Tools and providers
Part of Selecting conversion suppliers by one store job, one dossier and independent risk gates
Vetting a conversion supplier's identity, data roles and exit before you buy
Investigate a conversion supplier's identity, exact service, data roles, security, customer effects, commercial terms and workable exit before purchase.
Start with one tool job and exact service edition.
What to take away
- Due diligence should end with evidence, owners and open questions, not a completed-looking form.
- A supplier that passes identity checks can still fail data, accessibility, consumer, safety, payment, security or exit review.
- Record the supplier's support boundary as carefully as its feature boundary.
- Name the evidence artefact for each gate, such as a subprocessor list, penetration test scope or deletion certificate.
- A due-diligence file expires when its material facts no longer match the service.
- The decision is proceed to controlled testing, request evidence or hold; an unresolved non-compensating gate blocks procurement.
Identity and service
- Record the legal contracting entity, trading names, registered jurisdiction, address and signatory authority. Use the government's company information service to corroborate available registered facts. Do not treat registration as endorsement, solvency assurance or proof of a product claim.
- Name the service, edition, eligibility, UK availability, configuration, dependencies, inputs, outputs, exclusions and documentation date. Attribute each feature to its current official supplier record if a candidate is later named.
- Define the ecommerce task and affected journey states. Prevent a session-recording brief from expanding into personalisation, fraud or payment decisions without a new assessment.
Record the supplier's support boundary as carefully as its feature boundary. Identify contact routes, entitled users, evidence required for a case, escalation ownership and what happens outside the contracted service. Leave response and restoration thresholds blank until the merchant defines the operational need and the supplier accepts it contractually.
Data and security
- Map device storage, scripts, identifiers, order data, payment references and support records. The ICO's storage and access guidance supplies the PECR boundary for relevant operations.
- Determine controller and processor roles from real decisions. Inspect instructions, confidentiality, subprocessors, penetration test scope, transfers, rights assistance, retention, return, deletion and audit evidence. The ICO's contracts guidance is under review following the DUAA, so reopen it before signature.
- Ask who owns access, incidents and recovery. Tailor the NCSC's supplier assurance questions to production access, remote support, imported code and service criticality. Record a certificate's issuer, subject, scope, period and exclusions without calling it approval.
Customer and transaction effects
- Before checkout changes go live, test whether the configured service changes product claims, price, choice, authentication, payment, cancellation, refund or support. Use the CMA's price transparency guidance to check mandatory charge presentation, not as a product-selection badge.
- Before a listing change, confirm that product identity, warnings, traceability and withdrawal stay under a separate safety owner. Use OPSS guidance to map duties and corrective-action context across the supply chain.
- Before accepting a tool report, require an accessibility evidence plan for the whole journey. W3C WAI's evaluation overview says knowledgeable human evaluation is needed because no tool alone determines accessibility.
- Before the tool touches payment flow, identify payment entities, authorisation, capture, settlement, refund and dispute roles. Check FCA register information as bounded evidence, but it does not decide the supplier's suitability.
Ask how customer complaints, correction requests and disputed records reach the merchant. A tool provider may supply a report without controlling the underlying order or customer remedy. The contract and runbook should show who corrects each system, preserves the reason and informs affected teams.
Commercial operation and exit
- Leave price blank unless currency, VAT status, edition, unit, billing period, term, limits, promotion and research date are evidenced. Add implementation, internal labour, assurance, support, incident and migration work.
- Write buyer-owned fields for service definition, evidence, availability clock, exclusions, support response, change notice, credits, liability and insurance. Do not import a market SLA.
- Obtain export format, completeness test, configuration handover, deletion certificate, residual-backup treatment, transition help and termination route. Rehearse restoration without supplier assistance using synthetic or authorised material.
Track future changes after signature. Assign owners to monitor editions, documentation, interfaces, subprocessors, transfer arrangements, assurance reports, terms and end-of-life notices. Define which changes require risk review, fresh testing, customer communication, suspension or exit. A due-diligence file expires when its material facts no longer match the service.
Worked example: session-replay tool record
- Entity
- the UK contracting entity on the order form, with its company number checked against the government company information service.
- Edition
- the edition named on the order form, with its date and UK availability.
- Roles
- merchant controller, supplier processor, subprocessor list checked against the ICO contracts guidance.
- Exit
- CSV export, deletion certificate, configuration handover and a restore test without supplier assistance.
Every specialist approves only their field.
Before you act
- Record the legal contracting entity and signatory authority.
- Map device storage, scripts, identifiers, order data and payment references.
- Determine controller and processor roles from real decisions.
- Test whether the service changes product claims, price or payment.
- Obtain export format, configuration handover and deletion evidence.
Common questions
What should be recorded about the supplier's identity and service?
The record needs the legal entity, the exact edition and the evidence that links each feature to the supplier's current documentation. If the candidate or the edition changes, the old record no longer supports the buy decision.
How should data and security roles be determined?
Roles follow the real decisions in the workflow, not the label in the contract. Ask for the subprocessor list and the penetration test scope, then record who owns access, incidents and recovery.
What should be included in commercial operation and exit planning?
Commercial planning needs buyer-owned fields for service definition, evidence and availability. The exit plan needs a deletion certificate, export format and configuration handover, plus a restore test without supplier assistance.
