How to vet a landing page software agency with no evidence pack

What to take away

Run the review as a set of mandatory gates, not a score out of ten. A gate that fails produces hold.
Get the exact registered name, company number and contracting signatory before you discuss creative work.
Fix the scope and the software plan, and settle ownership of the account, domain, templates, assets and lead data.
Ask for evidence on the page work itselfmobile speed, form and lead-routing behaviour, tracking and analytics setup, and the landing page software the agency configures.
Treat case studies as supplier-selected evidence, and public ratings as unusable without their collection method.
No agency can be reviewed or recommended without an evidence pack. Send one dated request before you pay for discovery.

Scope of this review

Point / Position

Subject: An agency route for a buyer in England commissioning a landing-page build
Evidence held: Public procurement, review, security and data-protection records only
Excluded: Unnamed agencies, ratings, testimonials, prices and performance claims
Conflicts: No funding, referral fee or agency relationship recorded

Start with the legal entity, not the trading name

Ask for the registered name, company number, any trading names, the entity that will sign and the authorised signatory. Companies House gives a route to get registered company information. Match that filing against the proposal and the invoice.

Register material is not a guarantee. The Companies House service disclaimer warns that filed information is not comprehensive and is not verified simply because it was filed. Confirm bank details, the insurance certificate and the signatory directly. Buyers who want the contract points set out should put them in the same dated evidence request rather than accept a verbal assurance.

Define the work and the software plan

Name each deliverable in the proposal: research, copy, design, build and platform configuration. Keep analytics, testing and post-launch support on separate lines, each with a named owner. On the software side, list the templates, the forms and lead-routing rules, the tracking and analytics setup and any CRM or email connection the pages feed.

State the exact software plan, tier and billing entity. Say who owns the account, the domain and the templates, and who owns the source assets and the lead data. Ask which landing page software the agency configures day to day — a hosted builder such as Unbounce or Instapage, a site platform such as WordPress or Webflow, or the funnel tool the client already runs — and for a worked page from each. A claim of partner or specialist status should be checked in the platform's own partner listing, not only on the agency's site.

Example: a dated evidence request

Send one written request to named people, with a reply date against each line. A workable pattern:

Item	Ask whom	Reply by
Registered name and company number	Agency director	Day 2
Contracting entity and signatory	Finance lead	Day 2
Insurance certificate and bank details	Finance lead	Day 3
Software plan and account owner	Delivery lead	Day 5
One permissioned reference	Client lead	Day 10

If nothing arrives by the reply date, the legal identity and scope gates stay open and paid discovery waits. Readers who want a finished pack assessed should use the launch review guide.

Weigh case studies and public ratings

A case study is material the supplier chose to publish. Ask the named client what it can verify, then request one permissioned reference for comparable work. A client that cannot confirm the numbers was never a controlled comparison.

Do not turn public star ratings into a score without knowing how reviews were collected and moderated. CMA guidance for online review sites asks sites to show genuine reviews, transparent checks and any interests, as published in the reviews guidance for online review sites.

Check data protection and security

For lead data, name the controller, the processor, the sub-processors, the retention period and the exit route. The ICO publishes UK GDPR contract guidance for controllers and processors. Parts of that guidance are being updated, so take current qualified advice.

Security evidence should cover named users, privileged access, logs, incident contacts and offboarding. The NCSC's SaaS security guidance explains why the buyer keeps configuration and operational duties even when a provider runs the service.

When a mandatory gate fails

Hold is the right verdict when a mandatory gate is unmet. It is not a low score that good design work can lift.

A worked failure: an agency quotes under a trading name but will not name the contracting entity. That fails the legal identity gate on day two, and the portfolio does not offset it.

Set separate gates for legal identity, scope, data, security and contract terms. Accessibility, claim approval and exit planning take their own gates. Run a claims and testimonials check before any verdict, because unproven page claims sink an otherwise sound supplier.

What satisfies each gate

Gate	Evidence that satisfies it
Legal identity	Registered name and number matching the filing, the authorised signatory, and bank and insurance details confirmed direct
Scope	Named deliverables with owners, including templates, forms, lead routing, tracking and post-launch support
Software plan	Plan, tier and billing entity in writing, with account, domain and template ownership fixed
Data protection	Controller, processor, sub-processor, retention and exit roles written into the contract
Security	Named users, privileged access, logs, an incident contact and an offboarding step for the agency
Contract terms	The written terms themselves, covering liability, IP, term, notice, data and exit, read before signature
Accessibility	A named standard and a record of testing the built pages against it
Claim approval	A named approver and a dated record for every claim and testimonial on the page
Exit	A tested route to export lead data and hand over the account, templates and assets

A gate passes only when the written evidence is in hand and matches the proposal. Anything less is a hold.

Before you pay for discovery

Registered name, company number and contracting entity obtained.
Scope split into named deliverables, with the exact software plan and the platforms, forms and tracking named.
One permissioned reference requested for comparable work.
Controller, processor and sub-processor roles mapped.
Bank details, insurance certificate and signatory confirmed.
One dated evidence request issued before any payment.

Common questions

What evidence should a buyer demand first?

The legal entity, the contracting signatory and the scope. Without those three, no other document can be tied to a real supplier. Then add data protection, security and contract terms.

Why is there no league table of named agencies here?

No evidence pack or buyer brief was supplied, so a ranking would be invented rather than reported. This article sets out the review method and the gates instead.

What must happen before anyone publishes an agency verdict?

A named reviewer inspects the actual proposal, repeats the checks, discloses any relationship and states what was tested. Until then there is no selection.

Can a supplier case study count as a reference?

No. It is supplier-selected material. A reference counts only when the named client confirms comparable work and agrees to be contacted.