Decide what is being bought before any community tool demonstration

A community purchase combines a member experience with an operating model. Software can provide accounts, discussions, events, search and administration. It cannot decide which advice is safe, repair a weak purpose or allocate expert responsibility. A service supplier can provide people and process, but still needs clear authority and technology it can operate.

This guide is for English organisations evaluating hosted platforms, self-managed software, implementation partners or managed community services in 2027. Named products appear only as desk-researched examples from official public pages reviewed on 5 September 2026. No product was tested, no ranking is made and public descriptions must be confirmed for the exact plan and contract.

What to take away

Decide what is being bought

Separate four layers:

An organisation may buy one layer and supply the others internally. A hosted software vendor often does not run the community. A moderation agency may not own the application. A combined provider may subcontract important parts. Make every boundary visible before comparing proposals.

Write the current internal capability alongside the purchase. If nobody can own the member outcome, approve policy or answer specialist questions, more features will not fill the gap.

Turn member work into test cases

Requirements should describe observable journeys. Include an ordinary member need, a moderator task, a difficult exception and departure. For example:

Give each case acceptance evidence. Screenshots alone may not show permissions or audit history. A successful demonstration led entirely by a salesperson does not show whether the buyer's operator can repeat the work.

Classify requirements as mandatory, important or exploratory. Mandatory items need a clear consequence if absent. Weighting every feature equally rewards the longest catalogue rather than the safest fit.

Understand the main software models

Hosted specialist platform

The provider operates the application and infrastructure, usually as a subscription. This can reduce internal engineering work, but configuration, member operation and governance remain with the buyer unless the agreement says otherwise.

Circle describes community, courses and events within one platform. Mighty Networks presents communities, memberships and courses. These first-party pages indicate product direction, not fitness for a specific English service. The buyer must verify plan limits, permissions, accessibility, data terms and exit.

Open-source or self-managed route

Software can be operated on infrastructure chosen by the organisation or a technical partner. Discourse offers open-source discussion software alongside hosting. Self-management may increase technical control, while making upgrades, monitoring, backups and recovery the operator's responsibility.

Compare total work. A licence cost of zero does not make engineering, hosting, anti-spam controls, security response or support free. Decide who will maintain the system after the implementation specialist leaves.

Enterprise customer community

Some products are positioned around customer support and engagement within a wider service stack. Khoros Communities and Higher Logic Vanilla describe customer-community uses on their official pages. These may enter a shortlist where integration, scale or formal service arrangements matter, but the positioning itself is not evidence of performance.

Ask the same questions given to smaller-platform suppliers. An enterprise label does not establish administrator usability, transparent pricing, implementation effort or a clean export.

Custom or extended system

A buyer may add community functions to an existing portal or build a tailored service. This can integrate closely with customer identity and processes. It also creates product-management, accessibility, security and maintenance obligations that a purchasing comparison must cost.

Avoid custom work that merely recreates standard discussion features without a distinctive requirement. Conversely, avoid forcing a sensitive or regulated journey into a general tool because procurement appears quicker.

Evaluate human-service providers separately

Write a service workload with ranges: member numbers, new conversations, reports, events, languages, operating hours and specialist referrals. Ask providers to explain staffing, training, quality review, absence cover and escalation.

Use scenarios to examine judgement. How would the team handle an aggressive disagreement, suspected scam, inaccurate professional advice, hidden commercial relationship or privacy request? The aim is not to elicit a perfect scripted answer. It is to understand the decision boundary, evidence and people involved.

Meet those likely to deliver the work. Clarify whether named personnel are committed, how substitution occurs and which activity leaves the quoted scope. A global agency capability does not necessarily describe the English account team.

Check employment and contractor arrangements through proper due diligence without collecting irrelevant personal information. The buyer needs evidence of capacity, supervision and appropriate skills, not access to every internal record.

Compare like with like

Create separate tables for product and service evidence. Product fields might cover:

Service fields could cover scope, hours, staffing, authority, training, quality, reporting, escalation and transition. Then add an interface table showing who performs each task across buyer and suppliers.

Use the same scripted demonstration, questions and date for every candidate. Preserve blanks where evidence is absent. Do not turn absence into a numerical zero that implies a tested failure.

Quotes need a common boundary. Include subscription, implementation, migration, integration, training, routine operation, additional usage, specialist work, taxes and termination. Convert to a consistent period and mark uncertain volumes.

