Software Vendor Lock-In: How to Keep Your Options Open
Key takeaway
Lock-in is rarely about the technology you can see. It comes from data you can't export, business logic that exists only in a vendor's configuration, and documentation nobody wrote. Guarantee export, ownership, and knowledge transfer in the contract — those three clauses matter more than any architectural choice.
Every dependency creates some lock-in, and that's fine — the goal isn't zero switching cost, it's knowing what the cost is before you're forced to pay it.
Where it actually comes from
- Your data in a format only the vendor's software reads, with no bulk export.
- Business rules configured inside a platform rather than expressed in code you own.
- Proprietary managed services wired deep into the application rather than behind an interface.
- Knowledge — when only the vendor's staff understand how the system works, you're locked in regardless of what the contract says.
Contract terms worth insisting on
- Full data export on demand, in a documented, open format — and test it during the engagement, not at the end.
- IP assignment for anything custom-built, covering code, designs, and configuration.
- Source control in your organisation's account from day one.
- A defined exit period with knowledge transfer and documentation deliverables.
- Price protection on renewal, so the switching cost can't be discovered by your vendor and billed back to you.
Architecture choices that lower the cost
- Keep your own database as the system of record for the data that defines your business.
- Put third-party services behind a thin interface of your own, so swapping one is a contained change.
- Prefer open standards where a credible one exists — it's usually enough.
- Keep infrastructure defined in code, so an environment can be rebuilt somewhere else.
When accepting lock-in is the right call
Managed services and mature platforms save enormous effort, and refusing them on principle is its own expensive decision. Accept lock-in deliberately where the service isn't your differentiator and the data stays portable. Resist it where the component encodes how your business actually works.