Tools and providers
Part of Choosing a reputation supplier after opening the manual evidence first
An evidence room for a reputation supplier, arranged in five folders
Build a challengeable evidence room for an England reputation supplier, covering identity, review integrity, data, security, access and exit.
Build an evidence room, not a questionnaire that suppliers can pass with adjectives. Fictional Harbour Lane Furniture Repairs Ltd wants help with one England review-response case. No vendor is under review here. Each folder below ends in pass, fail or unresolved, with an owner and expiry date.
The desk method was prepared on 6 September 2026. It offers no legal advice or supplier approval.
What to take away
- Build an evidence room with five folders, each ending in pass, fail or unresolved with an owner and expiry date.
- A Companies House match is an identity record only and says nothing about capability, security or suitability.
- Require configured evidence for review collection, checking, moderation and presentation rather than claims of alignment.
- Due diligence stays unresolved until the buyer can leave without losing the original item, approvals, corrections or complaint trail.
Folder A: who is selling what?
- Capture the contracting legal entity, company number where applicable, trading name, address and authorised signatory.
- Attach the exact service, edition, modules, UK availability record, order form and terms version.
- Separate the vendor, reseller, hosting provider and subprocessor.
Companies House explains which items appear in its company data products. Its disclaimer says register information has not been verified or validated. Mark a match as an identity record only. It says nothing about capability, ownership of a product, security or suitability.
Folder B: what happens to a review?
Ask the supplier to trace one item from source discovery through status checks, drafting, approval, publication, complaint, correction and archive. Record edits, removals, duplicate detection and uncertainty. Establish whether the service invites reviews, offers incentives, moderates content or publishes ratings.
The CMA's guidance for online review sites addresses collection, checking, negative reviews, presentation and commercial interests. Require the supplier to show actual configured evidence rather than assert alignment. Reject proposals involving impersonation, concealed reward, selective positive collection or guaranteed removal.
Folder C: whose information is involved?
- List each field, source, purpose, recipient, location, retention rule and deletion route.
- Decide controller and processor roles from real decisions, not headings in the contract.
- Trace correction, objection, restriction, suppression and access requests into every export.
- Record employee information separately from customer or reviewer material.
The ICO's controller-processor contract guidance covers instructions, confidentiality, security, subprocessors, rights assistance, audits and end-of-contract provisions. It is under review after the Data (Use and Access) Act. A named privacy and legal reviewer must check the current page and the real arrangement.
Folder D: can the service be controlled and recovered?
Demand evidence for authentication, privileged roles, joiners and leavers, logs, support access, vulnerability handling, incident notice, backups, restoration and continuity. The NCSC's supplier assurance questions suggest examining governance, incidents, networks, data, offshoring, personnel, independent assurance and exit. Record the scope and date of every test or certificate instead of copying its badge.
Test whether another authorised operator can complete capture, approval, correction and export using relevant assistive technology. A supplier accessibility statement is evidence about its stated position, not proof that Harbour Lane's configured critical path works.
Folder E: content, money and departure
Clarify ownership and permitted use of source text, screenshots, response drafts, templates and derived reports. The IPO's copyright notices page states that copyright is automatic and no government copyright register exists in the UK. Real copying and publication decisions go to qualified IP review.
For money, retain currency, VAT presentation, charging unit, quantity, period, term, minimums, additions, overages, renewal and termination. Blank is preferable to an inferred amount. Include implementation, training, assurance, support, incident work, migration and exit.
Finally, require a machine-readable export, an isolated restore, removal of privileged access, return or deletion evidence, public-account control and continuity instructions. Due diligence remains unresolved until the buyer can leave without losing the original item, approval history, corrections or complaint trail.
Before you act
- Capture the contracting entity, signatory, service and terms version.
- Trace one review item from discovery through correction and archive.
- Map each data field, purpose, recipient, retention rule and deletion route.
- Demand evidence for access control, logs, backups, restoration and exit.
- Record the scope and date of every test or certificate.
- Require a machine-readable export and isolated restore before signing.
Common questions
What does a Companies House match actually prove about a supplier?
It is an identity record only. The register information has not been verified or validated, and it says nothing about capability, ownership of a product, security or suitability. Treat the match as one piece of evidence, not approval.
How should a buyer test whether a review service is genuinely controllable?
Demand evidence for authentication, privileged roles, joiners and leavers, logs, support access, vulnerability handling, incident notice, backups, restoration and continuity. Then test whether another authorised operator can complete capture, approval, correction and export using relevant assistive technology.
What must be in place before due diligence can be called resolved?
The buyer must be able to leave without losing the original item, approval history, corrections or complaint trail. That requires a machine-readable export, an isolated restore, removal of privileged access, return or deletion evidence, public-account control and continuity instructions.
