Tools and providers
Part of Investigating ecommerce platforms with dated supplier evidence and eight independent gates
Ecommerce platforms vendor due diligence: the paper trail
Vendor due diligence for ecommerce platforms: the entity, price, processor and exit papers to request, and why every claim stays supplier-stated until tested.
Vendor due diligence is mostly paperwork: the documents that name who you are contracting with, what exactly you are buying and what the vendor hands back if you leave. Each paper either supports a claim or leaves it as supplier-stated. A polished demonstration, certificate or familiar logo does not replace them.
Case and date: The papers below were listed on 6 September 2026 for an England merchant selling its own physical consumer goods online to UK adults, and they are the ones that merchant should hold before any signature.
What to take away
- Treat vendor due diligence as a paper trail where every critical item ends as pass, fail or unknown.
- Get the legal entity, exact plan, price schedule and processor terms in writing, with access dates.
- Verify the vendor's legal entity against the Companies House register.
- Mark advertised capabilities as supplier-stated until demonstrated in the proposed configuration.
- Export everything and restore it to an independent test location before commitment.
- Do not sign while a critical item remains unknown.
Who you are contracting with
Start with the legal entity, because every later document hangs from it. Record the contracting legal entity, trading name, company number where applicable, service territory and governing terms. Then verify the entity against the Companies House register and keep a dated copy of what it shows.
Confirm which party is the seller, marketplace operator, payment provider and processor for each event. Do not infer these roles from the software category. Different roles can sit with different companies, so ask for the terms that govern each one and read them side by side rather than relying on a single order form.
Fixing exactly what is being bought
Name the exact plan, release, add-ons, payment provider and fulfilment integrations, and save copies with access dates and renewal rules. A vague plan name cannot be checked later, and a renewal rule you did not save cannot be quoted back to the vendor.
Obtain a price schedule showing GBP or other currency, VAT basis, billing period, usage unit, transaction conditions, promotion, term, renewal and termination cost. Leave the budget cell blank if evidence is incomplete, and put each quote on a scope sheet so the vendors are priced on the same work.
Hosted or self-assembled: who runs what
Ask what the vendor operates and what stays with you. Shopify and BigCommerce are hosted ecommerce platforms, so verify which hosting, platform updates, checkout and security responsibilities the vendor runs and which remain with the merchant or its integrations.
WooCommerce is open-source ecommerce software for WordPress, typically used with hosting arranged separately. Check who operates the hosting and who handles WordPress, plugin and backup responsibilities in the proposed setup. Treat the vendor's commitments as specific to the plan and configuration under review, and compare candidates on the same catalogue and exit needs.
Supplier-stated or demonstrated
Mark every advertised capability as supplier-stated until it is demonstrated in the proposed configuration. A polished demonstration, certificate or familiar logo does not move a claim into the demonstrated column. A configured test with synthetic stock does.
| Paper to request | What it settles | If it is missing |
|---|---|---|
| Contracting entity and terms | Who is bound and under which terms | Unknown |
| Price schedule | Currency, VAT basis, term, renewal, termination cost | Leave the budget cell blank |
| Processor terms and sub-processor list | Who handles customer data and where it goes | Unknown |
| Certificate such as ISO 27001 | Scope and validity against the contracted service | Supplier-stated only |
| Export and restore record | Whether leaving works in practice | Hold the signature |
Give each paper an access date, as the dated supplier evidence investigation does for its candidate register. A paper without a date cannot show which version of the terms you actually read, and the vendor may have changed them since.
Processor and security papers
Ask for the processor terms, sub-processor list, transfer mechanism, audit evidence and end-of-service return or deletion provision. Read them against your own field map: each customer, staff, supplier and analytics field with its purpose, lawful basis, role, retention rule and deletion route.
The ICO's guidance sets out what needs to be included in a contract between a controller and a processor under the UK GDPR and Data Protection Act 2018. It is marked for review after the DUAA, so privacy counsel should recheck it before signature, and any amendment belongs on the paper trail.
Ask who owns vulnerabilities, patching, privileged access, backups, incidents and recovery, and demand evidence covering the contracted service and relevant dates. The NCSC supplier assurance questions examine governance, cloud dependencies, offshoring, independent testing and contractual controls. If the supplier offers ISO 27001 certification, check its scope and validity against the contracted service.
Customer-facing papers the vendor must support
The vendor's checkout has to carry the merchant's own customer terms. The Consumer Contracts Regulations 2013 list the information required for a distance contract, including delivery arrangements, the trader's complaint handling policy, if there is one, and cancellation rights.
Arrange an accessibility review of the configured browse, basket, checkout, account, cancellation and support journeys, using WCAG 2.2 AA as a benchmark. Supplier statements do not prove the final combination works for disabled users. Confirm which party is responsible for applicable PCI DSS requirements and request evidence for the contracted payment flow.
Exit evidence and sign-off
Export catalogue, orders, customers, permissions, suppressions, settlements, content, configuration and logs. Restore them to an independent test location, then record omissions. Until that restore has been done, an exit clause is a promise rather than evidence. The cost of leaving is a separate question, covered under ecommerce migration costs.
Do not sign while a critical item is unknown. Name the owner, evidence, expiry and remediation for each hold, and repeat changed checks immediately before commitment. A hold with no owner and no expiry tends to be forgotten, so write both next to it.
Before you sign
- Record the contracting legal entity and governing terms.
- Verify the legal entity against the Companies House register.
- Save the exact plan, add-ons and price schedule with access dates.
- Obtain processor terms, sub-processor list and audit evidence.
- Check any certificate's scope against the contracted service.
- Export all data and restore it to an independent test location.
Common questions
Which papers should be in hand before a platform contract is signed?
The contracting entity and governing terms, the exact plan and add-ons, a full price schedule, processor terms with the sub-processor list, audit evidence and a record of an export and restore. Anything not seen stays unknown, and an unknown critical item blocks signature.
How should a certificate or demonstration be treated?
As supplier-stated until it is demonstrated in the proposed configuration. For ISO 27001, check the scope and validity against the service you are actually buying, because a certificate for one part of a business says nothing about another.
What belongs on the record for each unresolved item?
An owner, the evidence still needed, an expiry date and the remediation. Repeat the changed checks immediately before commitment, so the file shows what was true on the day of signing and not only on the day of the first review.
