Tools and providers
Part of Choosing email software from the workflow up, with the buying gates kept apart
Email vendor due diligence: the documents to request
Email vendor due diligence by document: what to request from the supplier, what each answer must show and when a gap should stop the purchase.
Due diligence on an email vendor starts as a list of documents to request, not a questionnaire to send. Each document answers one question about the purchase, and each can be missing, out of date or about the wrong edition. A completed form means little if it concerns the wrong service.
This is for organisations in England. It is non-ranked, names no preferred supplier and excludes sector-specific duties. No control or contract was tested. Qualified UK privacy, security and commercial reviewers must decide what evidence the proposed use requires.
What to take away
- Ask for documents, not assuranceseach one has a version, a date and an owner.
- A document that describes the wrong edition, geography or service answers nothing.
- A sales deck cannot override a signed restriction.
- Open is not a half-passan unresolved mandatory item blocks signature.
- Reject or defer the purchase when critical role, transfer, security, accessibility, incident, export or continuity evidence is unavailable.
The request list at a glance
Send the list before the first meeting. Each row names what to ask for and what would justify stopping. Use the same list for every supplier, so a supplier comparison rests on equal evidence.
| Document | Ask for | Stop or defer when |
|---|---|---|
| Order form and online terms | Entities, product, edition, add-ons, term, support level | Terms conflict with a signed restriction |
| DPA and sub-processor list | Current versions with notice and objection terms | Roles cannot be analysed from the text |
| Assurance report or certificate | Service, edition, locations, control period, exclusions | Scope does not match the service bought |
| Transfer paperwork | IDTA, or the UK Addendum to the EU standard clauses, plus a transfer risk assessment | The mechanism or the assessment cannot be produced |
| Incident terms | Contacts, notification commitments, escalation path | Nobody is named or the terms are vague |
| Recovery statement | Which objectives are commitments and which are targets | The exercise history is missing |
| Accessibility report | VPAT or conformance report against WCAG 2.2 AA, known defects, support route | Only an alt-text field is offered |
| Export and deletion terms | Formats, omitted fields, retention schedule, deletion certificate | The full record cannot leave |
The order form and incorporated terms
Ask for the order form and every incorporated online term. Record the legal entities, product, edition, add-ons, hosting choice, user count, usage unit, term and support level.
Compare change rights, renewal, usage measurement, price adjustment, suspension, termination, liability and governing law. The contract areas to specify before signing give the same list from the drafting side.
Purchase record essentials
- Legal entities, product, edition, add-ons
- Hosting, user count, usage unit, term
- Support level and incorporated online terms
- Evidence source, version, access date, region
- Labelstated, assured, tested, committed
Set an expiry for each item. A current sub-processor list may change while an annual assurance report describes an earlier control period. Re-open time-sensitive records before signature, renewal, a new integration and any material change in processing.
Where only a summary is available, record the missing underlying evidence and decide whether that gap itself prevents purchase.
Data and responsibility requests
Ask who actually decides purposes and essential means for campaigns, analytics, product telemetry and support. Then request the personal-data categories, populations, sources, integrations, storage locations, remote access and onward recipients, and draw them as a data path.
Obtain the current DPA and sub-processor list, including notice and objection arrangements. Check what help the supplier gives with rights, incidents, audits, return and deletion.
Map data responsibility
- Identify controller and processor roles
- List data categories, sources, recipients
- Obtain current DPA and sub-processor list
- Check rights, incident, audit, deletion assistance
- Apply transfer guide to real data path
The ICO marks its controller and processor contract guidance as under review following the Data (Use and Access) Act. Use the live version and legal advice at contract signature.
For international access, apply the ICO's transfer guidance to the real data path rather than accepting a region label. Ask which mechanism covers it: an adequacy regulation, the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses.
Where the IDTA or Addendum is used, ask for the transfer risk assessment. The ICO says that if you initiate a restricted transfer, you are responsible for complying with the transfer rules.
