Advertising creative tools vendor due diligence: what to ask

Set the use boundary

Describe the precise creative work the platform will perform, who will use it, what information enters, and whether it can publish or alter live advertising.

This boundary determines which supplier controls matter and how much confidence the evidence must provide; a broad product demonstration cannot prove that your configured workflow is suitable.

List every user, administrator, agency, integration and support route. Classify source assets, prompts, personal information, product feeds and approval records. Identify prohibited uploads and excluded countries or business units. Note if the service can change live advertising or only return files.

This description should set the confidence required from the supplier and identify controls needing closer inspection. Make it specific enough to distinguish the planned workflow from a general product demonstration, including connections or users that could change the material being created.

Restrict permitted material

Set boundaries before any material is shared: identify permitted uploads, prohibited content, and whether information may pass to another model or service. Put the limits into operative contract terms, not just a product description or general privacy summary. Restrictions should cover the service configuration your team actually intends to use.

Ask what rights the supplier receives in uploads and outputs, whether customer material trains or improves a model, which third-party models receive it, and how an opt-out works. Check retention for prompts, generated images, deleted files, logs and backups. Review the relevant commercial terms with qualified counsel.

Trace roles and data paths

Map the actual legal and operational relationships before signing. Establish whether each use makes the supplier a controller or processor, who determines the purpose, and where work and support data go. The practical relationship, rather than a sales label, informs the terms and safeguards needed.

Use the personal-information map to check personal information and data-sharing arrangements. Confirm actual roles, Article 28 processor terms where applicable, transfer safeguards, any required transfer risk assessment, named sub-processors, processing locations and advance notice of changes. Include the routes used for support as well as production work.

The ICO notes that guidance may need review after legal changes and does not settle commercial negotiation, so assess proposed terms in context. Its fee checker can confirm fee registration, but a register entry does not establish platform security or suitability. Keep these limits alongside any security of processing claims and your accountability records.

Interrogate assurance evidence

Treat supplier assurance as a starting point, not a verdict. Ask what was assessed, which parts of the product were included, when the work took place, and what parts of your intended setup were excluded. Evidence is useful only when it supports the particular service and configuration you would use.

Use the NCSC cloud provider guidance to size scrutiny against sensitivity and possible impact, not as product approval. For cloud services, ask which security controls belong to the provider and which remain with its underlying host.

Request scoped ISO/IEC 27001, SOC 2 Type II and Cyber Essentials or Cyber Essentials Plus material where applicable. Ask for a penetration-test report or executive summary stating the assessor, scope, exclusions, findings and remediation status. Compare the technical requirements and evidence with your planned setup; a certificate alone does not establish suitability.

Put named people on controls

Identify the people who can change production templates, model choices, publishing connections and security settings. Ask how privileged staff are screened, trained and removed, and what customer-visible record remains after support access. Assign an owner to each material control so that unanswered supplier responses do not lack an internal contact.

Match escalation routes to an English team's working hours and campaign deadlines. Assign team roles for approving changes or halting activity when an issue arises. Make clear who can act when the usual decision-maker is unavailable.

Request the service-status history and the contract's definition of availability, including its committed percentage, measurement period and exclusions in the service-level agreement. Separate platform uptime from a critical integration's availability: the platform may operate while the workflow your team depends on is unavailable.

Record recovery time and recovery point objectives, retention periods for prompts, logs, backups and deleted files, and incident notification periods. Set deadlines for fixing material findings. Ask how the supplier communicates incidents, preserves evidence and coordinates with its host; a public status page alone cannot show the effect on your workflow.

Exercise continuity and exit

Make recovery and departure testable before disruption occurs. Confirm that essential work can be retrieved and that the team has a practical way to stop or continue urgent activity if the platform or a connected service becomes unavailable. A contract promise is not proof that your own process will work.

A supplier's promise to support departure does not rehearse your team's steps. Check that export and recovery work for the materials and records the workflow depends on, rather than treating a written commitment as a completed test. Confirm usable formats, transition time and any post-contract access before relying on them.

Set an alternative delivery route for urgent amendments if the service or identity provider is unavailable. Keep approved source files outside the platform where rights and security permit, and rehearse who can halt media if publishing still works but creative review does not.

Close the decision record

Give every material issue a named owner, a deadline and a recorded outcome: accept, mitigate, restrict or reject. Preserve accountability records showing what the evidence supports and what remains unresolved, rather than letting an unanswered supplier question disappear into procurement correspondence.

Pause procurement when a critical assertion lacks evidence proportionate to the planned use, or when your team cannot recover its work without the supplier. For an accepted mitigation, record how completion will be checked and who can approve the remaining exposure before the service is used. Keep the decision and its reasoning with the relevant supplier evidence.