Onboarding
From agreement to your own portal
What you provide, what we handle, and in which order. Select below which categories your portal should manage, from software licences and mobile services to printing and data centres. The delivery checklist grows with your selection, so it contains exactly what is required for your scope.
This page is fully accessible without signing in. It is intended to be shared with IT, procurement, HR and data protection, because these four areas determine the schedule.
Categories
12
From software to data centres
Process
6 phases
with acceptance criteria
Typical duration
6 to 12 weeks
The provider determines the pace
Documents
Available for advance review
DPA and TOMs publicly available
Step 1
The process, with responsibilities on both sides
Each phase has an outcome against which its completion can be measured. This is the plan against which we jointly assess acceptance, rather than a marketing timeline.
- 1
Kick-off and objectives
Week 1You
- ·Appoint a project manager and one decision-maker each for IT, procurement, HR and data protection
- ·Select categories and features and confirm the scope
We
- ·Record acceptance criteria in writing, jointly with you
- ·Schedule with named responsibilities on both sides
Phase complete when: The project plan is in place; every task has a named owner and a date.
- 2
Approvals and contracts
Weeks 1 to 2You
- ·Sign the Data Processing Agreement
- ·Involve the works council where usage data can be attributed to individuals
- ·Grant authorisation for provider communication
We
- ·Issue the Data Processing Agreement for your legal entities
- ·Complete your procurement team's security questionnaire and provide documents from the Trust Center
- ·Provide the system description for your co-determination process
Phase complete when: The contract and authorisation are signed, and data protection approval has been granted.
- 3
Contract data collection
Weeks 2 to 4You
- ·Supply the minimum data set for each contract across all selected categories
- ·Answer follow-up questions from one consolidated list rather than individually over several weeks
We
- ·Request missing inventory data directly from providers with your authorisation
- ·Reconcile your information against provider records and invoices
- ·Report deviations and gaps with documentation
Phase complete when: Every contract has a provider, value, renewal date and owner. Early warnings start at this point.
- 4
Setup and branding
Weeks 4 to 6You
- ·Approve the logo, colours and subdomain
- ·Have your IT department set the CNAME and email records
We
- ·Set up the tenant, import data, and configure roles and approval routes
- ·Connect Single Sign-On and HR integration where selected
Phase complete when: Your portal is accessible under your subdomain, with your branding and data.
- 5
Pilot
Weeks 6 to 8You
- ·Run one category or site in production
- ·Provide consolidated feedback
We
- ·Apply corrections
- ·Train your administrators and adapt the instructions to your configuration
Phase complete when: Acceptance against the criteria from Phase 1, documented in writing.
- 6
Go-live and operation
From Week 8You
- ·Inform staff in accordance with the plan agreed in Phase 2
We
- ·Roll out to all categories and sites
- ·Provide ongoing support and a quarterly review of inventory, costs and outstanding renewals
Phase complete when: Full operation. From this point, the inventory remains continuously current rather than being accurate only once.
What actually determines the schedule
The authorisation
It requires approval from your authorised signatories. This is often the individual step that delays a project by weeks, even though it takes ten minutes of work. That is why it appears in Phase 2 rather than later.
Inventory data held by the provider
How quickly a carrier or vendor releases the complete inventory determines Phase 3. A named account manager is considerably faster than the general hotline. We handle this part, but cannot compel the provider to act.
Co-determination
Where usage data can be attributed to individuals, your works council must be involved. This applies equally to licence usage data and telephony. If this starts only shortly before go-live, the date moves regardless of how complete the software is.
Step 2
Define the scope
Two separate questions. First: which contracts should be managed in the portal. Second: what else should the portal do. Each selection adds exactly the information required for it to the checklist in the next step.
Categories · 0 of 12 selected
What should be managed. Most start with one category and add the others later, without having to start the setup again.
Features that are always included
- Provider and contract overviewAll contracts across all categories in one place, rather than in email attachments and separate spreadsheets.
- Early renewal warningsA reminder before each notice deadline. Contracts no longer renew unnoticed.
- Cost overview by category and cost centreWhat you pay for each item, structured to match your management accounting.
- Roles and permissionsEach role sees exactly what it is permitted to see. Tenant isolation at database level.
- Reports and exportEvery view available as Excel or CSV. Your data remains fully exportable at all times.
- Audit logA traceable record of who changed what and when. A prerequisite for any internal audit.
Optional features · 0 of 8 selected
What else the portal should do.
Step 3
What we need from you
Complete and with explanations, so no one internally has to guess why a piece of information is needed. Tick what is already available. Your progress remains saved in this browser.
The minimum data set for each contract
We need these six items for every single contract, regardless of category. For Microsoft 365 just as for Adobe, DeepL, your mobile contract, printers and the data centre.
Once these are available, the portal is already working: it shows costs by category and warns you before every notice deadline. Everything else in the checklist only adds detail. The simplest way to supply this is a table with one row per contract and these six columns.
Company and structure
The framework to which every subsequent report and approval relates.
People and permissions
Who appears in the portal and what each person is permitted to do. Also the basis for assigning licences and devices to individuals.
Access and authorisations
So that we can act on your behalf with providers rather than occupying you with follow-up questions.
Branding and domain
Your portal should reflect your identity rather than ours.
Legal requirements and co-determination
The area where corporate projects fail more often than on technical matters. That is why it appears here rather than in the small print.
Step 4
We handle the providers
The bottleneck in these projects is rarely on your side. It lies in obtaining inventory data, authorisations and contracts that no one can find in full any more. This is precisely our day-to-day work.
We handle
- ·Requesting the complete inventory from the provider, with your authorisation and on your behalf
- ·Reconciling provider records against your invoices and your own lists
- ·Clarifying discrepancies directly with the provider, without copying you into every email
- ·Preparing data in an importable format, including from PDF invoices
- ·Negotiations and contract adjustments during ongoing operation
For this, we need from you
- ·The signed authorisation, using the template we provide
- ·Customer and contract numbers for each provider
- ·The name of your account manager at each provider, where there is one
A named account manager makes this phase considerably shorter than going through the general hotline. If there is none, the process still works, but takes longer.
Step 5
What your procurement and data protection teams can review in advance
All documents are openly available before you need to ask. Your internal review requires neither a conversation with us nor approval.
Data Processing Agreement
Under Article 28 GDPR, including standard contractual clauses and the complete annex on technical and organisational measures.
Security and compliance
Encryption, access control, tenant isolation, audit logging, incident management and recovery in detail.
Subprocessors
Complete list with purpose and location. Processing exclusively in the EU, Frankfurt region.
Trust Center
All legal documents in one place, for sharing with procurement, internal audit and data protection.
Co-determination
Where usage data can be attributed to individual employees, your works council must be involved. This applies equally to licence usage data and telephony, and is regularly overlooked because it is only expected for telephony. We provide the system description, the description of the types of data processed, and the information on analysis capabilities and deletion periods that your works council needs for a works agreement.
Dependency and exit
Your data belongs to you and can be exported in full in open formats at any time, without our involvement. The contract governs the return and deletion of data after the contract ends. We answer your procurement team's questions about provider risk, cover arrangements and continuity in writing before you sign. Please ask; these are welcome questions.
We provide further evidence, such as a Transfer Impact Assessment, Business Continuity Plan or reports from our subprocessors, under a confidentiality agreement. Send an informal request to privacy@commsos.de with the keyword “Trust-Pack”.
Your requirements profile
Your selection and delivery status in one document. You do not need to provide any details to print it or save it as a PDF. If you send it to us, we will contact you with what is still missing for your scope and a proposed date for the kick-off.