Reviews
Part of Reviewing reputation services by comparing only the overlapping job
Review management software: documents to request before you buy
Documents to request before buying review-management software or hiring an agency to run it: Google Business Profile permissions, approvals, data terms, service levels, reporting and exit records.
What to take away
- This checklist reports no verified performance data for any named product or agency; it judges documents you can request, not live service.
- Judge review-management software or an agency on six documented controls: reply approval, invitation wording, reporting units, data terms, service levels and exit terms.
- Google's Business Profile rules require explicit approval before a third party responds for a customer, and verbal consent is not sufficient.
- The CMA and the Digital Markets, Competition and Consumers Act 2024 address fake reviews and inducements, not product quality.
- Ask for a worked approval record and a sample reporting specification before you sign.
What this checklist covers
This is a documentary checklist, not a review of a named product or agency. Google Business Profile is the platform the checks are anchored to. Whether you buy a review-management tool or hire an agency to run one, the same documents should exist. The list sets out what a buyer can verify before buying and what no document can prove.
Record commercial interests and corrections next to the decision; the versioned disclosure and correction record explains how to keep that context visible.
No service was purchased and no account exercise occurred, so performance claims stay untested.
A pre-hire checklist for software and agency controls
- For Google Business Profile, request a permission diagram showing the client account and every operator or tool with access.
- Ask who authorises a reply and where that approval is recorded.
- Get the proposed invitation wording and the disputed-review procedure in writing.
- Require a sample reporting specification showing what each metric counts.
- Ask for a data processing agreement under UK GDPR Article 28 and the Data Protection Act 2018, covering instructions, security and return or deletion at exit.
- Get a service level agreement with response-time commitments for drafting, approving and publishing replies.
- Ask for the security and access-control policy, a list of subcontractors, and the complaints and escalation procedure.
- Check audit rights, insurance and indemnity, and the full fee schedule, including any charge per reply or per location.
- Obtain termination terms covering access withdrawal and client-owned records.
- Identify which materials stay subject to platform terms after exit.
Approval authority under Google's policy
Google's Business Profile rules require explicit approval before a third party responds for a customer, and verbal consent is not sufficient. If a dispute arises, the third party must be able to produce written or digital proof of that consent. A contract should name the approver and the time between approval and publication.
Account reply approval flow
- Client owns Google Business Profile
- Agency granted operator access
- Who authorises replies?
- Where is approval recorded?
- Drafting, approving, publishing split
- Client approver: what if pending?
Distinguish drafting, approving and publishing. If the client stays the approver, the contract should say what happens while approval is outstanding. A promised response service is too vague to assess when those roles are unnamed.
Invitation wording and the fake-review rules
Google's review-incentive policy treats offering rewards in exchange for reviews, for changed reviews, or for removed negative reviews as fake engagement, which it prohibits. The CMA's guidance for businesses and agencies covers writing or commissioning fake reviews and offering inducements for positive ones. The Digital Markets, Competition and Consumers Act 2024 gives the CMA new powers over fake reviews.
Request the invitation wording and the disputed-review procedure. Ask how the vendor separates a content-policy concern from disagreement with criticism. A platform's moderation decision is not the vendor's to promise.
Where a reviewer's personal data is processed, the vendor needs a lawful basis and an erasure route. Our note on routing a disputed review through data protection sets out how to keep deletion evidence.
Example: an approval record and reporting specification
The field list below is a template to request, not evidence from a real service or client file. Its illustrative entries show what a reporting specification might record; they do not prove that any vendor's software or controls operate this way.
Approval record and reporting specification
| Field | Illustrative entry | What it fixes |
|---|---|---|
| Review reference | platform review ID | ties one reply to one record |
| Approver | named client director | authority stays with the client |
| Approval time | 09:14, 3 March 2026 | shows the clock to publication |
| Reply state | approved, not published | separates drafting from publishing |
| Report count | one published reply | blocks inflated totals |
A reporting specification should define the unit counted. A drafted reply, a published reply and a platform decision are three different outcomes. If the contract counts them together, the report cannot show what the service delivered.
UK oversight relevant to review-handling controls
Use the CMA and ICO for distinct checks: the CMA investigates fake and misleading reviews, while the ICO governs personal data in review handling. Companies House holds registration and identity verification records for a limited company agency; those records do not establish the quality of its review-handling software or service.
The ASA applies the CAP Code to testimonials and review claims in ads. Since April 2025 the consumer rules in the Digital Markets, Competition and Consumers Act 2024 have replaced the Consumer Protection from Unfair Trading Regulations 2008 for misleading commercial practices. Treat these as constraints on vendor wording, not proof of software performance.
A defamation issue is distinct from a platform-policy complaint: the Defamation Act 2013 uses the serious harm test. Do not treat a vendor's moderation log as a ruling on legal liability.
Exit terms deserve the same scrutiny as scope. Written termination should cover access withdrawal, delivery of client-owned working records and the boundary with platform terms. Our checklist on reputation management commercial contracts covers the clauses to test first.
Common questions
Can this checklist rate a specific product or agency?
No. It names no provider and buys no service. A performance verdict needs an identified provider, verified conflicts and a defined exercise with retained evidence.
What should I ask before signing a review-handling contract?
Ask for the permission diagram, the approver's name, the invitation wording, the reporting units, the data terms and the exit terms. Treat each answer as a document.
Does CMA guidance prove a vendor is competent?
No. It sets out prohibited conduct such as fake reviews and inducements. Response times and escalation quality sit outside it.
How do I get account access back on exit?
Require written termination terms covering access withdrawal and delivery of client-owned records. Identify which materials stay subject to platform terms before any trial starts.
