreadsheets to a CRM. Ask: “Who performs the migration, what does it cost, and what typically goes wrong at our scale?”
Onboarding: The vendor’s process for getting your team set up and trained on a new system. Example: a guided setup plus a kickoff call for administrators. Ask: “Is onboarding included, and how many hours of human support do we get?”
Which reliability and performance terms belong in contracts?#
Reliability and performance terms are the words that should appear in writing when a vendor promises dependable service. This section defines uptime, SLAs, downtime, redundancy, latency, bandwidth and scalability. Knowing them lets a leader tell the difference between a contractual guarantee with a remedy and a marketing claim with nothing behind it.
Uptime: The percentage of time a service is working, usually quoted as a monthly average. Example: “99.9 percent uptime” means roughly 43 minutes of downtime allowed per month. Ask: “Is uptime guaranteed in the contract, and is there a remedy if you miss it?”
SLA (service level agreement): The contract section defining promised performance and what happens if it is missed. Example: a promise of 24-hour support response with credits for failures. Ask: “Can you show me the SLA terms and how customers actually invoke them?”
Downtime: Any period a system is unavailable, whether planned or not. Example: your website failing during a donation drive. Ask: “How do you notify customers of outages, and is there a status page we can check?”
Redundancy: Duplicating components so one failure does not stop service. Example: a second internet line that takes over automatically if the first drops. Ask: “What redundancy protects our data, and is it in the same building or a different region?”
Latency: Delay between a request and a response. Example: a video call lagging because the connection is slow. Ask: “Where are your servers relative to our users, and how do you handle slow response times?”
Bandwidth: How much data a connection can move at once. Example: five staff on video calls simultaneously need far more than five checking email. Ask: “What bandwidth do you recommend for our usage, and what happens if we exceed it?”
Scalability: Whether a system handles growth without a redesign. Example: doubling your user count without doubling your admin work. Ask: “What breaks or gets expensive first if we double our usage?”
Data and backup terms decide whether a bad day is an inconvenience or a catastrophe. This section defines backups, RPO, RTO, retention, data residency, archives and metadata. Together they determine how much data you can lose, how long you can be down, where your records physically live and how long deleted material survives.
Server room at The National Archives in London, May 2011, with rows of server racks and indicator lights Photo: The National Archives (UK), Wikimedia Commons, CC BY 3.0.
Backup: A separate copy of data kept so it can be restored after loss. Example: nightly copies of your donor database stored off-site. Compare approaches in Cloud Backup vs Local Backup: Which Do You Need. Ask: “How often are backups taken, and can I test a restore myself?”
RPO (recovery point objective): How much recent data you can afford to lose, measured in time. Example: an RPO of one hour means restoring to at most one hour before the incident. Ask: “What is the effective RPO of your backup schedule, and can it be reduced?”
RTO (recovery time objective): How long you can afford to be down before recovery finishes. Example: a two-hour RTO means staff wait at most two hours to work again. Ask: “In a real outage, what is the realistic time to restore, excluding optimistic assumptions?”
Retention: How long a system keeps deleted or old data. Example: 30 days of deleted-file recovery in a cloud drive. Ask: “What is the retention period for deleted items, and does it change after cancellation?”
Data residency: The country or region where your data is physically stored. Example: a Canadian grant requiring donor data stay in Canada. Ask: “Can you guarantee storage in a specific region if a funder or law requires it?”
Archive: Long-term storage for data you rarely access but must keep. Example: seven years of financial records stored cheaply. Ask: “What does long-term storage cost, and how is archived data retrieved?”
Metadata: Data about data, such as who created a file and when. Example: timestamps that show when a contract was modified. Ask: “What metadata is retained and visible to us and to you?”
What legal and cost terms appear in technology contracts?#
Legal, cost and governance terms appear in contracts and budgets, where ambiguity costs real money. This section defines vendor lock-in, SOC 2, GDPR, CCPA, BYOD, per-seat pricing, TCO, procurement, open source, provisioning and audit logs. These words control who is responsible for what, what everything actually costs over time, and how hard it is to leave.