Investigate the vendor

Confirm legal and trading identities. Companies House publishes guidance on searching its register. Public filings support corporate checks but do not prove service quality, solvency or assigned capacity.

Map subcontracts and dependencies. Ask which entity hosts data, provides support, supplies moderation or controls a critical integration. The National Cyber Security Centre's supply chain security guidance helps organisations understand and manage supplier risk. Apply the questions to the importance and exposure of the proposed service.

Review evidence rather than badges alone. Security certifications, audit reports, penetration summaries, recovery tests and policies answer different questions. Assign an internal reviewer capable of interpreting each record and tracking exceptions.

Speak to references with comparable member activity and operating arrangements. Ask about implementation, incidents, change and exit, not only satisfaction. References selected by a supplier remain selected evidence.

Assess data, security and accessibility

Create an information map for profiles, contributions, messages, events, reports and analytics. Establish controller and processor roles, purposes, lawful bases, access, retention, transfers, sub-processors and individual-rights assistance.

The Information Commissioner's Office's controller and processor guidance explains that role depends on the actual processing. Check contract terms against product behaviour and the buyer's configuration.

Security review should address identity, administrative privilege, logging, vulnerability handling, incident notification, resilience and recovery. The NCSC's cloud security principles offer a structure for assessment without certifying a particular platform.

Accessibility belongs in the member test, operator test and procurement record. W3C publishes the Web Content Accessibility Guidelines, but a vendor statement about a base product cannot prove that custom themes, embedded tools and content preserve access. Test with appropriate expertise and participants.

Prove data flows and exit

Use invented records to test each integration. Confirm source, direction, frequency, matching, access, errors, deletion and recovery. Marketing logos or a connector name do not demonstrate the buyer's intended workflow.

Run an export before signature and again after final configuration. Open it independently. Check posts, replies, attachments, identity links, groups, permissions, timestamps and moderation history. Estimate the work required to rebuild the useful structure.

Specify termination notices, transition help, operating continuity, member communication and deletion evidence. A buyer should know which functions stop immediately and which records remain available during the move.

Implement in controlled stages

Freeze the first-release scope and name accountable roles. Configure with test identities, not genuine member accounts. Rehearse ordinary tasks, serious reports, administrator absence, privacy requests and outages.

Migrate selectively. Archive or delete material according to an approved decision rather than copying every obsolete field and permission. Have community operators review the result because technical totals may conceal broken context.

Open to a bounded cohort with staffed support. Monitor access failures, unresolved needs, reports, corrections, operator effort and integration errors. Sign-up volume is not an acceptance test.

Transfer documentation, supplier contacts, credentials, renewals and decision records into ordinary ownership. A project team should not leave before the service team can operate and recover the system.

Record the purchasing decision

Keep requirement, evidence, test result, risk, reviewer and contractual commitment together. Distinguish a public product claim from an observed trial result and from an obligation the supplier has accepted.

The final decision should explain why the chosen combination meets the member outcome, which internal capability it requires, what remains unresolved and how the organisation can exit. If the evidence supports no current option, narrowing the service or pausing procurement is a valid result.

Tools and providers change. Recheck features, terms, prices, corporate status and regulator guidance before commitment. The durable part of the process is the decision trail from member need through demonstrable requirement to accountable operation.

Before you act

Common questions

What four layers should an organisation separate before comparing proposals?

The member service covers outcome, audience, activity and promise. The operating service covers facilitation, moderation, answers, analysis and escalation. The application covers profiles, permissions, discussions, search, events and administration. Infrastructure and integrations cover hosting, identity, data flows, monitoring and recovery. An organisation may buy one layer and supply the others internally.

Why does a zero licence cost not mean a free community platform?

Self-managed open-source software shifts upgrades, monitoring, backups and recovery to the operator. Engineering, hosting, anti-spam controls, security response and support still carry cost. The article advises comparing total work and deciding who maintains the system after the implementation specialist leaves.

How should a buyer test a moderation or managed service provider?

Write a service workload with ranges covering member numbers, conversations, reports, events, languages, hours and referrals. Use scenarios such as aggressive disagreement, suspected scam, inaccurate professional advice, hidden commercial relationship or privacy request. Meet the people likely to deliver the work and clarify whether named personnel are committed.