Nine checks for SAAS marketing vendor due diligence before you sign

Treat each answer as a branch in the decision tree: collect evidence, record uncertainty and hold approval when a material point remains open. Start with the checks that affect access and responsibility, then test data use, specialist review and the terms for ending the relationship before you accept the proposal.

Use this route to decide what must be settled before work starts:

If the work needs access to your accounts, test the safeguards

If work requires the supplier to enter analytics, CRM or advertising accounts, ask who can access each system and what information is visible. Before granting access, request the supplier's explanation of its safeguards, including whether it has Cyber Essentials or ISO certification, or can provide a SOC report where relevant.

File the access explanation and any security evidence separately. A supplier's confident response in a sales conversation is not a substitute for records showing what safeguards apply to the work. Do not enable access while the people involved, the information they can see or the evidence offered remain unclear.

Rule of thumb: Keep system access closed until its safeguards are evidenced.

If the invoice name does not identify the responsible entity, pause

If the invoice name, company number and registered address do not identify the same entity, stop approval and ask which legal person will sign and invoice. A trading name may differ from the company responsible for delivery, so establish who carries the obligation before paying or providing account access.

Check the company number against the public record, filing history and company information. Note any going-concern wording, late filings or ownership changes, and ask for an explanation if the record is difficult to interpret. The provider evidence review offers context, but does not replace checking the entity itself.

Rule of thumb: Do not proceed until the responsible legal entity is clear.

If a group structure obscures responsibility, trace the ownership

If the supplier's brand belongs to a group, establish which entity will perform the proposed work and identify the ultimate owner. Check whether a group company is in administration, and ask for clarification wherever the structure makes responsibility difficult to establish.

Use the answer to distinguish the supplier's branding from the party that will carry the delivery obligation. The supplier options guide can provide context about types of supplier, but it cannot prove which company is contracting with you or resolve an unclear ownership structure.

Rule of thumb: Follow the delivery obligation to a named company.

If the supplier will handle personal data, settle the processing terms

If the supplier will process personal data on your behalf, require written terms before approving the work. They should describe the processing, retention, sub-processors and each party's responsibilities, and should match the service being proposed rather than rely on a generic template.

Check that the supplier explains the lawful basis for the activity and compare the agreement with the actual service. Review the data protection requirements, and, if the supplier must pay the ICO data protection fee, verify its registration number using the ICO registration search. Keep the result and the supplier's account of its role with the agreement.

Rule of thumb: No personal-data work starts before written terms are agreed.

If research is part of the brief, check consent before recruitment

If the work includes surveys, interviews or panels, ask how consent will be recorded and which lawful basis applies. Assign someone to review the arrangements before recruitment begins, and retain the explanation with the brief. Hold approval if the supplier cannot show how its approach fits the activity.

The ICO's guidance on research provisions under UK GDPR describes safeguards and limits on further use. Ask the supplier to explain how those provisions relate to the planned research, then record the response alongside the consent and data-sharing arrangements.

Rule of thumb: Agree the research review before anyone is recruited.

If non-broadcast advertising is planned, appoint a claims reviewer

If the supplier will prepare non-broadcast advertising, agree who checks performance claims, comparisons and testimonials before publication. Keep the clearance evidence, and ask the supplier to assess proposed claims against the CAP Code. Put this review into the schedule instead of waiting until the copy is ready.

CAP Copy Advice may be considered before launch. Make sure the brief identifies the reviewer and the route for raising concerns, so responsibility is not left implicit between your team and the supplier. The supplier's assurance that material will be checked is not itself a record of what was reviewed.

Rule of thumb: No claim goes live without an assigned reviewer.

If pension communications are involved, identify the relevant reviewer

If the proposed activity includes pension communications, name the person responsible for reviewing them and consult the Pensions Regulator where relevant. Do this before work proceeds, rather than assuming that the supplier's general marketing review covers a specialist communication.

Record who will review the material and how that responsibility fits the planned work. If nobody is clearly assigned, hold approval until the gap is resolved. Keep the reviewer's role distinct from the separate checks on personal data, research consent and advertising claims.

Rule of thumb: Assign a reviewer before pension messages are prepared.

If assurance depends on insurance or references, verify each separately

Request current professional indemnity and public liability insurance certificates. Speak directly with references whose contract size is similar to yours, and ask about delivery rather than relying on a general recommendation. Treat the certificate and the reference conversation as different forms of evidence.

File the certificates, security records and reference notes separately. A reference can inform your view of the work, but it does not establish solvency or compliance. Refusal to identify the invoicing entity or provide insurance evidence is a warning sign, since both should be straightforward to supply when they exist.

Rule of thumb: Do not let one assurance stand in for another.

If the commitment or departure terms are unclear, resolve them in writing

If notice, renewal, minimum spend or data-return costs remain uncertain, do not treat the headline price as the full commitment. Review the commercial terms and hidden costs, then list each open point in the draft and request a clear answer.

Record the notice period, data-return process, asset handover and charges that may continue after termination. A short pilot with a clear end date can be easier to leave than an annual commitment, but the handover still needs agreement. Allow more time to assess exit arrangements for a larger or data-heavy engagement.

Compare the proposed service with the work you need using software selection criteria, not only the supplier's demonstration. Positive references cannot make up for missing entity or insurance evidence. Settle every answer that affects cost, access or handover in the written terms before accepting the proposal.

Rule of thumb: Agree the route out before committing to the work.