Vendor lock-in: Situations where switching away from a tool is costly because your data or workflows are trapped inside it. Example: years of records in a proprietary format that no competitor can import. Ask: “If we left tomorrow, what would we be unable to take with us?”
SOC 2: A common audit report showing a service provider’s security controls have been reviewed. Example: a vendor supplying a current SOC 2 report instead of just claiming to be secure. Ask: “Do you have a current audit report, and will you share it under NDA?”
GDPR / CCPA: Major privacy laws (European and Californian, respectively) that set rules for collecting and handling personal data. Example: requirements to delete a person’s data on request. See Data Privacy Basics Every Small Business Should Know. Ask: “Which privacy laws do you support compliance with, and what is your role versus ours?”
BYOD (bring your own device): Staff using personal devices for work. Example: a coordinator answering email from a personal phone. Ask: “Can work data be wiped from a personal device without touching the person’s photos and apps?”
Per-seat pricing: Charging per user per month, the dominant SaaS model. Example: 20 dollars per person for 10 staff means a 200-dollar monthly bill. Ask: “What happens to pricing if we add and remove people mid-year?”
TCO (total cost of ownership): All costs over time, including licenses, setup, training and support. Example: a cheap tool that needs paid consultant time every month. Budget guidance is in How to Budget for Technology in a Small Organization. Ask: “Beyond the license fee, what will we realistically spend in year one and year three?”
Procurement: The formal process of selecting and purchasing technology, often required by funders. Example: collecting three quotes for a new website. Ask: “Do you offer quotes and documentation our funder’s procurement rules will accept?”
Open source: Software whose source code is public and can be inspected or modified, often free to use. Example: an office suite with no per-seat license cost but real setup effort. Ask: “What support exists if we use this without a paid contract?”
Provisioning / deprovisioning: Creating or removing user accounts and their access. Example: disabling every account the day a staff member departs. Ask: “How long does deprovisioning take, and can it be done in one place for all your services?”
Audit log: A record of who did what in a system, used for investigations and compliance. Example: showing which account changed a payment amount. Ask: “How long are logs retained, and can we export them?”
Which vendor questions should you ask in each category?#
Vendor conversations can be organized by category, with one high-value question and one red flag per topic. The table below pairs each category, security, reliability, data, cost, support and privacy, with the most important question to ask and the warning sign in a weak answer.
ESA and OHB signed a contract for Comet Interceptor at ESA headquarters in Paris on 15 December 2022 Photo: European Space Agency, Wikimedia Commons, CC BY-SA 3.0 igo.
Category
Most important vendor question
Red flag in the answer
Security
Is MFA included and enforced for all users?
“MFA is available for an upgrade fee”
Reliability
Is the uptime promise in the contract with a remedy?
Verbal promises with no SLA section
Data
Can we export everything ourselves, in a standard format?
Export requires a paid professional service
Cost
What is total year-three cost, not just the promo rate?
No answer, or steep unexplained renewal jumps
Support
What support hours and response times apply to our tier?
Email-only support with no response commitment
Privacy
Which compliance frameworks do you support, and what is our role?
How many of these terms do I actually need to know?
You do not need all 40 on day one. Start with the security and cost terms, since those directly affect risk and budget, and pick up the rest as they come up in vendor conversations.
What is the single most important term to understand first?
MFA (multi-factor authentication) is the highest-value item because it blocks most account takeover attempts and costs little or nothing to enable. Ask every vendor whether they support it before you sign anything.
Should I ask vendors these questions in writing?
Yes. Written answers create a record you can hold vendors to and make it easy to compare proposals side by side. Email is fine; formal documentation is better for larger contracts.
What if a vendor cannot explain a term in plain language?
Treat that as a warning sign rather than a vocabulary problem. A good vendor should be able to tell you what a feature does for your organization without jargon, and hesitation often means the feature is thin or the salesperson does not know the product.
Build a realistic annual tech budget for a small organization: replacement cycles, subscriptions, security spending and contingency percentages you can copy.
A practical technology roadmap for small businesses and nonprofits: hardware, software, security, backups, cloud, and budgeting decisions explained without jargon.
