Commerce reviews vendor due diligence explained

What to take away

Commerce reviews vendor due diligence means checking a review software supplier's legal, security, technical and commercial claims before you sign a contract.

Start with the data protection file

A review tool processes names, email addresses, order references and sometimes images. That makes the supplier a processor under UK GDPR. Article 28(3) requires a written contract setting out the processing arrangements, and the Data Protection Act 2018 also applies. The ICO (Information Commissioner's Office) is the UK's supervisory authority. Ask for the data processing agreement before the commercial proposal and check that it covers the Article 28 requirements, including documented instructions, confidentiality, security, sub-processors, assistance with data-subject rights and the return or deletion of data.

Check the sub-processor list for hosting, email delivery and moderation services. Identify any recipient country and whether access or processing involves a restricted transfer. Ask which safeguard applies: a UK adequacy regulation under UK GDPR Article 45 (for example, the Data Protection (Adequacy) (United States of America) Regulations 2023, where the recipient qualifies), the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses. If relying on the IDTA or UK Addendum, request the Transfer Risk Assessment (TRA). A supplier that cannot name the recipient and safeguard in writing is a risk you cannot price.

Ask how long review content stays live after a shopper requests deletion. Confirm whether the supplier can remove your reviews from its own marketing material too. A retention schedule should state a period in months and the trigger that starts it.

Security and moderation controls

Ask for current certification evidence rather than a logo. Microsoft publishes a worked example of how an ISO 27001 statement is scoped and evidenced, which shows the detail a serious supplier should match: ISO/IEC 27001 information security management standards.

Other assurance routes include a SOC 2 report or Cyber Essentials certification. Ask for the evidence and confirm its scope and which services it covers.

Moderation is where most review disputes start. Check the supplier's controls against the CMA's guidance on fake reviews and the fake-review provisions in the Digital Markets, Competition and Consumers Act 2024. Ask who reviews flagged content, what response and appeal service levels the supplier will contractually meet, and what happens when a shopper appeals. Set an appeal window and escalation route in writing. If the supplier uses automated filtering, ask for its false positive rate and how you appeal a wrong decision.

Request the date and scope of the last penetration test, whether it was performed by a CREST-accredited provider, and whether remediation actions were closed. Then confirm who inside the supplier can open your review data, and whether that access is logged.

Integration and data portability

Ask for a sandbox and test three things: importing historical reviews, posting a new review, and exporting everything. Review syndication to search and social channels matters too. If your team runs paid placements around review content, confirm the supplier supports tracking through LinkedIn Campaign Manager before you commit budget.

Portability is the quiet test. Request a sample export file and check which fields it contains. Reviewer name, rating, body text, product ID and moderation status are the minimum needed to keep reporting intact after a move. If the supplier cannot produce one, assume your history stays with them.

Platform dependencies to check

Many review tools sit on top of third party APIs for store locators, maps or place data. Confirm which endpoints the supplier calls and what happens when those change. The Places API reference shows the dependency documentation a supplier should be able to talk through, including how reviews are retrieved.

Ask what happens if a dependency is deprecated, because a supplier without a migration plan passes that disruption to you.

Commercial terms and exit

Ask for the pricing model in writing, with the unit that triggers a charge. As an illustration, not a market benchmark, a team paying £400 a month for 2,000 monthly orders needs to know whether overage applies to orders, reviews or moderation actions. Compare quotes against the supplier comparison for England so you are testing like for like rather than headline rates.

Check auto-renewal, notice periods and price escalation clauses. Ask for the notice period in days and the fee for early termination. Then agree the exit: export format, timeline, deletion evidence and any post-termination support fee.

Decision table

Common questions

How long should due diligence take?

Two to four weeks is realistic for a mid-market retailer if you request documents in parallel. Security and legal review take longest, so start those before the demo stage.

What is the single most important document?

The data processing agreement, because it sets out lawful processing, retention and deletion. Without it, your review programme carries avoidable legal risk.

Can we skip a trial?

No. A sandbox or paid pilot lets you test import, moderation and export. Paper claims about integration rarely survive contact with your own order data.

What if the supplier refuses an export clause?

Treat that as a signal. A supplier confident in its product will agree to return your review history in a usable format.