Tools and providers
Part of Before you buy SEO tools, split the licence from the data
SEO tools vendor checks before signing
SEO tools vendor checks cover data sources, tier fit, security, integrations, contract terms and exit routes. Use this checklist before signing.
What to take away
Vendor due diligence for SEO tools is the evidence-gathering step between shortlisting a platform and signing a contract, covering data sources, security, contract terms and exit routes.
- Ask every shortlisted vendor the same written questions and score the answers on one scale.
- Check where rank, volume and traffic data come from before you trust any report built on it.
- Match the tier to your real team size, not the tier the sales team prefers.
- Test export, API and cancellation routes while you still have bargaining power.
- Keep dated copies of each answer, because terms and roadmaps change between renewals.
Set the review scope
Decide which tools fall inside one review. Tools that share a data pipeline can be checked together. Split the ones that do not.
Scoping the vendor review
- Decide which tools fall inside one review
- Group tools that share a data pipeline
- Split tools that do not
- Name one owner for the review
- Write the scope down with a review date
Name one owner for the review. That person holds the question list, logs answers and escalates gaps.
Write the scope down, with a review date, so the next buyer inherits your reasoning rather than your conclusions.
For the wider buying picture, from licence types to market scope, our guide to SEO tools and suppliers sets out the sequence to follow before you contact vendors.
Evidence to request
Ask for a sample report with a visible date, not a slide deck. Check the sample covers a site like yours in size and sector.
Evidence to request from vendors
- Sample report with a visible date
- Sample covers a site like yours
- Keyword volume source named
- Refresh frequency stated
- History recalculation policy explained
- Tier fitseats, projects, limits
Request the keyword volume source and the refresh frequency. If the vendor cannot name the source, treat the metric as illustrative only.
Ask how often data refreshes and whether past figures are recalculated when a method changes. A vendor that revises history quietly makes trend reporting unreliable.
Tier matters. A small team may need two seats and one project, while Semrush's mid-market proposition targets larger teams that need brand visibility at scale.
Data and integration checks
Confirm how rank positions are collected. Panel, clickstream and modelled methods produce different numbers, and mixing them across tools creates false trends.
If you plan to pull data into your own dashboard or warehouse, check for a documented API before you assume integration is possible. Moz publishes an API for teams feeding SEO data into custom tools. Its existence shows integration is supported, not that the data will match another vendor.
Record the endpoint, authentication method and quota in your notes. A promise made on a sales call is not a specification your developers can build against.
Also ask about rate limits, historical depth and what happens to your data if you leave.
Security and data terms
Ask where data is hosted and which subcontractors touch it. Under UK GDPR, your business is the controller and the vendor is usually a processor, so a data processing agreement is not optional.
Check the vendor's ICO registration if it processes personal data. Confirm retention periods for imported client lists and audit logs.
Ask how you would be notified if a new sub-processor is added, and where that data sits. Notification periods belong in the contract, not in a conversation.
If you sell to government bodies, the procurement route adds rules. The supplier guidance for the Digital Outcomes and Specialists framework explains how SEO services were bought through that route. It remains useful background even though it is withdrawn.
Contract and exit checks
Read the cancellation clause, the notice period and the price review mechanism. Check whether unused seats can be reassigned between people.
Check which law governs the contract if the vendor sits outside England.
Ask for a written exit plan: how you get your historical data out, in what format, and at what cost.
Diarise the auto-renewal date and notice window on the day you sign. Those dates rarely move once the contract starts.
Once the checks pass, the implementation stage decides whether the tool earns its place, so plan the handover to the team that will run it daily.
Checklist at a glance
| Check | What good looks like | How to verify |
|---|---|---|
| Data source | Named method for rank and volume data | Sample report with a date |
| Tier fit | Seats, projects and limits match your workload | Written quote against your user list |
| Security | Data processing agreement and named sub-processors | Contract pack and ICO registration |
| Integration | Documented API with rate limits | Vendor documentation and a test call |
| Exit | Data export in a usable format | Written exit plan in the contract |
Common questions
How long does due diligence take?
There is no fixed duration; it depends on the evidence required and how quickly the vendor responds. Keep the review proportionate: a seat-based tool that holds no client data needs less evidence than a platform with imported lists.
What if a vendor refuses sample reports?
Treat it as a gap in the record, not a deal breaker on its own. Log the refusal, score the item down and judge whether the tool is essential.
Does an ISO certificate close the review?
No. A certificate covers a defined scope, which may not include the product you are buying. Ask for the scope statement and check that it names the service.
