A good SaaS vendor should make very clear any changes to their system. There should be advance notice of updates, a description of what they involve, a discussion about risk/impact, and with time to review the changes locally, maybe on a sandbox system. If a vendor is pushing out changes without notice - unless related to very infrequent emergency hot fixes - I would consider this a red flag. I have seen this with a particular EDC vendor though, and in this specific case it demonstrated a bizarre lack of understanding on CSV regulations. Most vendors do a good job of handling changes though. Astillus makes a good point about the importance of relationships here.