---
title: "Martech vendor due-diligence checklist — MarTech Sentinel"
description: "Questions to put to a martech vendor before procurement review — security, GDPR and DPA, AI training, viability, fit — and which ones its website answers."
canonical: "https://martechsentinel.com/vendor-due-diligence-checklist"
last_checked: "2026-10-22"
---

# Martech vendor due-diligence checklist

> Canonical page: https://martechsentinel.com/vendor-due-diligence-checklist

The questions a review committee will ask about a martech tool, grouped the way the review usually runs. Work through it before a vendor reaches the committee, and you will know which answers you already have and which you still need to request.

- **Usually public:** the vendor’s own website normally answers it — and a MarTech Sentinel profile collects those answers with links to the source page.
- **Ask the vendor:** a public website almost never answers it; put it in your questionnaire or ask for it under NDA.

## Security

- [ ] Does the vendor’s own website use well-configured HTTPS and security headers, and is its email domain protected by an enforced DMARC policy? *(Usually public)*
- [ ] Can multi-factor authentication be enforced for every user in our account? *(Usually public)*
- [ ] Is single sign-on supported, over which protocol, and is SCIM provisioning available — on which plan? *(Usually public)*
- [ ] Is customer data encrypted in transit and at rest? *(Usually public)*
- [ ] Can we see the latest penetration-test summary or attestation letter, and when was the test done? *(Ask the vendor)*
- [ ] How is staff access to our data granted, logged and reviewed? *(Ask the vendor)*
- [ ] How quickly will you tell us about a security incident that affects our data, and is that written into the DPA? *(Ask the vendor)*

## Compliance & legal

- [ ] Does the vendor state a SOC 2 Type II report or an ISO 27001 certificate? *(Usually public)*
- [ ] Can we receive the SOC 2 report or the ISO 27001 certificate with its scope statement, and does the scope include the product we are buying? *(Ask the vendor)*
- [ ] Is a DPA published, or available to sign? *(Usually public)*
- [ ] Is the sub-processor list public, and how are customers told before it changes? *(Usually public)*
- [ ] Where is our data stored, where is it processed, and from where can it be accessed? *(Usually public)*
- [ ] For any transfer outside the EU, which mechanism applies — SCCs, the EU–US Data Privacy Framework, or another? *(Usually public)*

## AI governance

- [ ] Which features of the product use AI, and which model providers are behind them? *(Usually public)*
- [ ] Is our data used to train or improve AI models — yours or a provider’s — and is that off by default or only through an opt-out? *(Usually public)*
- [ ] Are AI-generated outputs labelled, and can a person review them before they take effect? *(Usually public)*
- [ ] Does the vendor state its role and risk class under the EU AI Act? *(Usually public)*
- [ ] What data were the models trained on, and how are model changes tested and announced? *(Ask the vendor)*

## Risk & viability

- [ ] Is there an uptime SLA with service credits, and a public status page with incident history? *(Usually public)*
- [ ] Is there a business-continuity and disaster-recovery plan, and when was it last tested? *(Ask the vendor)*
- [ ] Who owns the company, and what happens to our data if it is acquired or closes down? *(Ask the vendor)*

## Technical fit

- [ ] Which APIs and integrations are documented publicly? *(Usually public)*
- [ ] Which hosting model is offered — shared multi-tenant SaaS, a dedicated instance, or self-hosting? *(Usually public)*
- [ ] How do we export all of our data at the end of the contract, and in what format? *(Ask the vendor)*

A checklist is a starting point, not legal advice: your own committee’s requirements come first. Why so many questions end in “ask the vendor” is explained on our [methodology page](https://martechsentinel.com/methodology).

Definitions of the terms: [Glossary](https://martechsentinel.com/glossary).