Tools and providers
Selecting creator discovery software: a manual baseline register and six independent gates
Select creator discovery software for one England brief: build a manual register first, then test candidates such as Aspire, GRIN and Traackr through six gates.
Selecting creator discovery software should begin with one owned task: build an auditable candidate register for a specified England campaign brief, without contacting creators. Start in a buyer-controlled spreadsheet. Software proceeds only if it can reproduce that register with better evidence and no failed control gate.
What to take away
- Start with a buyer-controlled spreadsheet register for a specified England campaign brief before considering software.
- Admit only a defined service with legal entity, edition, and documented UK availability, not a category-level answer.
- Keep privacy, safeguarding, IP, advertising, security, and accessibility gates independent; failure in one is not offset by success in another.
- Test the smallest reversible unit with synthetic data and no live creator contact or production account.
- Record unknowns rather than assigning a favourable score, and require named reviewers to sign their own gates.
Build the manual baseline register
The baseline is a spreadsheet the buyer controls, built for one England campaign brief. Software is judged against it, so every column is defined before any tool is opened. Fill it from public creator profiles only, with the fields below.
| Field | What it holds | Evidence kept |
|---|---|---|
| Handle and platform | Public profile name and the platform it sits on | Profile URL and capture date |
| Stated location | Location the creator states publicly | Claimed or verified flag, never inferred from images |
| Content topics | Topics the creator posts about | Dated post links |
| Audience facts | Figures the creator shares about followers | Source, definition, claimed or verified |
| Business contact | Public enquiry route | Where the route was found; no private channels |
| Exclusions | Reasons not to approach | Brief rule, safeguarding flag, conflict of interest |
| Correction route | How an error is fixed | Owner and date of the fix |
Write the acceptance record
Name the buyer unit, brief version, authorised users, eligible creator population, excluded uses and deletion date. Specify each necessary field and why it affects this decision. Do not infer age, residence, protected traits, interests, authenticity, representation, audience composition or willingness from a name, image, location or supplier score.
For every field, require source, access permission, definition, claimed or verified status, collection time, refresh rule and correction route. Individuals have the right to obtain rectification of inaccurate personal data under Article 16 of the UK GDPR, so each field needs a correction path. A fresh timestamp still does not prove the record is true or suitable.
Admit only a defined service
Ask for the legal and contracting entities, service name, edition, documented UK availability and configured purpose. State whether it is a discovery database, opt-in marketplace, workflow, affiliate service, talent-management route or managed agency.
Name the candidates you will test, for example Aspire, GRIN, Traackr and Klear, and test each as a named edition against the same register. Reject category-level answers. GOV.UK's company information service shows free details such as the registered address and date of incorporation. That confirms identity, not the product or its performance.
Request current documents for privacy roles, subprocessors, transfers, retention, model uses, security, accessibility, support, change notice, export and deletion. Leave price, VAT, weights, thresholds and service levels blank until an exact quote or contract records currency, unit, period, eligibility, edition and limits.
Keep six gates independent
Each gate has its own named anchor and its own reviewer. A pass in one lane never offsets a failure in another.
| Gate | Named anchor | Evidence to request |
|---|---|---|
| Privacy and PECR | UK GDPR, PECR regulations 6 and 22, ICO data protection fee | Roles, sources, purpose, transparency, subprocessors, transfers, retention |
| Safeguarding | The buyer's own under-18 rule | Handling of possible under-18 records, named safeguarding lead |
| IP | Database right under regulation 13 of the Copyright and Rights in Databases Regulations 1997 | Rights to the data resold, licence terms, export rights, creator material licence route |
| Advertising | CAP Code, joint ASA and CMA guidance | Authority, incentives, claims, disclosure |
| Security | Cyber Essentials, an ISO information security certificate | Certificates and their scope, configured access, logs, incident handling, recovery |
| Accessibility | WCAG 2.2 AA, section 29 of the Equality Act 2010 | Observed search, correction and export tasks |
Privacy and PECR
Regulation 22 of PECR applies to unsolicited electronic mail sent for direct marketing to individual subscribers. Regulation 6 bars storing or accessing information in a user's device without consent, which matters for any tracking in a tool.
