Tools and providers
Part of Choosing social commerce tools by starting with the route a customer will take
Due diligence on a social commerce vendor, from subcontractors to a proven exit
Check a social commerce vendor in England through entity, access, security, data, subcontractor, service, continuity and tested exit evidence.
Short answer: map the access a vendor will receive first, then request evidence proportionate to that risk.
What to take away
- Map the access a vendor will receive before requesting evidence proportionate to that risk.
- Treat the Companies House register as a verification source, not a reliability certificate.
- Ask for evidence against the retailer's requirements rather than accepting an undated security statement.
- A badge or questionnaire response should not replace technical and contractual evidence.
- Finish with an exceptions log naming the evidence gap, risk owner, deadline and launch consequence.
Confirm identity and authority
- Record the legal entity, company number, registered address and proposed contracting party.
- Match that entity across the proposal, terms, privacy notice and invoice.
- Confirm who can bind it and who provides the actual service.
Companies House's register-search guidance lists public details including status, filings, officers and insolvency information. It also says the service is not comprehensive. Treat the register as a verification source, not a reliability certificate.
Confirm vendor identity
- Record legal entity and company number
- Match entity across proposal and terms
- Confirm who can bind the vendor
- Identify who provides the service
Beyond Companies House, check the ICO register of data protection fee payers for the vendor's registration number and match it against the proposal. Validate the VAT number through HMRC's check a UK VAT number service, which confirms the number and the registered business name.
Trace access and subcontractors
- List every shop, platform, catalogue, advertising and support permission requested.
- Reject shared administrator accounts and unexplained broad access.
- Identify hosting, support and other subcontractors involved in the service.
- Record where credentials and business data travel.
The NCSC's supply-chain assessment guidance recommends knowing what suppliers and subcontractors hold, setting minimum security requirements and checking arrangements over time. Ask for evidence against the retailer's requirements rather than accepting an undated security statement.
Examine personal-data roles
- Name each purpose and dataset, including account handles, order details, pixels and support messages.
- Decide whether each party acts as controller, processor or in another role for that activity.
- Review retention, deletion, rights support, incident notice and international transfers.
- Clause examplethe supplier must give prior written notice before adding a subprocessor, and the retailer may object on reasonable grounds. On termination the supplier must delete or return all retailer data and confirm deletion in writing.
Where a processor relationship exists, the ICO's contract guidance covers required processing details, documented instructions, security, subprocessors, assistance, audits and end-of-contract treatment. The ICO marks that guidance as under review following legislative change, so a qualified reviewer must check the current position before signature.
Test security and recovery claims
- Ask how named users authenticate and how privileged access is logged.
- Obtain incident-notification contacts, timing and required contents.
- Test removal of a user, revocation of a token and restoration of a safe configuration.
- Identify dependencies whose failure can stop listings or orders.
The NCSC's small-organisation security guide covers accounts, devices, backups and attack recognition. Use it to set a baseline, then add controls required by the vendor's actual access. A badge or questionnaire response should not replace technical and contractual evidence.
Review service and customer continuity
- Define supported tasks, service hours, escalation and change notification.
- Walk through a stale price, rejected product, failed order hand-off and refund dispute.
- Assign customer communication if the vendor or social platform is unavailable.
- Record which system remains authoritative during recovery.
GOV.UK's distance-selling guidance lists information and fulfilment duties for covered transactions. A retailer cannot outsource the practical problem of a confused customer merely by allocating fault in a supplier contract.
Ask for continuity evidence for the specific service, not a generic corporate plan. Identify the longest tolerable catalogue or order outage, the manual fallback, recovery priority and who can authorise it.
Reconcile those answers with any promised availability or restoration terms. Where the supplier depends on one social platform, record that concentration rather than assuming the vendor can restore an upstream service.
Prove the exit
- Export a representative catalogue, configuration and operational history before full rollout.
- Specify format, delivery time, transition help and deletion evidence.
- Remove feeds, pixels, applications, tokens and user accounts in a rehearsal.
- Preserve only records the retailer has a documented reason to retain.
For English contracting, name the law of England and Wales as governing law and set termination rights for cause, on notice, and immediately on insolvency or a serious data breach. Check whether TUPE could apply if the vendor's staff transfer to a replacement supplier, and take advice before signing.
Finish with an exceptions log naming the evidence gap, risk owner, deadline and launch consequence. Repeat checks when access expands, a subcontractor changes, the checkout route moves or the vendor's financial or service position materially changes.
Worked example of the log:
| Gap | Risk owner | Deadline | Launch consequence |
|---|---|---|---|
| No subprocessor list or approval clause | Data protection lead | 5 working days before launch | Hold order feeds until the clause is agreed |
| Token revocation test failed | Ecommerce manager | 10 working days before launch | Pause the advertising pixel until the test passes |
| No deletion certificate at exit | Procurement lead | 30 days after termination | Retain the final payment until deletion is confirmed |
Date each supporting document so later reviewers can recognise stale assurance.
Before you act
- Map vendor access before requesting evidence.
- Confirm the legal entity and who can bind it.
- List every permission and named subcontractor.
- Name each personal-data purpose and role.
- Test user removal and token revocation.
- Prove the exit with a rehearsal.
Common questions
Why should due diligence follow the access a vendor receives?
A supplier posting approved content presents a different exposure from one holding catalogue credentials, customer orders or advertising identifiers. Access determines which controls and contractual terms actually matter.
What does the NCSC guidance say about suppliers and subcontractors?
The NCSC's supply-chain assessment guidance recommends knowing what suppliers and subcontractors hold, setting minimum security requirements and checking arrangements over time. Ask for evidence against the retailer's requirements rather than accepting an undated security statement, because arrangements change.
How should a retailer prove the exit before full rollout?
The export, rehearsal and deletion steps are set out in Prove the exit above.
