Tools and providers
Part of Procurement framework for property media workflows using official records as evidence
Property creators vendor due diligence: evidence gates
Property creators vendor due diligence for UK media: log named owners, expiry dates and approval gates for data, rights, security, accessibility and exit.
Property creators vendor due diligence should establish whether one exact supplier and edition can support an authorised property-media workflow in the relevant UK nation. It is not a search for reassuring badges.
What to take away
- Every vendor answer needs a named owner, dated evidence, an expiry date and a defined action when evidence fails.
- A UK billing address does not prove UK-only access or processing, so document transfers and subprocessors properly.
- Accessibility conformance must cover the exact interfaces used by staff, clients and viewers, tested with representative users.
- Approve only the stated edition, workflow and period; any unknown on the listed gates is a failed gate.
- Property-source verification stays outside the vendor because a search result cannot validate a whole listing.
Identity and commercial scope
- Record the contracting legal entity, company number, registered address and trading names. Companies House says its public register is not a comprehensive source, so corroborate identity and authority in the contract.
- Name the product, plan, region, user quantity, add-ons, reseller and implementation partner. Capture which document controls if pages conflict.
- Save the price basis only from the current quotation, including currency, VAT treatment, usage measures, renewal, increases, support charges and exit work. Do not invent a market price.
- Allocate contract, procurement and finance owners. Record liability, indemnity, insurance, service credits, termination and continuity terms for specialist review.
Data, privacy and rights
- Map client contacts, appearances, property locations, access instructions, raw footage, enquiries, analytics, logs and support copies. State controller and processor roles for each movement. Assess personal-data handling against the UK GDPR and Data Protection Act 2018; assess electronic marketing and relevant cookies against PECR.
- Check the executed processor terms against the ICO's required contract provisions, including the UK GDPR's Article 28 processor terms. Identify all subprocessors, purposes, locations, change notice and objection route.
- Document remote support and international transfers using the ICO's transfer guidance. Where a transfer safeguard is required, consider the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable. A UK billing address does not prove UK-only access or processing.
- Define export, return, deletion, backups, legal holds and deletion evidence at exit. Assign a privacy owner and review whenever a subprocessor, hosting route or purpose changes.
- Identify ownership and licensing for uploads, outputs, templates, models, music and metadata. The IPO's digital-image notice is a reminder that internet availability does not remove copyright. Where relevant, check licensing with PRS for Music for musical works, PPL for recorded music and DACS for visual-art rights; confirm that the licence covers the intended use.
Security and resilience
- Request the architecture, encryption boundaries, identity controls, privileged-access process, guest restrictions, event logs, vulnerability handling and incident-notification terms.
- For each certificate or penetration-test statement, record issuer, report period, exact product and systems covered, exclusions, exceptions and customer responsibilities. Evidence may include ISO/IEC 27001 certification, Cyber Essentials or a SOC 2 report; these are not interchangeable and their scope must match the service. For penetration testing, ask whether testing was conducted under the NCSC CHECK scheme or by a CREST-accredited provider. A report should show the tested product version, systems in scope, test period and retest status. A logo is not assurance for the purchased configuration.
- Ask where backups sit, who can restore them, recovery objectives, dependencies and the last relevant test. The NCSC's response and recovery guidance can frame an exercise, but the team must test its own route.
- Record service status, support channels, severity definitions, escalation, maintenance, continuity and supplier failure arrangements. Assign security evidence an expiry date and a named reviewer.
Accessibility, property and publishing gates
- Obtain current accessibility conformance evidence for the exact interfaces used by staff, clients and viewers. Assess against WCAG 2.2 AA and EN 301 549, and consider duties under the Equality Act 2010; a conformance report is not itself a legal determination. Test keyboard, screen reader, zoom, captions, transcripts, errors and approval controls with representative users. Representative users means people who match the roles and assistive technology used by staff, clients and viewers, including at least one keyboard-only user and one screen-reader user.
- Keep property-source verification outside the vendor. Record the official dataset's geography, edition, identifier and limitation. Depending on the UK nation and the claim, check sources such as HM Land Registry, Registers of Scotland or Land & Property Services in Northern Ireland, and the relevant official EPC register; a search result cannot validate a whole listing.
- Require a prominent advertising disclosure test. The ASA's social-media guidance does not make a platform label a substitute for assessing the real communication.
- Refer mortgage or investment material to a named FCA financial-promotion reviewer under FG24/1. Separately review estate-agency activity, consumer claims, lead handling and appearance permissions.
Exit decision
Before signature, export a synthetic workspace with files, metadata, approvals and logs; restore it independently; revoke all access; and check the deletion route. Record defects and retest them.
Approve only the stated edition, workflow and period. Any unknown involving legal entity, processor terms, transfer, rights, privileged access, incident recovery, accessibility, pricing liability, export or deletion is a failed non-compensating gate. The accountable owner either resolves it or records a hold.
The accountable owner signs off the hold, with the privacy or security lead, and it is recorded in the vendor decision log with the open item, date, scope and review date.
Evidence owners and review dates
For every gate, enter the individual owner's full name and role in the decision log, not just a team name. Record the evidence title, supplier edition and scope, date checked, stated expiry date and next review date. Use the date printed on time-limited evidence; if it has no stated expiry, agree and enter a calendar review date before approval. Leave no owner or date field blank.
Assign the procurement lead to identity and commercial evidence, the privacy lead to data and transfer evidence, the security lead to security and recovery evidence, the accessibility lead to interface evidence, and the rights or editorial lead to source and licensing evidence. The accountable owner confirms the gate decision and records any hold.
Before you act
- Record the contracting legal entity, company number and trading names.
- Map data flows and state controller and processor roles for each; check UK GDPR, Data Protection Act 2018 and PECR relevance.
- Check processor terms and any required international transfer safeguard, including the applicable IDTA or UK Addendum.
- Assign a named individual and expiry or review date to each evidence item.
- Test accessibility on the exact interfaces against WCAG 2.2 AA and EN 301 549 with representative users.
- Check relevant official property and EPC registers, and confirm media rights and licence scope.
- Export a synthetic workspace, restore it independently and revoke access.
- Refer mortgage or investment material to a named FCA reviewer.
Common questions
What should be recorded for the supplier's identity and commercial scope?
Match the legal entity in the signed contract to the entity named on the current quotation, then confirm authority to contract. Treat the product, plan, region, reseller and implementation partner as scope boundaries: evidence for a different edition or region does not establish the service being purchased.
How should security and resilience evidence be treated?
Check whether security evidence is ISO/IEC 27001 certification, Cyber Essentials or a SOC 2 report, and confirm its scope and period; these are different forms of evidence. For penetration testing, check the product and systems tested, exclusions and retest status, including whether the provider used the NCSC CHECK scheme or CREST-accredited testing. Record the evidence's stated expiry or a dated review date and a named reviewer. See security evidence an expiry date.
What must happen before signature on exit and deletion?
Make acceptance conditional on demonstrating the export and restore route, revoking access and checking deletion evidence. Contract wording alone does not prove the route works. Record defects, keep the hold in place until they are resolved, and retest.
