Tools and providers
Part of Choosing social listening tools and providers when coverage is only a claim
Social listening vendor due diligence: documents to request
A document request pack for social listening vendor due diligence in England: what to ask for, what to inspect in each document, and how to grade the answers.
Vendor due diligence works best on paper that can be inspected. A questionnaire response is a starting point, not proof that the contracted service has the stated source rights, privacy controls or resilience. Ask for named documents, read their scope and date, and grade each answer by the strength of its evidence.
This request pack is for an organisation in England buying a social listening service, whose posts come from platforms the vendor does not own. It is not a supplier approval or a legal opinion. Once the contract is signed, running the service is a separate job, covered in the operations guide.
What to take away
- A questionnaire response is a starting point, not proof of source rights, privacy controls or resilience.
- Ask for the master services agreement, DPA, subprocessor list, penetration test summary, BCP/DR plan, insurance certificates and exit plan by name.
- Security evidence must be current and in scope, not a logo or a policy from another entity.
- Grade answers as assertion, document, demonstration or buyer test.
- Name the reviewer, evidence, gap, deadline and consequence for each answer.
Pin down who is contracting and what is quoted
Confirm the contracting entity, company registration, service name and support entity. Record the quoted package, users, usage limits, integrations, sources and service locations. Everything later is checked against this description.
Identify subcontractors, including any enrichment or sentiment-analysis provider, and the functions and data entrusted to each. Ask which documents are contractual and which are marketing material. Keep the evidence date beside every answer, because a group-level policy may not cover the entity or environment delivering the service.
Request the named documents
Ask for each document by name. A general description of a control is not the document, and a request that names the paper is harder to answer with a brochure.
| Document | What to inspect | Gap to record |
|---|---|---|
| Master services agreement | Contracting entity, quoted package and which terms bind | Marketing claims that sit outside the contract |
| Data processing agreement (DPA) | The roles each party accepts for purposes, fields, queries and model training | A role label that does not match what the service really does |
| Source and data-licence terms | The agreement or licence behind each social platform feed the service uses, with its date and scope | A source the vendor cannot substantiate |
| Subprocessor list | Each subprocessor, including enrichment and sentiment-analysis providers, with functions and data | An unnamed provider or an undeclared function |
| Penetration test summary | Currency, coverage and remediation evidence | A summary that is out of date or out of scope |
| Business continuity and disaster recovery plan | Backup recovery and the recovery sequence for the delivered service | A plan written for another entity or environment |
| Insurance certificates | Insurer, cover and dates | A certificate that names a different entity |
| Exit or transition plan | Export format, data dictionary, query definitions, audit history, deletion evidence and transition help | An export nobody has tested |
Source permissions and privacy roles need their own pass. Trace each source permission to an authorised route and stop collection if the supplier cannot substantiate it. Controller and processor status follows actual purposes and means, so named counsel should confirm the arrangement. If the vendor is a processor, compare the DPA with the UK GDPR contract requirements the ICO describes.
Read the certificates, not the logos
Ask for certificates and scope statements by name: ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II or Cyber Essentials Plus. Inspect the certification scope and date rather than accepting a logo on a sales page.
Define the service boundary, data classes and privileged roles first, so the scope statement can be compared with them. Request recent independent-test coverage and remediation evidence. Review encryption boundaries, access logs, backup recovery and credential revocation, and test incident contacts and the contractual notification clocks.
The NCSC's supplier assurance questions ask whether the supplier conducts independent security tests, such as penetration tests, and remediates any findings. They also cover governance, networks, data protection, offshoring, personnel, subcontractors and exit, so they suit a written request.
Check viability, change and exit
Obtain financial and continuity evidence in proportion to how critical the service is. Record dependency on upstream platforms and specialist subprocessors. Define notice and approval for any change of ownership, hosting, source, model, subprocessor or package.
Require a usable export, a data dictionary, query definitions, audit history, deletion evidence and transition help. The government's Sourcing Playbook offers key policies and guidance on sourcing decisions for public services. Private buyers can borrow the discipline, but it is not a rule that automatically governs their purchase.
Where the commercial terms reach exit and renewal, the contract areas show what the agreement must settle.
Grade each answer and record the decision
Grade each answer as assertion, document, demonstration or buyer test. A demonstration shows the feature working once, and a buyer test shows it working on the buyer's own configuration. Name the reviewer, evidence, gap, deadline and consequence for each answer.
A mandatory failure should cause repair, scope reduction or rejection before price scoring. Named UK procurement, privacy, security, IP, commercial and legal reviewers should approve the completed file and the negotiated contract. Reopen the file after any material change.
Due diligence narrows uncertainty. It does not certify the vendor, its platform access, legal compliance, security or future performance. When candidates reach comparison, put them on the same criteria before anyone compares prices.
Before you send the request
- Confirm the contracting entity, registration and support entity.
- Record the quoted package, users, limits, integrations, sources and locations.
- Request the DPA, subprocessor list, penetration test summary, BCP/DR plan and insurance certificates.
- Ask for ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II or Cyber Essentials Plus scope and date, not a logo.
- Require a usable export, data dictionary, query definitions and deletion evidence.
- Decide in advance who grades each answer and by when.
Common questions
Which documents should be requested by name?
Ask for the master services agreement, the data processing agreement, the subprocessor list, a current penetration test summary, the business continuity and disaster recovery plan, insurance certificates and the exit or transition plan. Ask which of them are contractual and which are marketing material.
How should vendor answers be graded?
Grade each as assertion, document, demonstration or buyer test, and name the reviewer, evidence, gap, deadline and consequence. A mandatory failure should cause repair, scope reduction or rejection before price scoring.
Does completed due diligence certify the vendor?
No. It narrows uncertainty. It does not certify the vendor, its platform access, legal compliance, security or future performance, so the file is reopened after any material change.
