Tools and providers
Part of Choosing marketing automation tools with the operating problem defined before the demo
Marketing automation vendor due diligence, from corporate identity to exit evidence
Use this marketing automation vendor due diligence checklist to test legal roles, security, accessibility, integration, pricing and exit evidence.
Marketing automation vendor due diligence should produce an evidence file, named owners and clear reasons to stop. A completed questionnaire is not enough if the answers do not match the product edition, implementation partner and data flow an England-based organisation intends to buy.
What to take away
- Vendor due diligence must produce an evidence file with named owners and clear stop reasons, not just a completed questionnaire.
- Reconcile the demonstration environment with the quoted configuration and list features shown but not included.
- Test consent evidence, objections and suppression records to see how they enter, change and leave the service.
- Use NCSC cloud security principles as a structured question set, not as certification or a risk assessment replacement.
- The due-diligence file should end with a decision, residual risks, specialist approvals, evidence dates and a recheck date.
Corporate and product identity
- Record the contracting entity, company or registration details where applicable, governing law, notices address and every delivery subcontractor.
- Name the product, edition, region, add-ons and implementation version. Attach the dated quotation and product schedule.
- Reconcile the demonstration environment with the quoted configuration. List features shown but not included.
- Identify which party licenses software, configures it, hosts it, supports it and can access customer information.
Pause if the seller will not identify a material service provider or if the quotation cannot be mapped to the demonstrated scope.
Corporate and product identity checks
- Contracting entity and governing law
- Product, edition, region, add-ons
- Dated quotation and product schedule
- Demo vs quoted configuration gaps
- Who licenses, hosts, supports, accesses
Data protection and marketing permissions
- Draw sources, fields, purposes, recipients, locations, retention and deletion points for each proposed journey.
- Determine controller, joint-controller and processor roles with qualified counsel. Obtain processing terms for the actual parties.
- Record subprocessors, notification procedures and any overseas access. Do not infer transfer status from a regional hosting label.
- Test how consent evidence, objections and suppression records enter, change and leave the service.
- Keep lawful-basis analysis separate from PECR permission for each channel and recipient type.
The ICO's processor-contract guidance covers instructions, confidentiality, security, subprocessors, rights assistance, audits and end-of-contract return or deletion. It is under review following the Data (Use and Access) Act 2025 and does not decide wider commercial terms. The ICO's electronic-mail guidance should inform channel-specific questions, followed by publication-day legal review.
Security evidence
- Ask for identity federation, multi-factor authentication, privileged-role design and emergency access arrangements.
- Inspect the relevant logging, customer visibility, retention and export options.
- Request vulnerability handling, secure development, incident notification, resilience and recovery evidence.
- Test revocation, least privilege, failed-login handling and a connector secret change in a controlled environment.
Use the NCSC cloud security principles as a structured question set. They do not certify the supplier or replace a risk assessment by a named security specialist.
Accessibility and usable control
- Test essential authoring, approval, reporting and preference-management tasks with keyboard navigation and relevant assistive technology.
- Check representative emails, forms and landing pages produced from the buyer's real design system.
- Ask for an accessibility statement, known defects, remediation ownership and change-notification route.
- Record which WCAG 2.2 success criteria were tested, by whom and with what result.
Do not accept a template label as evidence that edited content or the administrative interface is accessible. A qualified accessibility reviewer should approve the test plan and unresolved exceptions.
Integration and operational resilience
- Specify objects, fields, direction, frequency, authentication, rate limits and ownership for every essential connection.
- Inject a duplicate, invalid field, timeout and expired credential. Observe queues, retries, alerts and reconciliation.
- Identify manual workarounds and their capacity limit.
- Require change notice for APIs or features that could break a critical journey.
An integration directory proves that a connection is advertised, not that the required exchange works safely. Successful buyer-side reproduction is the acceptance evidence.
Price, contract and exit
- Normalise currency, tax, billing period, minimum term, renewals and all usage units.
- Model current and stress volumes without presenting either as a forecast.
- Price implementation, migration, training, assurance, support, overages and termination help separately.
- Obtain sample exports for contacts, permission and suppression records, content, workflows, activity and reports.
- Set notice dates, transition support, deletion evidence and an owner for retaining suppression information.
Reject or escalate any unresolved hard exclusion. The due-diligence file should end with a decision, residual risks, specialist approvals, evidence dates and a recheck date before signature. That record is more valuable than a large folder of undigested vendor documents.
Before you act
- Record contracting entity, governing law, notices address and delivery subcontractors.
- Draw data sources, fields, purposes, recipients, locations, retention and deletion points.
- Test revocation, least privilege, failed-login handling and a connector secret change.
- Test essential tasks with keyboard navigation and relevant assistive technology.
- Inject a duplicate, invalid field, timeout and expired credential into integrations.
- Obtain sample exports for contacts, permission and suppression records, content, workflows, activity and reports.
Common questions
What should a marketing automation vendor due diligence produce?
It should produce an evidence file, named owners and clear reasons to stop. A completed questionnaire is not enough if answers do not match the product edition, implementation partner and data flow an England-based organisation intends to buy.
How should consent and suppression records be tested?
Test how consent evidence, objections and suppression records enter, change and leave the service. Keep lawful-basis analysis separate from PECR permission for each channel and recipient type, and obtain processing terms for the actual parties.
What should the due-diligence file end with?
It should end with a decision, residual risks, specialist approvals, evidence dates and a recheck date before signature. That record is more valuable than a large folder of undigested vendor documents.
