Skip to main content

Martech vendor due-diligence checklist

The questions a review committee will ask about a martech tool, grouped the way the review usually runs. Work through it before a vendor reaches the committee, and you will know which answers you already have and which you still need to request.

  • Usually publicthe vendor’s own website normally answers it — and a MarTech Sentinel profile collects those answers with links to the source page.
  • Ask the vendora public website almost never answers it; put it in your questionnaire or ask for it under NDA.

Security

  1. Does the vendor’s own website use well-configured HTTPS and security headers, and is its email domain protected by an enforced DMARC policy? Glossary: DMARCUsually public
  2. Can multi-factor authentication be enforced for every user in our account? Glossary: MFA (multi-factor authentication)Usually public
  3. Is single sign-on supported, over which protocol, and is SCIM provisioning available — on which plan? Glossary: SSO and SCIMUsually public
  4. Is customer data encrypted in transit and at rest? Glossary: Encryption in transit and at restUsually public
  5. Can we see the latest penetration-test summary or attestation letter, and when was the test done? Glossary: Penetration testAsk the vendor
  6. How is staff access to our data granted, logged and reviewed?Ask the vendor
  7. How quickly will you tell us about a security incident that affects our data, and is that written into the DPA? Glossary: Incident responseAsk the vendor

Compliance & legal

  1. Does the vendor state a SOC 2 Type II report or an ISO 27001 certificate? Glossary: SOC 2 (Type I and Type II)Usually public
  2. Can we receive the SOC 2 report or the ISO 27001 certificate with its scope statement, and does the scope include the product we are buying? Glossary: ISO/IEC 27001Ask the vendor
  3. Is a DPA published, or available to sign? Glossary: DPA (Data Processing Agreement)Usually public
  4. Is the sub-processor list public, and how are customers told before it changes? Glossary: Sub-processorUsually public
  5. Where is our data stored, where is it processed, and from where can it be accessed? Glossary: Data residencyUsually public
  6. For any transfer outside the EU, which mechanism applies — SCCs, the EU–US Data Privacy Framework, or another? Glossary: SCCs (Standard Contractual Clauses)Usually public

AI governance

  1. Which features of the product use AI, and which model providers are behind them?Usually public
  2. Is our data used to train or improve AI models — yours or a provider’s — and is that off by default or only through an opt-out? Glossary: Customer data used for trainingUsually public
  3. Are AI-generated outputs labelled, and can a person review them before they take effect? Glossary: AI output labellingUsually public
  4. Does the vendor state its role and risk class under the EU AI Act? Glossary: EU AI Act risk class and roleUsually public
  5. What data were the models trained on, and how are model changes tested and announced? Glossary: Model documentationAsk the vendor

Risk & viability

  1. Is there an uptime SLA with service credits, and a public status page with incident history? Glossary: Uptime SLA and status pageUsually public
  2. Is there a business-continuity and disaster-recovery plan, and when was it last tested?Ask the vendor
  3. Who owns the company, and what happens to our data if it is acquired or closes down?Ask the vendor

Technical fit

  1. Which APIs and integrations are documented publicly?Usually public
  2. Which hosting model is offered — shared multi-tenant SaaS, a dedicated instance, or self-hosting?Usually public
  3. How do we export all of our data at the end of the contract, and in what format?Ask the vendor

A checklist is a starting point, not legal advice: your own committee’s requirements come first. Why so many questions end in “ask the vendor” is explained on our methodology page.