Every piece of software creates dependence, and that is not bad in itself. A tool deeply integrated into processes is usually also one that takes a lot of work off your hands. Vendor lock-in becomes a problem when the dependence arises unnoticed and the exit is only examined once it is needed.
Causes
Proprietary data formats that can only be read in the tool itself. Missing or incomplete exports, for example without documents, history or links. Special features built so deeply into processes that they cannot be rebuilt elsewhere. Integrations that only work with this vendor. And contracts silent on exit. In the cloud, services offered in this form by only one provider add to it.
The questions to ask before signing
In which format can all data be exported, including documents and change history? Is export possible at any time or only on termination, and does it cost anything? How long after termination is data still retrievable, and when is it demonstrably deleted? Is there a documented interface? Ask these questions before signing and you get precise answers; ask them on termination and you get negotiations.
Data portability under Swiss law
The Swiss Federal Act on Data Protection gives data subjects a right to receive or transfer their personal data in a common electronic format (Art. 28 FADP), under certain conditions. For businesses as customers of a SaaS provider, that does not replace a contractual exit arrangement: business data, structures and documents must be covered by the contract.
Limiting lock-in deliberately
Avoiding dependence altogether is rarely sensible. Knowing and limiting it is: export data regularly and test that the export is usable; prefer open standards where they exist; do not implement critical logic exclusively in proprietary features; fix data residency and sub-processors in the contract. With in-house builds on your own infrastructure, the same applies in reverse: dependence on individual people is lock-in too.
In the family office context
For family offices and trustees the question is especially delicate, because data is needed over decades and retention duties of ten years and more apply. Software from which mandates, documents and history cannot be fully exported is a risk to the evidence trail. Our article on data protection in the family office covers the exit question in the context of outsourcing, and the decision guide standard software or in-house build weighs the dependencies of both routes.