Tools and providers
Part of Proposal software tools and providers explained
Why proposal software vendor due diligence needs a written checklist
Proposal software vendor due diligence checklist: company filings, security scope, data transfers, contract terms and exit risk, and the evidence to request.
What to take away
- Send one document request to every shortlisted supplier, then compare like for like.
- Set a named owner and a decision date before the first call, or the shortlist drifts into the next renewal cycle.
- Companies House filings, certification scope and a signed data processing agreement matter more than feature lists.
- Check the publication date on background figures such as the ONS digital economy statistics before citing them, because population-level data is not evidence about a named supplier.
Why due diligence stalls
Most buying teams treat due diligence as a final hurdle. It gets squeezed into the last week before signature, which is backwards. A proposal software vendor will hold your pricing, customer names and commercial terms. The risk sits in the contract, not the product tour.
A shared checklist gives every stakeholder the same questions and turns a vague feeling into a comparable record.
Company and financial checks
Start with the legal entity, not the brand. Confirm the registered name and number on the Companies House register, then pull the filing history.
Company and financial checks
- Registered name and number confirmed
- Filing history pulled
- Latest filed accounts requested
- Runway statement for early-stage supplier
- Charges and overdue filings checked
- Recent change of control checked
For an early-stage supplier, ask for the latest filed accounts and a runway statement. For an established one, check for charges, overdue filings or a recent change of control.
The business population estimates published by GOV.UK in 2014 are superseded by later annual releases, so size alone should not disqualify a supplier. Opacity should.
Security and data checks
Ask for the current certification scope, not just the badge. A certificate with a narrow scope tells you little.
Request the subprocessor list. If buyer data is processed outside the UK, get the transfer mechanism in writing.
For a fuller picture of how suppliers fit together, the proposal software tools and supplier guide maps vendor categories, including the security and data questions each type typically raises.
Contract and pricing checks
Read the renewal clause first. Auto-renewal with a 90-day notice window is a common trap.
Check the price review mechanism. A CAP tied to CPI is defensible; an uncapped annual increase is not.
Three UK contract points belong on the list. Confirm the governing law and the courts named for disputes, which for an English buyer is normally England and Wales. Search the ICO register of data protection fee payers for the supplier's registered name, and check the entry is current. Make sure the contract names UK GDPR, not EU GDPR alone.
LinkedIn's advertising costs and pricing page is relevant only if the quote bundles paid placement, where it works as an external media rate check. It is not evidence for the software licence fee itself.
Integration and exit checks
List every system the tool must talk to, then ask for documented API limits. Rate limits cause more post-sale pain than missing features.
Ask what happens to your data on termination. You want a dated export in an open format, not a promise of reasonable assistance.
The checklist
Use this as a shared document. Every line needs a named owner and a date.
- Registered company name and number confirmed against Companies House.
- Latest filed accounts reviewed, with any charges or overdue filings noted.
- Certification scope obtained in writing, not just the certificate.
- Subprocessor list and data transfer mechanism confirmed.
- Data processing agreement signed by both parties.
- Security questionnaire completed, including incident history.
- Uptime commitment and service credits stated in the contract.
- API rate limits and integration documentation tested.
- Data export format and termination timetable agreed.
- Renewal notice period and price review CAP confirmed.
- Reference call completed with a customer of similar size.
- Total first-year cost modelled, including implementation and training.
Scoring the shortlist
Score each supplier against the same weighted criteria. For example, security at 25%, contract terms at 25%, integration at 20%, support at 15% and price at 15%.
Weight
- Security and data
- 25%
- Contract terms
- 25%
- Integration
- 20%
- Support
- 15%
- Price
- 15%
Vendor A
- Security and data
- 4
- Contract terms
- 3
- Integration
- 4
- Support
- 3
- Price
- 2
Vendor B
- Security and data
- 3
- Contract terms
- 4
- Integration
- 2
- Support
- 3
- Price
- 4
Evidence
- Security and data
- Certification scope letter
- Contract terms
- Marked-up master agreement
- Integration
- API rate limit document
- Support
- Support hours in the SLA
- Price
- Three-year cost model
These scores are illustrative. The weighted totals work out at 3.3 for Vendor A and 3.2 for Vendor B, so the totals alone do not settle the choice.
Record the evidence beside each score. A score without a source is an opinion.
If your team is still comparing approaches, the proposal software selection process sets out how to weight criteria before this stage.
Common questions
How long should due diligence take?
Allow three to four weeks from shortlist to signature for a mid-market tool. Compressing it below two weeks usually means skipping reference calls or contract review.
What if the vendor refuses to share accounts?
That is a signal, not a dead end. Ask for a parent company guarantee or a shorter initial term instead. If neither is offered, treat the refusal as a risk you are choosing to accept.
Should security review come before pricing talks?
Run them in parallel. Sequential gating slows the process and lets a weak security position hide behind a competitive price.
