Tools and providers
Part of Choosing newsletter monetisation tools for 2027 by workflow, cost and exit readiness
Newsletter monetisation vendor due diligence checklist
Use this newsletter monetisation vendor due diligence checklist to check a platform’s identity, data handling, payments, security, support and export route.
Newsletter monetisation vendor due diligence starts by approving a vendor only when its evidence matches the exact newsletter function, configuration and legal relationship. A security PDF that names no sub-processors and a feature grid that omits export formats cannot compensate for an unknown contracting entity, an inaccessible cancellation route or a missing export.
For every item, record owner, source, document date, applicable edition, finding, gap, expiry and decision.
What to take away
Step 1: for every item, record pass, fail or unknown; never turn unknown into a partial score.
Use this record template for each item:
| Owner | Source | Document date | Edition | Finding | Gap | Expiry | Decision |
|---|---|---|---|---|---|---|---|
| Name | Register or contract | YYYY-MM-DD | Plan and region | Confirmed | Open item | YYYY-MM-DD | Approve or hold |
- Approve a vendor only when evidence matches the exact newsletter function, configuration and legal relationship.
- Record owner, source, document date, applicable edition, finding, gap, expiry and decision for every item.
- Award remains on hold while a mandatory answer is absent, stale or tied to the wrong edition.
Identity, scope and money
- Verify the legal and trading identity that will contract, invoice and process data. Record the company number or equivalent, address and group relationships from appropriate registers and the signed agreement. For a UK company, check its registered details against Companies House, the register maintained under the Companies Act 2006, and compare the company number with the VAT number on the invoice.
- Name the exact newsletter platform, plan, region, enabled modules, integrations and excluded functions. For example, identify whether the stack uses Substack, beehiiv, Ghost or Mailchimp, and whether paid access or payments involve Stripe, PayPal, Patreon or Memberful. Verify the roles and connections in the selected configuration; marketing copy for another edition is not evidence.
- Capture currency, VAT presentation, billing event, unit, quantity, period, renewal, price-change route, payment-processing deductions, refunds, chargebacks, support and termination. Reconcile the quote with checkout and contract rather than copying a headline amount.
- State who supplies paid access, advertising, affiliate tracking and payment processing. These exchanges carry different obligations and records.
For consumer sales, assess the configured offer, confirmation, cancellation and complaint routes against the Consumer Contracts Regulations 2013 and GOV.UK's distance-selling guidance. A named consumer-law reviewer must examine the configured offer and customer journey.
Data, marketing and security
- Map each recipient, subscriber, payer, advert and support field through supplier, sub-processors, analytics and exports. Identify controller and processor roles by purpose under the UK GDPR and Data Protection Act 2018. Record the ICO registration number shown in the privacy notice.
- Obtain the signed processor terms, instruction limits, sub-processor list, transfer locations, retention, deletion, audit assistance and incident duties. Check the ICO's guidance on controller-processor contracts and whether the Data (Use and Access) Act 2025 affects the applicable position.
- Keep acquisition source, service communication and marketing permission separate. Apply the Privacy and Electronic Communications Regulations 2003 (PECR) and the ICO's current electronic-mail guidance, with publication-day legal review.
- Request security policy scope, access controls, encryption claims, recent assurance reports, incident history, recovery tests and dependency information. Compare them with the NCSC small-organisation controls, which do not certify the vendor.
Accessibility, rights and advertising
- Request current accessibility documentation for the actual editor, email, signup, checkout, account, cancellation and support journey. Test keyboard, focus, labels, errors, zoom, text alternatives and reading order in the configured service.
- Define ownership and licence for copy, templates, subscriber contributions, analytics, logos and generated assets. Check post-termination use and deletion.
- Separate supplier ad labels from the publisher's decision about whether content is marketing. CAP requires marketing communications to be obviously identifiable, and objective claims need their own substantiation.
- Trigger FCA review before any communication could invite or induce financial activity. Vendor approval does not authorise a financial promotion.
Support, failure and exit
- Ask for support channels, covered hours, severity definitions, response evidence, escalation, service-credit limits and continuity contacts. Treat uncontracted targets as aspirations.
- Define correction, withdrawal, subscription access, payment failure, refund, suppression and customer-notification routes. Name restart authority after an incident.
- Obtain export schemas for content, subscriber status, permissions, suppressions, payment references, invoices and analytics. Record API limits, format, cost, timing and fields excluded. Ask for CSV, JSON or XML with field definitions.
- Rehearse export, integrity check, controlled import, reconciliation and deletion with synthetic or specifically authorised records. Supplier documentation that an export button exists is not recovery evidence.
The procurement owner compiles the findings, but specialist gates remain independent. Privacy, PECR, consumer, advertising, FCA, accessibility, security, IP, employment, contract, accounting, tax and VAT reviewers each sign their own scope. Award remains on hold while a mandatory answer is absent, stale or tied to the wrong edition.
Before you act
- Verify the legal and trading identity that will contract, invoice and process data.
- Name the product, plan, region, enabled modules, integrations and excluded functions.
- Obtain the signed processor terms and sub-processor list.
- Request current accessibility documentation for the actual user journey.
- Define correction, withdrawal, subscription access, payment failure, refund, suppression and customer-notification routes.
- Rehearse export, integrity check, controlled import, reconciliation and deletion.
Common questions
What must be recorded for every item in the vendor audit?
Use one row per checklist item with owner, source, document date, edition, finding, gap, expiry and decision.
What evidence is required to verify the legal and trading identity?
Check the company number, registered address and group links against the register and the signed agreement.
What should be rehearsed to demonstrate a viable exit route?
Test a full export, integrity check, controlled import, reconciliation and deletion on synthetic records.
