Tools and providers
Part of How to choose keyword research tools and providers for your team
What keyword research vendor due diligence means for procurement teams
A keyword research vendor due diligence checklist for UK content teams, covering data provenance, contracts, security, onboarding, exit terms and scored trials.
What to take away
- Due diligence has moved from a one-off purchase check to a continuous obligation, because regulators expect organisations to map the personal data reaching supplier systems.
- Ask for evidence rather than assurancesnamed data sources, penetration test dates, sub-processor lists and breach notification windows.
- Score every shortlisted vendor against the same checklist so finance and legal review one document, not five.
- Agree exit terms at signing, covering raw keyword exports and historical rankings.
- The wider buying sequence is set out in keyword research tools and supplier guide for 2027.
Why the checklist changed
Procurement questions that once felt optional now sit in the main contract pack. Keyword tools blend search volumes, clickstream data and scraped results, so a simple answer about provenance is rare.
Ask what the vendor collects, where it stores it and who else touches it. That is a legal question as much as an SEO one.
Data provenance checks
Ask the vendor to name every source behind its keyword volumes. A credible answer separates first-party panels from licensed clickstream data and public search APIs. If those cannot be separated, treat the numbers as directional only.
Data provenance checks
- Name every source behind keyword volumes
- Separate first-party panels from licensed clickstream
- Separate public search APIs from other sources
- Treat inseparable numbers as directional only
- Record refresh cadence per supplier
Monthly updates suit long-range planning, while weekly feeds support seasonal campaigns. Record the refresh cadence in the same row for every supplier.
Contract and licence terms
Read the licence for seat limits, API calls and permitted use. Some contracts bar resale of exported data, which affects agencies building client reports. Others restrict use in model training.
Contract and licence checks
- Check seat limits and API call allowances
- Check permitted use and resale clauses
- Check restrictions on model training
- Confirm renewal price escalation justification
- Check small-team tier seat cap
Confirm what happens at renewal, because price escalation above inflation needs a written justification. Check whether a small-team tier's seat CAP fits your headcount. Semrush for small teams and startups sets out how its own tiers are structured, which helps you frame the question.
Security and data protection
Request the latest penetration test summary and its completion date. Ask for the sub-processor list and the countries where data is stored.
Check the breach notification window. A 72-hour commitment mirrors the UK GDPR expectation, and anything longer deserves a written explanation.
Tool capability evidence
Run a scored trial rather than a demo. Give each vendor the same ten seed terms and compare volume ranges, related-term quality and export formats. Moz Pro publishes what its toolkit covers, which helps you map features to your scoring sheet.
Record the trial date and the exact queries used. That evidence protects you if results shift after signing.
Onboarding and workflow fit
Map the vendor's workflow to yours before purchase. Ask whether onboarding and training are included or billed separately. Paid onboarding can add a material sum to year one, so model it explicitly.
If paid search or social data feeds your content plan, check the platform's own setup guides. Getting started with LinkedIn advertising shows the kind of official documentation to expect from any vendor you onboard.
Pricing and exit terms
Build a three-year cost model, not a one-year one. Include seats, API overage, onboarding and any data storage fees. For example, a team paying £400 a month for ten seats faces £14,400 over three years before overages.
Exit terms matter as much as entry terms. Confirm you can export raw keyword data, historical rankings and saved projects in a standard format. Ask for the deletion timeline after contract end.
Comparison table
Evidence to request
- Data provenance
- Named sources and refresh cadence
- Licence terms
- Seat, API and resale clauses
- Security
- Pen test date and sub-processor list
- Capability
- Scored trial on fixed seed terms
- Onboarding
- Training scope and cost
- Exit
- Export formats and deletion timeline
Red flag
- Data provenance
- Vague proprietary data answers
- Licence terms
- Bans on client reporting
- Security
- No breach window stated
- Capability
- Demo-only evaluation
- Onboarding
- Onboarding billed as extra
- Exit
- No bulk export option
For deeper guidance on judging the datasets behind vendor claims, read keyword research best tools: data and sources.
Common questions
How long should due diligence take?
Allow two to four weeks for a shortlist of three vendors, with the trial and legal review running in parallel.
Who should sign off on the vendor?
Finance owns the cost model, legal owns the contract and security review, and the content lead owns the capability score.
What if the vendor refuses to share provenance?
Treat that as a scoring failure; untraceable volumes cannot support planning decisions.
Do small teams need the same checklist?
Yes, but scale the evidence. A five-person team can use a published security page and one scored trial rather than a full audit.
