Tools and providers
Part of Write the operating case before comparing landing page software products
Due diligence on a landing page supplier, from legal party to proven exit
A due-diligence checklist for landing page suppliers covering identity, product scope, data, security, accessibility, support, contracts and exit.
Vendor due diligence should end with a dated evidence pack. The buyer must be able to show what it checked, what remains unknown, who accepted each decision and when the evidence expires.
This checklist was prepared on 6 September 2026 for organisations operating in England. It is general procurement information, not legal, privacy, security, accessibility, tax or commercial advice. Named qualified specialists must review the actual use and contract before approval.
What to take away
- Vendor due diligence should end with a dated evidence pack for one supplier, one legal entity and one product edition.
- A trust badge or sales demonstration is not enough to show what was checked and what remains unknown.
- Match the security evidence level to the page's data and business impact rather than accepting unverified promises.
- A template name or supplier statement is not an accessibility conformance result.
- Set a hold if the supplier cannot identify the contracting party or provide a workable exit.
1. Identify the party and product
- Record the full contracting name, company number where applicable, address and governing documents.
- Check the public register through the government's Companies House information service, while recognising that registration does not verify product quality, solvency or supplier claims.
- Attach the order form, exact edition, service description and every document incorporated by reference.
- List administrators, users, domains, integrations, limits and excluded functions.
Resolve discrepancies between a brand name, invoice entity and contractual provider before proceeding.
Identify the contracting party
- Record full contracting name
- Note company number and address
- Check Companies House register
- Attach order form and edition
- List users, domains and integrations
- Resolve brand and invoice discrepancies
2. Map content, data and roles
- Inventory page copy, media, code, form fields, identifiers, scripts and destination systems.
- Decide the factual controller, processor or other roles for each purpose rather than accepting a generic label.
- Record instructions, confidentiality, security, sub-processors, rights assistance, audits, incident support, return and deletion.
- Identify processing locations, access countries and transfer routes.
The ICO's contracts and liabilities guidance describes UK GDPR contract topics and is marked under review after the DUAA. Its international-transfer guide helps frame restricted-transfer analysis. Both require publication-day and signature-day review by a qualified privacy professional.
3. Examine security evidence
Examine security evidence
- Ask which service, period and locations any assurance report covers, such as an ISO/IEC 27001 certificate or a SOC 2 report.
- Check identity, multi-factor authentication, privilege separation and service-account controls.
- Record encryption boundaries, logging available to the customer and data-isolation claims.
- Define incident severity, notification route, evidence access, recovery and communications.
- Review vulnerability reporting, change control, dependency risk and business continuity.
The NCSC advises that confidence in a provider's security claims can range from an unverified promise to independently tested assurance in its cloud-provider selection framework. Match the evidence level to the page's data and business impact.
4. Test accessibility and page control
- Demonstrate keyboard operation, focus order, labels, errors, zoom and responsive layout on a representative page.
- Review the editor and approval process separately from the visitor-facing output.
- Confirm that the buyer can inspect or control custom code, scripts and third-party widgets.
- Preserve domain ownership, DNS recovery, certificates and redirects outside a single supplier account.
Use WCAG 2.2 as a technical reference and have an accessibility specialist set the applicable test scope. A template name or supplier statement is not a conformance result.
5. Read support and commercial terms
- Define support channel, operating hours, severity, response clock, exclusions and escalation.
- Record fees in GBP or stated currency, VAT status, unit, period, minimum term, overages and promotion conditions.
- Check renewal, price and feature changes, suspension, acceptable use, intellectual property and liability.
- Identify service acceptance, remedy, termination rights and the effect of a supplier acquisition or product withdrawal.
For a buyer in England, expect fees quoted in GBP with VAT treatment stated, and contracting on English law and jurisdiction unless the signed documents say otherwise.
Do not infer a service level from ordinary support copy. The signed documents must state the obligation and remedy that the buyer is relying on.
6. Prove exit and continuity
Request sample exports for pages, assets, lead records, objections, consent evidence, definitions and audit history. Test whether another service can reconstruct the critical page. Document redirect control, deletion timing, back-up treatment, sub-processor deletion and evidence of completion.
Set a hold if the supplier cannot identify the contracting party, demonstrate an essential function, support required processing terms, meet the assurance threshold, allow the core accessible task or provide a workable exit. A senior signature cannot turn an unknown into evidence.
Before you act
- Record the contracting name, company number, address, governing documents, order form, exact edition and service description.
- Inventory page copy, media, code, form fields and destination systems.
- Ask which service, period and locations any assurance report covers.
- Demonstrate keyboard operation, focus order, labels, errors and zoom, and request sample exports for pages, assets, lead records and audit history.
Worked example of a completed evidence-pack entry: item, contracting party; checked against the Companies House register on 6 September 2026 by the procurement lead; evidence expires 6 September 2027.
Common questions
What should the buyer be able to show after vendor due diligence?
The buyer must be able to show what it checked, what remains unknown, who accepted each decision and when the evidence expires. The process should end with a dated evidence pack for one supplier, one legal entity and one product edition.
How should the buyer treat security assurance reports from a landing page supplier?
Ask which service, period and locations any assurance report covers. The NCSC advises that confidence in a provider's security claims can range from an unverified promise to independently tested assurance. Match the evidence level to the page's data and business impact rather than accepting a generic claim.
When should a buyer set a hold on a landing page supplier?
Set a hold if the supplier cannot identify the contracting party, demonstrate an essential function, support required processing terms, meet the assurance threshold, allow the core accessible task or provide a workable exit. A senior signature cannot turn an unknown into evidence, so unresolved gaps should stop approval.
