Why subscription commerce vendor due diligence starts before the demo

What to take away

The CMA has been the UK's competition and consumer authority since April 2014, and its reading of unfair terms shapes subscription contracts.
Use a dated evidence table as your template, with one named owner who can stop the signature.
Map every personal data field a supplier will touch before the first demo, because the ICO's principles apply to each one.
Score exit rights, data portability and price change notice beside features, since those decide the cost of leaving.
Set a deadline, for example 10 working days before signature, so the checklist closes.

Write the questions before you shortlist

Vendor scoring sheet rows

Data handling
Integration effort
Billing logic
Support cover
Contract flexibility

If you are still choosing which suppliers to include, the subscription commerce tools and supplier guide explains how the categories differ. That stops you scoring vendors that cannot serve a UK subscription model.

Give each row a weight before you see any vendor, because weights set after a good demo tend to drift.

A typical weighting for a mid-market platform is data handling 20, integration 20, billing 20, support 20 and contract 20. Adjust the weights to your risk.

Worked example: row Data export, weight 20. Evidence: a sandbox export completed within 24 hours and a deletion confirmation dated on receipt. Result: pass. If the export takes 5 working days or deletion proof is missing, fail.

Map the data the supplier will hold

Fields to map

Customer names
Delivery addresses
Payment tokens
Support transcripts
Cancellation reasons
Marketing export fields

The ICO's data protection principles require a lawful basis, a defined purpose and a storage limit for each, so ask for the supplier's retention schedule. A vendor that cannot name its sub-processors is a vendor you cannot audit.

Name the lawful basis from Article 6 UK GDPR for each field. Examples are consent, contract, legal obligation, vital interests, public task and legitimate interests. Tie retention to a UK rule. Tax records usually need six years plus the current tax year. Contract claims in England and Wales usually have a six-year limitation period.

Include the fields your own marketing team would export into the platform, since those are the ones teams forget to list.

Ask for evidence, not assurances

A supplier's claim of full compliance is not evidence. Ask for a current penetration test summary, an incident response process with named contacts, and a list of sub-processors and their locations. Give each document an expiry date, for example 12 months.

Evidence item	What to request	Expiry or review date
Data map	Field-level map, lawful basis and retention period for each field	Review every 12 months
Penetration test summary	Current summary with date and scope	12 months from test date
Incident response process	Named contacts, escalation times and last test date	Review every 6 months
Sub-processor list	Names, locations and roles	At each renewal
Sandbox test record	Logs for signup, failed payment and cancellation	At each renewal
Contract terms	Price change notice, minimum term and exit fee	At signature and each renewal
Export and deletion test	Timed export and deletion confirmation	At each renewal

Copy this table into a shared sheet and treat it as your checklist template.

If the supplier is small, ask who covers security when the lead engineer is away. Record every answer in the scoring sheet with the date it arrived.

Ask for a sandbox account and run signup, a failed payment and a cancellation yourself. Record what broke, and when it was fixed.

Put renewal and price terms in the contract

Consumer subscription terms have tightened since the Digital Markets, Competition and Consumers Act 2024. The CMA is the authority that would read your renewal wording after a complaint. Ask how the platform handles renewal reminders and cancellation flows. Then inspect the contract for minimum term, price change notice and early exit fees.

Compare the notice period the platform enforces with the notice your own terms give customers. If they differ, the gap becomes a complaint later.

Check vendor claims against Bank of England series

Do not base a churn assumption on a vendor's case study. Use published series instead.

The Bank of England's statistics include Bank Rate and effective interest rates on new lending to households and non-financial corporations. Use Bank Rate to stress-test price rises and discount assumptions. Use effective interest rates to test churn if subscribers face higher repayments.

For cost per subscriber comparisons, the review of subscription commerce tools in England explains how licence models differ, which matters more than the headline price.

Pick two series, note the release date, and write the assumption you drew from them into the file. Challenge any vendor claim that ignores those series.

What a dated evidence checklist changes

Most teams run due diligence informally, then rebuild it under pressure when a renewal lands. The table shows what shifts.

Informal approach

Data map: Supplier security page on file
Evidence: Verbal assurance on a call
Integration: Demo environment only
Commercials: Price agreed by email
Exit: Export assumed to work

Checklist approach

Data map: Field-level map with retention periods
Evidence: Recent test summary and sub-processor list, dated
Integration: Sandbox test of signup, dunning and cancellation
Commercials: Price change notice, minimum term and exit fee recorded
Exit: Timed export test and deletion confirmation

Keep the file in one place and version it, so the next renewal starts from evidence rather than memory.

Common questions

How long should vendor due diligence take?

Two to three weeks suits most mid-market platforms if you set an evidence deadline at the start. Complex payment or data migrations can push it to six weeks, so agree the timetable before the first call.

Who should own the checklist?

A named operations or finance lead, not the person who chose the vendor. Give that owner the power to stop the signature.

What if a supplier will not share its sub-processor list?

Treat that as a failed item and move on. You cannot meet your own data protection duties without knowing where the data goes.

Do we need legal review for every vendor?

No. Use a lawyer for contracts above your agreed spend threshold, and for anything touching payment data or long minimum terms.