Vendor due diligence for branding agencies: a supplier's paperwork

A vendor's assurance documents count as evidence only when they cover the product, edition and workflow the agency has actually ordered. A SOC 2 Type II report, an ISO/IEC 27001 certificate, a VPAT, a data processing agreement and a subprocessor list each answer one narrow question, and none of them answers all five.

Here the vendor is a supplier the agency buys from: digital asset management, a brand asset portal, a generative image tool, project management or font licensing. Bynder, Brandfolder or Frontify for asset management and brand portals, and Monotype for font licensing, show the kind of vendor meant.

This is a desk method for reading their papers, not an audit, legal opinion, review or endorsement of any vendor. A supplier's reputation, customer logo or security badge cannot stand in for a document. Where a paper is missing, the honest entry is unknown, and approval waits.

What to take away

Read every assurance document for its scope, date, assessor and exclusions before it is filed.
A report or certificate is evidence only for the product and edition inside its scope.
A hosting-region statement is a starting point. Remote access and onward processing need their own answer.
A VPAT, an ACR or WCAG 2.2 does not prove that the agency's configured product or exported design is accessible.
Hold approval for missing mandatory proof, and reject the supplier if a non-compensating gate cannot be met.

Which document answers which question

Each document in a vendor's pack has a job and a limit. Reading one beyond its limit is the usual way a pack ends up looking complete while a gap stays open. Match the paper to the question before accepting it.

Document	The question it answers	Its limit
SOC 2 Type II report	What an independent assessor examined about the vendor's controls	Covers only the scope and period it names
ISO/IEC 27001 certificate	Whether the vendor's stated scope was certified	The ordered product may sit outside that scope
VPAT or ACR, with known issues	What the vendor says about accessibility conformance	It is the vendor's statement, not a test of the agency's set-up
DPA and subprocessor list	Who processes what, and under which terms	Roles still depend on what each party actually does
Export format list and deletion plan	How work and records leave the service	Unproven until an exit test has been run

Anything the vendor cannot supply is logged as unknown. Which tools to shortlist in the first place is a separate decision, set out in the tools and supplier guide, and this method starts once a named product is on the table.

A completed pack, as a worked example

The table shows the format of a finished evidence pack for a digital asset management platform. The entries are illustrative, so replace each with the vendor's own documents and version numbers.

Field / Entry

Product: Digital asset management platform, team edition, 25 seats
Contracting entity: UK limited company, England
Data categories: Client brand files, contact details, usage logs
Hosting and access: UK South; support from Ireland and India
Subprocessors: Cloud host, email provider, analytics provider
Security evidence: SOC 2 Type II report; ISO/IEC 27001 certificate
Accessibility evidence: VPAT/ACR; known issues list
Contract and exit: DPA and subprocessor list; export and deletion plan

Reading the security evidence

Ask for a current SOC 2 Type II report or ISO/IEC 27001 certificate, or a demonstration, at the confidence level the workload needs. Then record scope, date, assessor, exclusions and remediation. A badge on a trust page that gives none of these is incomplete evidence.

The NCSC's cloud security principles are designed to help you choose a cloud provider that meets your security needs. They apply to Software-as-a-Service, and configuring the service securely is a separate task. They do not certify any supplier, so the vendor's answers still need checking.

Ask who reports an incident, what evidence the agency receives, how access is revoked and how restoration is tested. Ask the vendor to name dependencies that sit outside its own control. Record change-notice periods for security functions, hosting, APIs and supported file formats.

A reply that points only to a generic trust page stays incomplete until the evidence is tied to the service that was ordered, not to the vendor's range. The same questions feed the security gate in the selection checklist, where a failed recovery test stops appointment.

Reading the data papers

Start with the data processing agreement and the current subprocessor list, then decide controller and processor roles for each operation. A contract label cannot assign roles without the facts. The UK GDPR and the Data Protection Act 2018 set the legal duties.

Article 28 sets what a written contract between a controller and a processor must cover, so the agreement is read against that article, line by line.

The ICO's guidance on contracts between controllers and processors explains what needs to be included in the contract and why. It is regulatory guidance, not mandatory law by itself, so the agency still checks the wording against the legislation and the real processing.

List each data category, person and purpose, with the collection point, location, recipient, retention period, export and deletion route. A hosting-region statement is not the whole analysis. Check remote access and onward processing, and ask the vendor to name each restricted transfer and the safeguard it relies on.

Reading accessibility and rights claims

A VPAT or accessibility conformance report (ACR) with a known-issue list is the vendor's own statement. Test the agency's critical tasks with affected users before relying on it. WCAG 2.2 is a global technical standard, not proof that a configured product or an exported design is accessible.

Public-sector buyers should also ask for conformance evidence against EN 301 549, the standard that supports the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. Those regulations apply to public-sector bodies, not to all private branding work, so a private agency should record why it asks.

For rights, identify ownership and licences for uploaded assets, fonts, stock, templates, outputs and generated material. The IPO's intellectual property overview gives the general UK categories. Qualified counsel must examine the actual terms and the client contract before anyone treats a licence as settled.

Proving that the work can leave

An exit plan that has never been run is a promise, not evidence. A vendor can describe export and deletion fluently without ever having done either for a customer. Run the test before the contract is signed, in this order.

Export originals and metadata against a written export format list.
Transfer administrator control to the agency or its client.
Remove the integrations.
Preserve the records the agency is required to keep.
Obtain a deletion certificate, or written confirmation that deletion has happened.

Name an owner and a deadline for every exit artefact in the contract, so nobody is left guessing who must hand over what. Until step five is evidenced, the deletion entry in the pack stays unknown, however confident the vendor's sales material sounds.

Closing the commercial record

Capture currency, VAT treatment, billing unit, minimum commitment, renewal, usage charges, support, change rights, liability, suspension, termination and dispute routes. Do not fill gaps with an assumed market price. The matching contract clauses are settled once the evidence is in.

Define service measures only from the negotiated contract. Each needs a numerator, denominator, clock start, clock stop, exclusions, reporting source, remedy and review date. Do not copy a target from another customer, or treat a service credit as proof that operational harm has been repaired.

Hold approval for any missing mandatory proof and give each exception a named owner and a deadline. Reject the supplier if a non-compensating gate cannot be met. Save the pack with its expiry dates, and reopen it after a material acquisition, subprocessor change, incident, contract amendment or failed acceptance test.

Before you act

Name the evidence pack owner, approval date and expiry date.
Log scope, date, assessor and exclusions for each report or certificate.
Record each unresolved gap with a named owner and deadline.
Run the exit test and file the export format list and deletion confirmation.
Set review triggers for acquisition, subprocessor change, incident or contract amendment.

Common questions

Does an ISO/IEC 27001 certificate prove the vendor's product is secure?

No. A certificate is evidence for the scope it names and nothing wider. Check that the product and edition you bought sit inside that scope, and record the date and the assessor. Anything outside it remains unknown until the vendor supplies separate proof.

What should happen when a vendor sends only a trust page?

Treat the answer as incomplete. A generic page does not show how the ordered service handles the agency's files, people and client obligations. Ask for the report, certificate or demonstration, tied to the product and edition, and hold approval until it arrives.

Is a hosting-region statement enough for the data review?

No. It says where data is stored, not who can reach it from elsewhere, such as a support team in another country. Ask about remote access and onward processing, and have the vendor name each restricted transfer and the safeguard behind it.

When should the due-diligence pack be reopened?

Reopen it after a material acquisition, a subprocessor change, an incident, a contract amendment or a failed acceptance test. The pack carries expiry dates, so stale evidence is noticed rather than assumed to still hold.