Under the UK GDPR the controller is the body that determines the purposes and means of processing. A supplier statement cannot choose the buyer's lawful basis. Organisations that use personal information must pay the ICO data protection fee unless exempt, so check each party's fee status.
Safeguarding and IP
Safeguarding review addresses possible under-18 records without guessing age. IP review covers database access and creator material. A database right subsists in a database where there has been substantial investment in obtaining, verifying or presenting its contents, so ask what rights the supplier holds in the data it resells.
Advertising, security and accessibility
Advertising review checks authority, incentives, claims and disclosure against the advertising rules. GOV.UK's guidance for brands says businesses must take responsibility for ensuring paid-for endorsements are properly labelled as ads, in line with the joint ASA and CMA guidance.
Security review asks for Cyber Essentials or ISO information security certificate evidence and then checks configured access, logs, incident handling and recovery. Cyber Essentials is the minimum standard of cyber security recommended by the Government for organisations of all sizes.
Accessibility review observes actual search, correction and export tasks against WCAG 2.2 AA, the standard public sector bodies must meet. Section 29 of the Equality Act 2010 bars a service provider concerned with a service to the public from discriminating against someone requiring the service.
Test the smallest reversible unit
Prepare synthetic entries for an ordinary record, duplicate, stale item, conflicting sources, correction, suppression, rights withdrawal and deletion. Record input version, expected state, observed state, evidence and tester. Include keyboard-only navigation, zoom and assistive-technology checks appropriate to the users. Automated checks alone are not enough, so add manual tasks.
Use no live creator contact, personal data or production account. A passed synthetic case verifies only that configured behaviour on the test date. It does not establish lawful sourcing, complete coverage, authenticity, suitability or campaign effect.
Record the decision
Compare each admitted service with the manual register on identical fields.
Use the channel strategy to confirm where each field comes from. Compare task completion, provenance retained, corrections propagated, export integrity, access evidence, accessibility defects, unresolved risks and whole-life cost record. Record unknowns rather than assigning a favourable score.
Require named reviewers to sign their own gates and attach an evidence-expiry date. The quality checklist and the commercial contracts guide cover the record and the exit terms.
The selection remains HOLD if the supplier identity or edition is uncertain, a creator-data field lacks provenance, a specialist gate fails, the synthetic pack from the supplier comparison cannot be completed, or clean export and deletion are unproved. Choosing no new software is a valid conclusion.
Before you act
- Build the manual register for one England brief, with evidence kept per field.
- Write the acceptance record first, naming buyer unit and brief version.
- Admit only a defined service with legal entity and edition.
- Keep six gates independentprivacy, safeguarding, IP, advertising, security, accessibility.
- Test the smallest reversible unit with synthetic entries only.
- Record the decision with named reviewers and evidence-expiry date.
- Choose no new software if any gate fails or provenance is missing.
Common questions
What should a buyer do before contacting any creators or evaluating software?
Build an auditable candidate register for a specified England campaign brief in a buyer-controlled spreadsheet. Software proceeds only if, per the operations and delivery guide, it can reproduce that register with better evidence and no failed control gate. Do not contact creators during this initial stage.
Why must the six review gates remain independent?
Privacy and PECR, safeguarding, IP, advertising, security, and accessibility each address distinct risks. Failure in one lane is not offset by success in another. A supplier statement cannot choose the buyer's lawful basis, and each gate requires its own evidence and sign-off.
What does a passed synthetic test actually prove?
A passed synthetic case verifies only that configured behaviour on the test date. It does not establish lawful sourcing, complete coverage, authenticity, suitability, or campaign effect. Use no live creator contact, personal data, or production account during testing.
