Vetting a web design agency's tools and suppliers in the UK

When you commission a web design agency, you also buy its tools. The agency's proposal will name a design and prototyping tool such as Figma, a content management system such as WordPress or Drupal, a hosting provider, form and integration services and an analytics product, and your site will depend on each of them long after the agency's contract ends. This guide is how a UK buyer checks that stack before signing, and how an agency should present it.

What to take away

Define the job, the data it will hold and the handover evidence before comparing products.
Run pass, fail or unresolved gates before scoring features, and hold the decision while one is unresolved.
Compare suppliers on total cost across the term, not the monthly price.
Rehearse export and deletion before signature.

Define the job before the product

Write one service statement: who does which task, what evidence proves it done, and what stays outside the project.

Your procurement record should name:

Buyer, contracting entity and decision owner.
The user task and its evidence.
Permitted data and any transfer question.
Editing roles, retention and recovery needs.
Required exports, deletion proof and account handover.

The Government Digital Service wants public teams to keep control of stored data and avoid lock-in. Its guidance on choosing technology is written for government, though the decision discipline travels to a private commission in England.

Price the whole contract, not the subscription

A monthly price is one line of the model. Build it across the term you expect to keep the tool.

Put the licence or subscription, delivery work, assurance tests and the exit line on separate rows. Our blank budget sheet with a tax block and assurance reserves gives you the columns to copy.

Example: a 24-month cost total on illustrative figures

Figures here are illustrative, not market prices.

Supplier A quotes £240 a month for a hosted CMS plus £85 per editor seat. Three editors over 24 months put the licence line at £11,880. Migration adds £4,500, the accessibility audit £2,400 and exit work £1,800, giving £20,580 before VAT.

Supplier B quotes £390 a month with three seats included, plus £3,200 migration and £600 exit: £13,160. The cheaper headline became the dearer contract.

Keep the tool categories separate

Keep tool categories separate

Category	Evidence before approval
Design and prototyping	Edition, sharing rules, version history
Content management	Role model, workflow, rollback test
Hosting and delivery	Regions, subprocessors, tested exit
Forms and integrations	Fields, purpose, retention
Analytics	Event list, data flow, PECR assessment

One supplier may sell several categories, and each connected service still faces its own gates. Pin every entry to a named product and edition before approval. A good agency proposal fills this table in for you, row by row, with the product, the edition and who holds the account; a proposal that says only "our CMS" or "standard hosting" has not yet told you what you are buying.

What a filled-in row looks like, using products UK agencies commonly propose:

Design and prototyping:Figma or Sketch. Ask whose account the files live in and whether you get edit access at handover.
Content management:WordPress, Drupal, Umbraco or Craft CMS, either self-hosted or as a managed service. Ask for the edition, the plugins or modules, and who pays for their licences.
Hosting and delivery:a cloud platform such as AWS or Microsoft Azure, or a managed host such as WP Engine or Netlify. Ask for the data region and the list of subprocessors.
Forms and integrations:a form tool such as Typeform or HubSpot forms, and connectors such as Zapier. Ask where submissions are stored and for how long.
Analytics:Google Analytics 4, Matomo or Plausible. Ask whether the configuration sets cookies before consent, which is the PECR question.

None of these is a recommendation. The point is that each row names one product, and each product then goes through the gates below.

Check the agency itself

Before the tools, check the company proposing them. Look the agency up on Companies House to confirm the legal entity, its directors and whether its accounts are filed on time. Check the ICO's register of data protection fee payers, because an agency that will handle your users' personal data should appear on it. Confirm that the contracting entity on the proposal is the same one you found.

Apply non-compensating gates

Score features only after each mandatory gate has acceptable evidence. A weighted total can hide a failed accessibility or privacy test.

The accessibility gate has a fixed target. The latest published version of the Web Content Accessibility Guidelines is WCAG 2.2, which the W3C published on 5 October 2023 and updated on 12 December 2024. The criteria sit at three levels, A, AA and AAA, and the levels build on one another, so to be AA compliant a site must meet all of the A and AA criteria; for A and AA there are 55 criteria in total. Ask the agency which of its tools produce the public pages and the editing screens, and test both.

Accessibilitytest public pages and the editing interface against WCAG 2.2 level AA and the Equality Act 2010 duty on reasonable adjustments.
Privacyseparate administration, forms, analytics and marketing, then record purpose, lawful basis, retention and rights under UK GDPR and PECR.
Securitycheck authentication, least privilege, logging, backups and incident notification.
Intellectual propertylist ownership and licences for code, fonts, themes and media.

Where a provider handles personal data for the buyer, the ICO's contract checklist covers instructions, confidentiality, subprocessors, assistance and deletion.

Example: a gate outcome on analytics consent

Take analytics as the category. A supplier help page shows a default that stores an identifier on a visitor's device before consent, with no visible switch to change it.

The outcome is fail for that configuration. Ask for a consented-only setup and keep the field unresolved until a test proves the change. A polished dashboard does not offset the failure.

Build the evidence pack

Marketing pages locate a function. They do not prove it works with the buyer's content, roles and settings. Keep the page or terms where the licence allows.

For cloud services, the NCSC's supply-chain security principle asks buyers to understand which customer data and metadata reach third parties, and how the provider manages its suppliers.

Run bounded acceptance tests

Test with synthetic content unless the buyer has documented authority for live data. Give each test an owner, fixture and failure response.

Create, publish and roll back a page at three permission levels.
Export the content set and rebuild a sample page from it.
Load a form with synthetic data and trace it.
Test analytics with consent refused.
Run an automated scan, then a keyboard and screen-reader check.
Suspend the subscription in a sandbox and rehearse deletion.

Acceptance Test Plan

Editor creates draft but cannot publish
Reviewer corrects inaccessible component and retests
Form rejects malformed input without exposing data
Code change reviewed, staged and rolled back
Owner exports content, media, code and logs
Departing user loses access; buyer keeps accounts

Plan implementation and exit together

Start with an inventory of accounts, data, domains and certificates. Repositories, integrations and licences go on the same sheet with a named owner each.

Set a change freeze, back up source material and prepare rollback before the first transfer. Matching record counts do not prove that content still works.

Rehearse exit as you would a launch, testing what exports cleanly and what needs a paid plan.

Implementation and Exit Inventory

Inventory accounts, data, domains, certificates
Create named owners before migration
Set change freeze and back up source
Prepare rollback and reconcile totals
Rehearse export, paid plans and deletion

Common questions

Can one platform cover every tool category

Sometimes, but each connected service still faces its own gates. Ask for export of each asset type.

What if a supplier refuses a pilot

Mark the field unresolved and price the risk into the contract. A trial with synthetic content costs less than a failed migration.

How do we prove deletion at exit

Ask for written confirmation and a sample from the deletion log.

Do we need a lawyer and an accountant

Take legal advice where the contract terms are complex. Ensure financial checks cover total cost of ownership.