Tools and providers
Part of Matching attribution tools to jobs, and what each must show first
Marketing attribution vendor due diligence checklist
Marketing attribution vendor due diligence checklist: record identity, model, data roles, security, consent, evidence, contract, exit export before procurement.
Use this marketing attribution vendor due diligence checklist against the exact legal party, service, edition and proposed use. A polished security page or company registration cannot answer whether the configured service fits the buyer's evidence job. This checklist was prepared without contacting, testing or recommending a vendor.
What to take away
- Run due diligence against the exact legal party, service, edition and proposed use, not a polished security page.
- Classify the actual job as platform credit, reconciliation, MMM, experiment support or general analytics, and reject mixed descriptions.
- A badge or group-wide report is not evidence for an omitted service in the purchased edition.
- Run a controlled export before signing and require deletion scope and evidence after termination.
- An unresolved privacy, PECR, security, accessibility, evidence, contract or exit question keeps the vendor on hold.
Identity and service
- Record contracting entity, company number where applicable, jurisdiction, invoice party and policy owners. Use Companies House search guidance for public register facts, while recognising that registration does not prove quality, solvency or control effectiveness.
- Name the edition, service boundary, geography, inputs, connectors, outputs, model and version. Capture source URLs, dates and incorporated terms.
- Classify the actual job as platform credit, reconciliation, MMM, experiment support or general analytics. Reject a description that mixes them without separate evidence.
- Ask who owns product notices and how the buyer learns about retired connectors, model changes or revised limits. Attach each answer to a contract term or dated service record rather than a salesperson's recollection.
Attribution evidence
- Name the attribution job and the vendor typeplatform credit (for example Google Analytics 4, Adobe Analytics, Meta Ads Manager, AppsFlyer, Adjust, Branch or Singular), reconciliation (for example Measured, Northbeam, Triple Whale or Rockerbox), MMM or experiment support. Record the model used: last-click, data-driven, rule-based or custom. Require model version history, model-change notices and a named owner for change communications.
- Record lookback and conversion-window settings by channel and conversion. Ask for evidence of how a window change affects historical reporting. Test a known conversion path and compare the result with the configured window.
- Map cross-device and cross-domain identity resolutionidentifiers used, authenticated and unauthenticated coverage, match rates, gaps and how unmatched traffic is treated. Require the match-rate method and a dated sample, not a claim.
- Define a reconciliation tolerance against platform-reported conversions before signing. Record the tolerance, the source platforms, the comparison period and the evidence that the vendor can produce a like-for-like report. Reject a reconciliation claim that cannot be repeated in the buyer's export.
- For incrementality, require geo-holdout, lift-test or equivalent design evidence: test design, control selection, duration, minimum detectable effect and how results are reported. If the vendor offers no test design, record that gap and keep the vendor on hold for that job.
- For MMM, record the provider or in-house model, input granularity, calibration sources, refresh cadence and how MMM outputs reconcile with platform attribution. Ask what the vendor does not model.
- For consent and tags, record consent mode, TCF or equivalent framework status, tag and pixel governance, server-side or client-side collection, data-sharing settings and the audit trail for tag changes. Apply PECR storage and access rules to each tag and pixel.
Data and legal roles
- Map purposes, essential means, data fields, identities, missingness and recipients before assigning roles. The ICO's controller and processor guide was marked under DUAA review on the research date. Treat DUAA-dependent points as unresolved and recheck the ICO guide before signing.
- List sub-processors, locations, remote access and onward uses. Apply the ICO's 2026 international transfers guide to the real flow rather than a hosting label.
- Record device technologies and purposes. The ICO's final storage and access guidance covers tags, pixels and similar techniques under PECR. For each tag and pixel, record consent mode, TCF or equivalent framework status, server-side or client-side collection and the audit trail for changes.
- Ask how the service supports access, correction, objection, deletion and suppression across raw data, derived features, models and exports. Record what the vendor cannot do and send the gap to the buyer's privacy reviewer.
Security and operations
- Obtain authentication, least-privilege, privileged support, encryption, tenant separation, log, vulnerability, incident, backup and recovery evidence for the purchased edition.
- Record certification scope, auditor, issue date, exclusions and expiry. A badge or group-wide report is not evidence for an omitted service.
- Compare the response with the NCSC's cloud security principles. Assign an independent security reviewer and a recheck date.
- Inspect how long audit events remain available, who can alter them and whether the buyer can export them during an incident. Do not accept a general logging claim as proof that the required event and retention exist in the quoted edition.
Accessibility, rights and support
- Define buyer tasks and test them with stated browsers, assistive technologies and exports. GOV.UK's accessible technology guidance provides procurement questions in a public-sector context; it is not a private-service certification.
- Specify rights in source data, campaign taxonomies, identity mappings, model inputs, derived outputs and feedback. Ask whether buyer data trains or improves a supplier model.
- Document support channels, coverage, evidence supplied, change notices and escalation. Leave service levels blank unless the proposed contract states them.
- Give accessibility and support findings separate owners. A responsive helpdesk cannot compensate for an inaccessible critical task, and a conformance report cannot demonstrate the configured export route without a test.
Commercial and exit proof
Enter price only with exact currency, VAT treatment, unit, period, edition, term, limits, overage and date. Keep the field blank for this checklist. Add change, renewal, liability, termination and continuity terms for qualified review.
Run a controlled export before signing. Verify schema, history, identifiers, model metadata, timing, fees and restoration in a buyer-controlled route. Require deletion scope and evidence after termination. The continuity owner should prove that the manual baseline can resume without relying on the vendor account.
Finish every section with pass, fail or unresolved, plus evidence owner and expiry. An unresolved privacy, PECR, security, accessibility, evidence, contract or exit question keeps the vendor on HOLD regardless of other strengths.
Before you act
- Record contracting entity, company number, jurisdiction and invoice party.
- Name the edition, service boundary, inputs, connectors, outputs, model and version.
- Name the attribution model, model version history, lookback window and conversion window.
- Map purposes, data fields, identities and recipients before assigning roles.
- Obtain security evidence for the purchased edition, not the group.
- Define buyer tasks and test them with stated browsers and assistive technologies.
- Record reconciliation tolerance against platform-reported conversions.
- Record identity resolution coverage, match rate and consent or TCF status.
- Run a controlled export and verify schema, history, identifiers and timing.
Common questions
What should a buyer record about the vendor's legal identity?
Record the contracting entity, company number where applicable, jurisdiction, invoice party and policy owners. Use Companies House search guidance for public register facts, while recognising that registration does not prove quality, solvency or control effectiveness.
How should a buyer treat a security certification badge?
Record certification scope, auditor, issue date, exclusions and expiry. A badge or group-wide report is not evidence for an omitted service, so compare the response with the NCSC cloud security principles and assign an independent security reviewer and a recheck date.
What must happen before signing the contract?
Run a controlled export before signing. Verify schema, history, identifiers, model metadata, timing, fees and restoration in a buyer-controlled route. Require deletion scope and evidence after termination, and prove the manual baseline can resume without the vendor account.
