Tools and providers
Part of Vetting a web design agency's tools and suppliers in the UK
Vendor due diligence for web design agencies: identity, data and exit checks
Investigate a web supplier with evidence-led identity, data, security, accessibility, contract, cost, continuity and exit checks for England buyers.
An England buyer needs the exact legal supplier, contracted service and delivery chain. The checklist below does not approve a vendor and is not legal, security, tax or financial advice.
The method was reviewed on 6 September 2026. No supplier was contacted or audited.
What to take away
- Vendor due diligence should end with evidence, owners and unresolved questions, not a comforting score.
- Each gate is independent, so a strong balance sheet cannot cure an inaccessible product or bad exit clause.
- Registration on Companies House is identity evidence only, not endorsement or solvency assurance.
- A fail or unresolved mandatory gate keeps the purchase on hold.
Identity and authority
- Match the proposal, invoice and terms to the legal entity. Use the Companies House service for a UK-registered company to check the registered name and number.
- Record the trading name, registered number, address, signatory authority and any reseller or group-company role.
- Confirm which entity owns the service, hosts the data, provides support and receives payment.
Worked example: the proposal names the trading brand, the invoice names a parent company, and the hosting terms name a separate subsidiary. Ask for a group structure chart and a written statement that identifies the contracting entity, the code owner, the data controller and the payment recipient. If the chain still conflicts, keep the identity gate unresolved.
Pass evidence is a consistent entity chain and an authorised contracting route. Stop if material identities conflict or the vendor will not clarify them.
Identity and authority checks
- Match proposal, invoice and terms to legal entity
- Record trading name, registered number and address
- Confirm signatory authority and reseller role
- Identify entity owning, hosting, supporting, receiving payment
- Stop if material identities conflict
Service and supply chain
List the precise edition, hosting region, integrations, subprocessors and buyer-controlled components. The NCSC's cloud supply-chain principle asks buyers to understand access to customer data and metadata as well as the provider's management of its suppliers.
Supply chain evidence to request
- List edition, hosting region and integrations
- Identify subprocessors and buyer-controlled components
- Request scoped security material and report dates
- Obtain exceptions, incident route and recovery evidence
- Mark gated documents as unseen until reviewed
Request the scoped security material, report dates, exceptions, incident route, recovery evidence and vulnerability process. A public badge is not the underlying report. Mark gated documents as unseen until an authorised reviewer reads them.
Ask for the artefact and its date: SOC 2 Type II report, ISO/IEC 27001 certificate with scope, Cyber Essentials or Cyber Essentials Plus certificate, and the latest penetration test date, scope and remediation status.
Data and privacy
Map every purpose, person, data type, storage location, recipient, transfer and retention rule. Assign controller and processor roles from the actual decisions. The ICO's contract guidance identifies required processor subjects, including instructions, subprocessors, security assistance, audit information and return or deletion.
Data and privacy mapping
- Map purpose, person, data type, location, recipient
- Assign controller and processor roles
- Ask for deletion evidence and backup treatment
- Request subprocessor notice and rights help
- Review analytics storage under PECR separately
Ask for deletion evidence, backup treatment, subprocessor notice and help with rights and incidents. Keep analytics storage or access under PECR as a separate review.
Accessibility and service operation
Collect an accessibility statement or a conformance report against WCAG 2.2 Level AA for the exact user interface and version. Then test the buyer's staff journey and generated website. GDS's COTS guidance says public-service accessibility assurance must be specific to the service. It is a useful warning for other buyers, not a private-sector legal test.
Check support channels, hours, severity definitions, clock rules, escalation, planned maintenance and recovery. Leave service levels blank unless the contract states them.
Rights, money and exit
Name ownership and licences for source code, designs, content, fonts, plugins, templates and generated material. Record currency, VAT treatment, billing unit, term, renewal, usage charges, support, migration and exit cost. Qualified reviewers must examine procurement, employment access, IP, contract, tax and finance separately.
For contract terms and claims, the Competition and Markets Authority (CMA) and the Advertising Standards Authority (ASA) also publish UK-wide guidance.
Ask finance to reconcile the quote, order form, renewal notice and invoice on the same basis. Optional support, additional environments, storage, traffic, collaborator access and integration charges should remain separate fields. If a variable charge has no usable measurement rule or alert route, leave the commitment on hold. Do not replace an absent supplier figure with an industry average.
For migration, overage and support, ask for a rate structure. A purely illustrative exit line might be 40 developer hours at £100 per hour, so £4,000 plus VAT, with data export quoted as a fixed £750.
Overage could be priced per 1,000 extra page views or per 10 GB storage. Support might be a monthly retainer or a day rate. Label any assumed rate as illustrative, not a market benchmark.
Require a sample export and deletion route for code, content, media, configuration, analytics definitions, tickets, domains and credentials. Use this decision-note template for the final decision:
| Field | What to record |
|---|---|
| Gate | Identity, service, security, data, accessibility or exit |
| Evidence | Document name and date seen |
| Owner | Named person accountable |
| Status | Pass, fail or unresolved |
| Limitation | Accepted risk or missing item |
| Recheck | Renewal or review date |
Before you act
- Match proposal, invoice and terms to the legal entity.
- Confirm which entity owns, hosts, supports and receives payment.
- List edition, hosting region, integrations, subprocessors and buyer components.
- Map every purpose, person, data type, location, recipient, transfer and retention rule.
- Collect an accessibility statement or WCAG 2.2 AA conformance report for the exact interface and version.
- Require a sample export and deletion route before committing.
Common questions
What evidence should confirm the supplier's identity and authority?
Match the proposal, invoice and terms to the legal entity. Use Companies House for a UK-registered company to check the registered name and number. Record the trading name, registered number, address, signatory authority and any reseller or group-company role. Confirm which entity owns the service, hosts the data, provides support and receives payment.
How should a buyer handle security certificates and gated documents?
Request the scoped security material, report dates, exceptions, incident route, recovery evidence and vulnerability process. Ask for SOC 2 Type II, ISO/IEC 27001, Cyber Essentials or Cyber Essentials Plus, and pen-test dates with scope.
Mark gated documents as unseen until an authorised reviewer reads them. The NCSC cloud supply-chain principle asks buyers to understand access to customer data and metadata as well as the provider's management of its suppliers.
What should happen if a mandatory gate fails or stays unresolved?
Do not sign while a mandatory gate is unresolved. Record the missing evidence, the named owner and the recheck date in the decision note. If a variable charge has no usable measurement rule or alert route, leave the commitment on hold. Do not replace an absent supplier figure with an industry average.