For UK email campaigns, the UK GDPR and PECR rules still apply to the organisation. Check how the supplier supports recording consent and applying the soft opt-in where applicable; the organisation remains responsible for its campaign compliance.
Security evidence scoped to the service
Match every certification or test, including any ISO 27001 certification or SOC 2 report, to the service, edition, locations, control period and stated exclusions. Then review identity controls, least privilege, privileged access, API credentials, logging, encryption boundaries, backup and vulnerability handling.
Security evidence scope
- Match certification to service and period
- Review access, logging, encryption, backup
- Obtain incident contacts and escalation paths
- Separate recovery commitments from targets
- Rehearse buyer-supplier hand-off
Obtain supplier incident contacts, notification commitments, evidence support and escalation paths. Ask which recovery objectives are commitments, which are targets and how they were exercised.
NCSC SaaS guidance emphasises that customer configuration, access and recovery remain important. Rehearse the buyer-supplier hand-off rather than inferring resilience from a badge.
Email-specific requests
Confirm how the service supports SPF, DKIM and DMARC, including alignment for the organisation's sending domains, and whether DMARC aggregate reports reach the organisation. Ask whether sending uses shared or dedicated IPs, and how any IP warm-up is planned and monitored.
Request evidence of blocklist monitoring and ask about feedback-loop support. Ask how the supplier monitors complaints and bounces, what thresholds or limits it applies, and what evidence it can provide about inbox placement.
Check the supplier's support for Google's and Yahoo's current bulk-sender requirements, including one-click unsubscribe (RFC 8058) for promotional mail, and verify the requirements that apply to the organisation's own sending.
Accessibility evidence
Request the supplier's accessibility conformance report, often supplied as a VPAT, and check it names the standard it measures against. WCAG 2.2 level AA is the usual yardstick, and EN 301 549 is the European standard built on it.
The organisation's own duties under the Equality Act 2010 do not pass to the supplier. Ask for known defects, the roadmap and a support route, then test the delivered email.
Exit, deletion and operation
Ask which export formats are available, including CSV where offered. Export contacts, permission evidence, suppression state, templates, configuration and logs where available, document omitted fields and transformations, then restore the agreed portable set to a safe destination.
Confirm the deletion workflow, backups, legal retention and post-termination retention period. Ask for the retention schedule and a deletion certificate, with the date it will be issued. Record the termination notice period and any conditions that affect continuity or access to exports.
Name who can pause sending, disable an integration, invoke support, reject a change and authorise restart. Test imports and suppression on synthetic fixtures rather than trusting a badge.
Closing the request
Finish with pass, fail or open for every mandatory gate. Open is not a half-pass. State remediations, owners, deadlines, contract conditions and review triggers.
How the evidence is classified and weighed belongs to the review methodology. Here the output is simpler: a request list with every row answered, dated and owned, and a clear authority to stop.
Before you act
- Send the request list before the first supplier meeting.
- Record the exact legal entities, edition, add-ons, term and support level.
- Obtain the current DPA and sub-processor list with notice and objection terms.
- Match every certification to service, locations, control period and exclusions.
- Ask for export formats, omitted fields and deletion evidence.
- Finish with pass, fail or open for every mandatory gate.
Common questions
What should a buyer do when only a summary of evidence is available?
Record the missing underlying evidence and decide whether that gap itself prevents purchase. Re-open time-sensitive records before signature, renewal, a new integration and any material change in processing.
How should international access be assessed?
Apply the ICO's current transfer guidance to the real data path rather than accepting a region label. The controller and processor contract guidance is under review after the Data (Use and Access) Act, so use the live version and legal advice at signature.
What does accessibility evidence require beyond an alt-text field?
Request product conformance material, known defects, roadmap status and a support route. Test the delivered email and core operator tasks with relevant users and assistive technologies, because an editor's alt-text field does not establish accessible output.
