Reviews
How to audit a prospecting software vendor's security claims
A prospecting software security audit: check ISO 27001, SOC 2, Cyber Essentials and pen test evidence against UK GDPR, with a one week due diligence checklist.
What to take away
- A prospecting software security audit starts with a data map, not a feature list.
- Match each claim to evidencea data processing agreement, sub-processor register, or current certificate.
- Test lawful basis, breach notification and deletion promises against UK GDPR and PECR.
- Ask for security assurance by nameISO 27001, SOC 2 Type II, Cyber Essentials Plus and a penetration test summary.
- Check access control and encryption specificsMFA, SSO, role-based access, AES-256 at rest and TLS 1.2 or later in transit.
- Put notice periods, deletion deadlines and transfer mechanisms in the contract.
- Re-audit annually and after any breach, merger or major release.
Build a data map before you read the sales deck
Most buyers open the sales deck first. Start with your own data instead. List every field a tool would touch: names, work emails, phone numbers, LinkedIn URLs, and rep notes. Ask the vendor to mark which fields they store, enrich, or resell. Anything they cannot map is a gap you own.
Then request the sub-processor register. Enrichment providers, email verification services and cloud hosts all sit in the chain. The vendor should name each one and the country it processes in. A register that says trusted partners only tells you nothing.
Check the lawful basis claims against UK GDPR
Prospecting software often names legitimate interests as the basis for processing business contact data. That can work, but the vendor cannot choose it for you. Your organisation is the controller for the lists you build and the emails you send.
The ICO guide to the GDPR sets out the lawful bases and the rights people can exercise. Ask how the tool handles access, erasure and objection requests. A vendor that cannot delete a contact from its enrichment partners within a month is a risk.
If you sell to regulated firms, the guide to lead generation software for financial advisers covers consent and TPS screening in practice.
Put breach and retention promises in writing
The Data Protection Act 2018 frames UK breach reporting, so ask for the vendor's 72 hour notification process. Get it as a contract term, not a slide, along with the incident response service level and the escalation path to a named security contact. Then ask who tells your clients if the vendor itself is breached.
Article 32 of UK GDPR expects security matched to risk. Ask for specifics: AES-256 encryption at rest, TLS 1.2 or later in transit, multi-factor authentication on every admin account, single sign-on and role-based access control. Vague promises of enterprise-grade security are not evidence.
Cold email still falls under PECR, and the ICO direct marketing guidance explains consent and the soft opt-in rules. If the vendor sells scraped lists, the risk lands on you.
Turn B2B prospecting claims into evidence
| Claim | Evidence to request |
|---|---|
| ISO 27001 certified | Current certificate, scope statement and audit body |
| GDPR compliant | Data processing agreement, sub-processor list, retention schedule |
| Consent based data | Source of each record and the opt-in wording used |
| UK data residency | Named data centre locations and backup regions |
A claim with no document behind it is a marketing line. Ask for the current version, the date, and the scope covered.
Check the security certificates and assurance evidence
ISO 27001 shows an information security management system has been audited; ask for the current certificate, its scope statement and the audit body. A SOC 2 Type II report from an independent auditor covers security, availability and confidentiality over a period, so request the report and its period, not just the badge.
Cyber Essentials and Cyber Essentials Plus are the UK's National Cyber Security Centre backed baseline schemes, and Plus adds a hands-on technical assessment. A penetration test report or summary letter shows when an independent tester last examined the platform; ask for the executive summary, its date, and what was remediated.
Ask for the vulnerability disclosure policy or security page and the cadence of scanning and patch management. Then send a security questionnaire, whether a CAIQ, a SIG or your own, and read the answers against the certificates.
Example: reading a sub-processor list
A vendor sends a register with four entries: a cloud host in Ireland, an enrichment firm in the United States, an email verification tool, and a CRM connector. Two of those transfers leave the UK.
Ask for the transfer mechanism and the retention period for each entry: the UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. If the enrichment firm keeps records longer than your own policy, your deletion promise may be untrue.
A due diligence checklist you can run in a week
- Request the data processing agreement, sub-processor register and retention schedule.
- Ask for the security evidencean ISO 27001 certificate with its scope, a SOC 2 Type II report, Cyber Essentials Plus certification and the latest penetration test summary.
- Submit a security questionnaire covering access control, encryption, incident response and vulnerability management, and ask for the disclosure policy.
- Ask for the DPIA the vendor ran on its own enrichment pipeline.
- Submit an erasure request for a test contact and time the response.
- Check the vendor's ICO registration and Companies House filing history.
Work through the list before you sign, and keep the answers with the contract.
If your team needs to build these habits, the prospecting software skills forecast sets out what to train and review first.
For a worked view of how evidence is weighed, read why prospecting software agency reviews vary so much.
Common questions
Do I need a DPIA before buying prospecting software?
Often yes. If you enrich profiles at scale, a DPIA records risks and mitigations before go live.
What if the vendor will not name its sub-processors?
Walk away or push for a restricted contract. The list is a standard part of a data processing agreement.
Does a certification badge replace due diligence?
No. A certificate shows an audit took place, not how your data is handled. Check its scope and date.
How often should I re-audit a vendor?
Annually at least, plus after any breach, merger or major feature release.
