When
An unsolicited contact pressures you to act immediately or refuses independent verification.
Then
Do not follow its links or provide credentials.
Urgency and a familiar company name are not substitutes for confirming the sender through a separate channel.
When
The agreement does not clearly identify responsibilities, compensation, data use, or content rights.
Then
Do not accept the proposed arrangement yet.
You cannot assess whether an offer is appropriate without knowing what each party is committing to.
When
Your team needs controls the provider has not documented for your intended workflow.
Then
Keep evaluating other options.
A legitimate provider can still be the wrong fit for your security, approval, or reporting requirements.