Tools and providers
Part of Choosing B2B social selling tools by mapping four system jobs before any shortlist
Vendor due diligence for B2B social selling: identity, data roles, security and exit evidence
Check a B2B social selling vendor on legal identity, product scope, data roles, security evidence, contract terms and exit evidence for the UK buyer.
B2B social selling vendor due diligence should follow the exact service and data path being bought. A supplier may hold prospect details, connect employee identities, write to a CRM and schedule public content. The checklist below turns those dependencies into evidence requests. It is not legal, security or financial assurance on its own.
What to take away
- Follow the exact service and data path being bought, not a brand name.
- Match the legal entity to product terms, insurance and bank details.
- Name the instrument behind each requestthe UK GDPR and Data Protection Act 2018, a data processing agreement, a transfer safeguard, ISO/IEC 27001 or Cyber Essentials evidence.
- Ask for a diagram showing platform, vendor, CRM and sub-processor connections.
- Define controller, joint controller or processor status for each activity.
- Due diligence is complete when the decision and its limits are reproducible.
Identity and contracting party
- Record the legal name, company number, registered address and entity that invoices and signs.
- Check the Companies House register under the Companies Act 2006: confirmation statement (CS01), annual accounts, officer appointments, current status and overdue markers.
- Match the legal entity to the product terms, insurance and bank details rather than assuming a brand name identifies it.
Companies House explains which details are available in its free register search. Its guidance also warns that the information is not comprehensive and can contain errors. Treat the register as one corroborating source, then seek accounts, references or professional advice proportionate to the commitment.
Verify the contracting entity
- Record legal name and company number
- Record registered address
- Identify entity that invoices and signs
- Check status, officers and filing history
- Match entity to terms, insurance, bank
Product and delivery boundary
- Attach the required edition, add-ons, users, social identities, CRM environment and support level.
- Link every mandatory capability to a dated first-party technical or support record.
- Identify implementation partners and which party remains accountable for configuration.
- Mark previews, staged releases and oral assurances as conditional until contracted and demonstrated.
Ask for a diagram showing platform, vendor, CRM and sub-processor connections. A broad statement that the service "integrates" is not enough to establish fields, direction, frequency or failure behaviour.
Define the delivery boundary
- Attach edition, add-ons, users, support level
- Link capabilities to dated first-party records
- Identify implementation partners and accountability
- Mark previews and oral assurances as conditional
- Request platform, vendor, CRM diagram
Personal information and location
- Define whether each party is controller, joint controller or processor for each activity.
- List prospect and employee fields, purposes, sources, retention and deletion triggers.
- Obtain the sub-processor list, hosting and support locations, and change-notice process.
- Identify any restricted transfer and the proposed safeguard before enabling live data.
Where the supplier is a processor, the ICO's guidance Contracts and liabilities between controllers and processors covers what the UK GDPR requires: documented instructions, confidentiality, security, sub-processors, rights assistance, audits and end-of-contract provisions. The guidance is under review following legislative change, so qualified review and a live recheck are required.
Map data roles and locations
- Define controller, joint controller or processor
- List fields, purposes, sources, retention
- Obtain sub-processor and hosting locations
- Identify restricted transfers and safeguards
Security and incident response
- Request evidence for identity controls, privileged access, logging, encryption, vulnerability handling and staff access.
- Ask who notifies whom after an incident, within what contractual period and with which investigation support.
- Trace cloud and other critical dependencies, including the service used to send support files.
- Test administrator removal, token revocation and account recovery in the proposed configuration.
The NCSC's supplier assurance questions provide a practical starting set, including breach awareness and cloud-service dependencies. Answers need evidence and risk-based follow-up; a certificate logo should not end the enquiry.
Commercial and operational terms
- Compare quotations using the same users, profiles, usage, term, currency, tax treatment and support.
- Identify renewal notice, usage overages, implementation work, training and exit assistance.
- Set service reporting, escalation and recovery expectations that can be measured.
- Resolve ownership and permitted reuse of content, configuration, reports and derived records.
Do not copy public list prices into a long-term business case without a dated quotation. Record assumptions and the person authorised to accept variation.
Exit evidence and decision log
- Export a sample in the promised format and verify it independently.
- Confirm deletion timing, backup treatment and evidence of completion.
- Locate drafts and scheduled posts, then define cancel, transfer and archive actions.
- Preserve the requirement trace, demonstrations, open risks, reviewer decisions and approval.
Give unresolved issues an owner and deadline. Reject the vendor if a mandatory control fails or evidence cannot be obtained; delay if the gap may be closed; accept a residual risk only through the organisation's authorised route. Due diligence is complete when the decision and its limits are reproducible, not when every checklist box contains a reassuring answer.
Before you act
- Record the legal name, company number and registered address.
- Attach the required edition, add-ons, users and support level.
- List prospect and employee fields, purposes, retention and deletion triggers.
- Request evidence for identity controls, logging and encryption.
- Compare quotations using the same users, term and support.
- Export a sample in the promised format and verify it independently.
Common questions
What should a buyer check about the contracting party?
Record the legal name, company number, registered address and the entity that invoices and signs. Check current status, officers, filing history and overdue markers for a UK company. Match the legal entity to product terms, insurance and bank details rather than assuming a brand name identifies it.
How should personal information and location be handled?
Define whether each party is controller, joint controller or processor for each activity. List prospect and employee fields, purposes, sources, retention and deletion triggers. Obtain the sub-processor list, hosting and support locations, and identify any restricted transfer and proposed safeguard before enabling live data.
When is vendor due diligence complete?
Due diligence is complete when the decision and its limits are reproducible, not when every checklist box contains a reassuring answer. Give unresolved issues an owner and deadline. Reject the vendor if a mandatory control fails, delay if the gap may be closed, or accept residual risk through the authorised route.
