Tools and providers
Part of Selecting multilingual social tools by task, evidence and the cost of leaving
Due diligence on a multilingual marketing vendor, from identity to exit evidence
Investigate a multilingual marketing vendor through identity, product, language, data, security, accessibility, contract, exit evidence and review dates.
Multilingual social marketing vendor due diligence should follow the data, language asset and publishing authority through the complete supply chain. A polished demonstration or certificate is one record, not a substitute for testing the contracted service.
What to take away
- Due diligence must follow data, language assets and publishing authority through the entire supply chain.
- Essential missing evidence produces a HOLD, even if a weighted commercial score is high.
- Reopen the review after any change to edition, subprocessor, data location or integration.
Define the object under review
Name the legal counterparty, exact product, edition, deployment, implementation partner, support route and proposed subcontractors. State the England business task, source asset, target language and variety, format, channel, user roles, content sensitivity and contract period. Do not treat a person's name, postcode, profile or ethnicity as language, literacy or buying intent.
Vendor due diligence checks
- Verify contracting entity and signatory authority
- Obtain dated first-party product documentation
- Request language competence and correction route
- Inspect product interface separately from output
- Map data flows, roles, locations, retention
- Open sample export before commitment
Use the following as separate pass-or-hold checks:
- Identity and authority:verify the contracting entity, registered details where applicable, signatory authority, invoicing party and every party able to appoint subprocessors or publish to the buyer's account.
- Product evidence:obtain dated first-party documentation for the precise edition, hosting, integrations, file types, role model, change policy, support and end-of-life route. Record claims as supplier claims until reproduced. A dated first-party record might be a current SOC 2 report, an ISO 27001 certificate with scope, or a penetration test summary.
- Language delivery:identify who translates, who performs native-level review for the relevant variety, who checks the subject and who approves tone. Request competence evidence and a correction route. Bilingual identity alone does not establish professional ability.
- Accessibility:inspect the product interface separately from output assets, social rendering and linked journeys. Automated results, a VPAT or a conformance statement do not prove the configured route works for disabled users.
- Data and PECR:map account, source-file, translator, participant, audience, tracking, support and telemetry data. Confirm roles, purposes, instructions, locations, transfers, retention, deletion and rights support. Direct marketing and storage or access technologies require their own qualified analysis.
- Security and resilience:require current evidence for authentication, least privilege, logs, vulnerability handling, incident notification, backups, restoration, staff access and supplier dependencies. Test credential removal and recovery with synthetic content.
- Rights and people:determine ownership and permitted use of source text, target copy, terminology, memories, images, fonts and machine-assisted output. Separately review safeguarding, confidentiality, employment or contractor status and workplace access.
- Commercial exit:record currency, VAT basis, units, overages, support clocks, renewals, conflicts, rebates, suspension, termination, export formats, deletion cycles and continuity assistance. Open a sample export before commitment.
The NCSC's supply-chain principles advise organisations to identify protected assets, suppliers, subcontractors and access. Its guidance supports the investigation method, not a finding that any supplier is secure.
Where the vendor acts as processor, the ICO's contract checklist covers documented instructions, confidentiality, security, subprocessors, rights assistance, return or deletion and audit.
The ICO flags that page as under review after the Data (Use and Access) Act 2025. Re-check it on the date the page gives for its next review, and have a named privacy lawyer or practitioner confirm the current position for the actual arrangement.
GOV.UK's copyright overview explains the general UK permission boundary. It does not decide ownership of a commissioned translation, training data or connected asset; obtain specialist IP review.
Record a defensible conclusion
Per item, save document, version, date, reviewer, finding. Also save gap and expiry. Essential missing evidence produces HOLD despite a high weighted commercial score.
For example, a vendor may score highly on price, support hours and references but have no current penetration test summary or subprocessor list. The missing security evidence triggers HOLD.
Hold or proceed decision
Is essential evidence missing?
HOLD despite high commercial score
Record finding and proceed
Reopen review after an edition, subprocessor, data location, integration or language change. Reopen after an accessibility finding, incident, platform rule, contract or ownership change. Due diligence supports a point-in-time decision and never guarantees compliance, quality, continuity or results.
Before you act
- Name the legal counterparty, product, edition, deployment and subcontractors.
- Obtain dated first-party documentation for the precise edition and integrations.
- Request competence evidence and a correction route for language delivery.
- Inspect the product interface separately from output assets and linked journeys.
- Map all data flows and confirm roles, purposes, locations and retention.
- Open a sample export before commitment to verify commercial exit.
Common questions
What should be verified about the contracting entity and its authority?
Check the contracting entity, its registered details and signatory authority. Also check the invoicing party and anyone able to appoint subprocessors or publish to your account. Treat each as pass or hold.
How does bilingual identity relate to professional language ability?
Bilingual identity does not prove professional ability. Ask who translates, who reviews for the target variety, who checks the subject and who approves tone. Request competence evidence and a correction route.
What evidence is needed for security and resilience?
Ask for current records on authentication, least privilege, logs and vulnerability handling. Also ask about incident notification, backups, restoration, staff access and supplier dependencies. Test credential removal and recovery with synthetic content.
