Tools and providers
Part of Decide what is being bought before any community tool demonstration
Due diligence on a community vendor, from financial standing to automated features
Check a community vendor's identity, product scope, data role, security evidence, service capacity, commercial terms, continuity and exit plan.
Due diligence should test whether a vendor can provide the exact software or service promised under conditions the buyer can govern. It is not completed by collecting a security certificate and a customer logo. Use the checklist before commitment, then retain dated evidence and decision owners.
What to take away
- Due diligence tests whether a vendor can deliver the promised software under conditions the buyer can govern.
- A security certificate and a customer logo do not complete due diligence on a community vendor.
- Marketing terms such as enterprise or AI need a practical definition before you rely on them.
- Automated features carry different risks depending on whether they draft responses or remove content.
- Conditional approval only works when somebody tracks the condition to closure.
Identity and financial standing
- Confirm the contracting name, company number, registered status and group ownership.
- Match the entity in the proposal, data terms and invoices.
- Review relevant filings and material corporate changes.
- Identify subcontractors that deliver important work.
- Record any reliance on one founder, moderator or technical specialist.
Companies House explains the public information available through its register search. A filing supports identity and history checks; it does not prove solvency, skill or future continuity.
Vendor identity checks
- Confirm contracting name and company number
- Verify registered status and group ownership
- Match entity across proposal, data terms, invoices
- Review filings and material corporate changes
- Identify subcontractors delivering important work
- Record reliance on one founder or specialist
Product and service boundary
- Attach the exact edition, modules and environments.
- Separate standard configuration from implementation work.
- Define moderation hours, languages and escalation authority.
- List buyer staff and systems required for delivery.
- Verify important claims through a demonstration or documentary record.
Marketing language such as enterprise, managed or artificial intelligence needs a practical definition. Ask what the feature does, which data it uses, who reviews it and what happens when it is wrong.
Product and service boundary
- Attach exact edition, modules and environments
- Separate standard configuration from implementation work
- Define moderation hours, languages, escalation authority
- List buyer staff and systems required
- Verify important claims by demonstration or record
Data protection and information control
- Map controller, joint-controller and processor roles by activity.
- Obtain the sub-processor list and transfer information.
- Check access, retention, assistance, deletion and audit terms.
- Test member and content exports with representative data.
- Establish how the vendor handles rights requests and breaches.
The Information Commissioner's Office publishes guidance on controllers and processors. Apply it to actual decisions; do not accept a role label without checking the processing.
Data protection checks
- Map controller, joint-controller and processor roles
- Obtain sub-processor list and transfer information
- Check access, retention, deletion and audit terms
- Test member and content exports with real data
- Establish rights request and breach handling
Security and resilience
- Review authentication, privilege, logging and staff access.
- Examine vulnerability, patch and incident processes.
- Obtain recovery objectives and evidence of relevant tests.
- Identify support and notification contacts.
- Assess dependencies and the consequence of supplier failure.
The National Cyber Security Centre's supply chain security collection provides guidance for understanding and managing supplier risk. Select questions according to the community's data, exposure and importance rather than demanding documents nobody will assess.
Delivery capacity and quality
- Meet the people likely to implement or operate the service.
- Check onboarding, training, absence cover and quality review.
- Use realistic moderation and support cases in evaluation.
- Speak to references with a comparable operating model.
- Distinguish provider-selected testimonials from independent evidence.
No reference can guarantee the buyer's result. Ask about workload, failures, changes and exit, not simply overall satisfaction.
Accessibility and automated features
- Obtain the vendor's current accessibility evidence for relevant journeys.
- Identify customisation that could weaken the base product's behaviour.
- Include disabled participants and suitable specialists in practical testing.
- List every automated classification, recommendation or moderation feature proposed.
- Ask what data trains or drives it, how errors are reviewed and whether it can be disabled.
Do not accept "AI-powered" as a capability description. Request the specific task, inputs, outputs, human decision and known limitations. A tool that drafts a response and a system that removes member content create different risks.
Ask how the supplier handles model or feature changes during the contract. The buyer should know whether behaviour can change without configuration approval and how previous decisions remain explainable.
Commercial terms and departure
- Normalise price period, currency, tax and usage assumptions.
- Identify renewal, indexation and additional-work mechanisms.
- Review liability, insurance and remedy with qualified advisers.
- Specify transition assistance, formats, timing and deletion evidence.
- Assign an owner to notice dates and continuing oversight.
End with a risk register showing evidence received, gaps, mitigations, accountable decisions and review dates. Reject or pause the purchase where a mandatory control is absent. Conditional approval only works when somebody tracks the condition to closure.
Before you act
- Confirm the contracting name, company number and group ownership.
- Attach the exact edition, modules and environments to the agreement.
- Map controller, joint-controller and processor roles by activity.
- Test member and content exports with representative data.
- Meet the people likely to implement or operate the service.
- Assign an owner to notice dates and continuing oversight.
Common questions
What does a Companies House filing prove about a vendor?
A filing supports identity and history checks, but it does not prove solvency, skill or future continuity. The article says to review relevant filings and material corporate changes, then retain dated evidence and decision owners rather than treating a register search as a complete assessment.
How should a buyer treat an AI-powered feature claim?
Treat it as marketing language needing a practical definition. Ask what the task is, which data it uses, who reviews errors and whether it can be disabled.
What should happen when a mandatory control is missing?
Reject or pause the purchase. Conditional approval only works if someone tracks the condition to closure.
