Tools and providers
Part of How should you compare social media agencies tools before signing?
Nine checks for social media agencies vendor due diligence
A nine-point checklist for social media agencies vendor due diligence, covering company records, data broker rules, platform credentials and contract exit terms.
What to take away
- Most teams run due diligence on price and pitch, not on the vendor's legal and data record. That is the mistake to fix first.
- Nine checks cover the ground: company status, insurance, data sources, platform credentials, contract exit and subprocessors.
- The Information Commissioner's Office expects buyers to ask where marketing data came from, so a broker list without a lawful basis is a stop signal.
- Keep an evidence file with dates. Verbal assurances from a pitch do not survive a change of account manager.
- Score each vendor against the same nine points before you shortlist, not after.
Run the checks in this order
Work through the list in sequence. Each step feeds the next, and a failure at step three should stop the process before you spend time on references.
Nine due diligence checks in order
- Confirm legal entity at Companies House
- Check filing and credit history
- Request insurance certificates
- Map every data source
- Verify platform credentials
- Confirm the legal entity. Ask for the registered company number and check it at Companies House. A trading name that does not match the contracting entity is a common problem in agency pitches.
- Check filing and credit history. Late accounts, a recent change of directors or a dormant parent company all change the risk profile.
- Ask about professional indemnity and public liability cover. Request the certificate, not a summary, and note the cover limit and renewal date.
- Map every data source. If a vendor buys audience data from list brokers, the buyer carries the compliance risk. Read the ICO guidance on organisations using marketing services of data brokers before you accept any broker-sourced list.
- Verify platform credentials. For LinkedIn work, ask for the account team's certification status and check the official LinkedIn marketing solutions resources yourself. For short-form video, confirm named staff have current TikTok for Business training and access to the ad account.
- List subprocessors. Scheduling tools, analytics platforms and AI writing assistants all touch client data. Ask for the current list and the countries where data is stored.
- Test the reporting. Request a sample monthly report from a comparable account, redacted if needed, and check whether the numbers reconcile to platform data.
- Read the exit clause. Notice periods, data return, account ownership and handover support matter more than the pitch deck. Our guide to social media agencies tool implementation explains why handover failures usually trace back to access and ownership terms.
- Take two references, one current and one former client. Ask the former client why the relationship ended.
Score the answers consistently
Build a simple grid with the nine points as rows and each shortlisted vendor as a column. Score green, amber or red against evidence you have seen, not claims you have heard.
A red on data sources or company status should end the process. Amber scores are workable if the vendor accepts a contract condition, such as a data source warranty or a shorter notice period.
Record the date of every document you review. Due diligence is a snapshot, and a certificate that expires mid-contract creates a gap you will need to manage.
Set the commercial terms before you sign
Due diligence does not end at the reference stage. Put the findings into the contract.
Ask for a named account lead and a named substitute, with a notice period if either leaves. Agency account churn is the most common cause of a promising retainer going flat.
Agree what happens to ad accounts, creative files and audience data at the end of the term. Ownership should sit with the client from day one.
Set a review date at 90 days and again at six months. Use the same nine-point grid to check that nothing has changed, particularly subprocessors and data sources.
If you are comparing several vendors at once, the wider social media agencies tools and supplier guide for 2027 sets out how pricing models and service tiers differ, which helps you weight the scores.
Common questions
How long should vendor due diligence take?
For a retainer under £5,000 a month, allow one to two weeks for the nine checks. Larger contracts with data sharing or regulated sectors need longer, because subprocessor and data source reviews take time to evidence.
Do I need to check a vendor's data broker sources?
Yes. The ICO is clear that organisations using broker-supplied marketing data remain responsible for having a lawful basis. If a vendor cannot name its sources, treat that as a red score.
What should stop a procurement outright?
A mismatch between the contracting entity and the trading name, no professional indemnity cover, or undisclosed data brokers. Any of these should end the process until the vendor provides evidence.
Can a small team run this checklist?
Yes. The nine points take a few hours if you request documents in one batch. The time cost sits in reading the contract and mapping subprocessors, not in the company checks.
