Tools and providers
Creator discovery platforms vendor due diligence checklist
A creator discovery platforms vendor due diligence checklist for checking creator data, audience quality, platform access, campaign features and evidence.
Creator discovery platforms vendor due diligence should establish who supplies what, where each creator field came from and how the buyer can correct or remove it. Complete the checklist for one exact service edition and one England discovery task. For example, test finding creators in a defined topic area on Instagram, TikTok and YouTube, reviewing sourced follower, engagement and audience-demographic fields, then creating and exporting a shortlist. A non-compensating gate is a must-pass item: missing evidence means HOLD, and strengths elsewhere cannot make up for it.
What to take away
- Complete the checklist for one exact service edition and one England discovery task.
- A missing non-compensating gate produces HOLDresolve the evidence gap before signing or activating the service.
- Registration at Companies House is not evidence of capability, solvency or endorsement.
- Database access is not communication permission, so assess contact and promotion separately.
- Do not accept an accessibility statement as the only evidence of accessibility.
Identity and service boundary
- Record the legal entity, contracting entity, trading name, service, edition, UK availability evidence and configured purpose.
- Use Companies House information to check incorporated identity and filings only. Do not treat registration as evidence of capability, solvency or endorsement.
- Classify each functiondatabase, opt-in marketplace, workflow, affiliate service, talent management or managed agency. Identify underlying suppliers.
- Test the same discovery task on the exact editioncheck search and filters, creator lists, outreach workflow, campaign management, reporting and export. Keep evidence of what worked and any gaps; do not contact creators without separate clearance.
- Examples to assess include CreatorIQ, Traackr, Modash, Upfluence and HypeAuditor. Treat these as shortlist candidates, not recommendations, and verify each current service edition and UK availability.
Creator-data evidence
- List every field with definition, source, access permission, collection timestamp, refresh and intended use.
- For creator profiles, record follower counts, engagement rate and audience demographics with their definitions, dates, sources and status as reported, claimed, calculated or estimated.
- Mark creator claim, public observation, platform report, buyer input, calculation, inference and independent check distinctly.
- Screen for possible audience-quality or fake-follower concerns by reviewing available follower-growth and engagement patterns, repetitive comments and mismatches between available metrics. Record the evidence and refer concerns for review; do not treat one signal as proof of fraud or authenticity.
- For Instagram, TikTok and YouTube, document the data-access route and check the current platform terms and applicable API rules for the vendor’s collection, storage, display and reuse.
- Document correction, challenge, suppression, restriction, deletion and downstream propagation.
- Prohibit inference of age, residence, protected traits, interests, authenticity, suitability, authority, audience composition, reach or willingness.
The ICO's accuracy guidance supports source and status records and action on inaccurate data. It is under review following DUAA changes and does not validate supplier fields.
Privacy, roles and contact
- Map controller, joint-controller and processor decisions by operation, not by contract heading. Record the relevant UK GDPR and Data Protection Act 2018 roles and responsibilities for each operation.
- Obtain purposes, lawful-basis analysis, transparency route, recipients, retention, subprocessors, locations, transfer mechanism and model uses.
- Screen whether a DPIA is required before live processing. The ICO's DPIA page explains the likely-high-risk test and is marked under review.
- Assess research contact and later promotion separately under privacy and PECR. Database access is not communication permission.
Rights, children and advertising
- Obtain evidence for platform, database, copyright and creator-material permissions. IPO database-right guidance shows why access and reuse deserve their own analysis.
- Do not guess whether a creator is under 18. Define escalation, restricted access and safeguarding review for uncertainty.
- Require creator or representative authority, incentive records, claim substantiation, disclosure approval, monitoring, correction and withdrawal.
- Check campaign disclosure and advertising review against the CAP Code and relevant ASA guidance, as well as the CMA's brand endorsement guidance. Treat the CMA guidance as UK regulator guidance, not campaign clearance.
Security and accessibility
- Inspect configured permissions, privileged access, authentication, logs, alerting, incident evidence, backups, restoration and account recovery.
- Trace sub-suppliers that can access buyer or creator information. NCSC supply-chain guidance supports specifying security requirements and seeking evidence through contracts.
- Ask whether the vendor holds ISO/IEC 27001 certification or can provide a SOC 2 report, where relevant. Check the scope, date and exceptions; neither replaces review of the service's actual controls.
- Test the buyer task with keyboard, zoom and relevant assistive technology; record versions, defects and retest. Do not accept an accessibility statement as the only evidence.
Commercial, support and exit
- Leave price, VAT treatment, weights, liability, insurance and service thresholds blank until qualified review of a dated exact-edition quote.
- Once qualified review is complete, record currency, billing unit, period, eligibility, minimums, overages, implementation, support hours, renewal, cancellation and change notice.
- Define support event, clock, timezone, exclusions, evidence and escalation before setting a buyer threshold.
- Test export for fields, definitions, provenance, timestamps, corrections, suppressions and audit history. Require deletion evidence and retained-record justification.
Named privacy, PECR, safeguarding, IP, advertising, security, accessibility, commercial, procurement and tax reviewers should sign their own lanes. The checklist is evidence triage, not legal advice or a supplier recommendation.
Before you act
- Record the legal entity, contracting entity, trading name and edition.
- List every creator field with its source and intended use, including follower, engagement and audience-demographic fields.
- Check audience-quality signals and document any concerns without treating a single signal as proof of fraud.
- Verify the data-access route against applicable platform terms and API rules.
- Test search, lists, outreach workflow, campaign features, reporting and export on the exact edition.
- Map controller, joint-controller and processor decisions by operation under the UK GDPR and Data Protection Act 2018.
- Screen whether a DPIA is required before live processing.
- Test the buyer task with keyboard, zoom and assistive technology.
- Leave price, VAT, liability and thresholds blank until qualified review.
Common questions
What happens if a non-compensating gate is missing?
A non-compensating gate is a must-pass checklist item: evidence for other items cannot make up for a gap. The article states that a missing gate produces HOLD, so resolve the gap before signing or activating the service. The checklist is evidence triage, not legal advice or a supplier recommendation.
Can Companies House registration prove a vendor is capable or solvent?
No. The article says to use Companies House information to check incorporated identity and filings only. It adds that registration must not be treated as evidence of capability, solvency or endorsement. Identity checks and capability checks are separate tasks, and the latter need their own evidence.
Does database access give permission to contact creators?
No. The article says database access is not communication permission. It instructs buyers to assess research contact and later promotion separately under privacy and PECR. So a vendor's database access does not by itself authorise outreach, and each contact purpose needs its own lawful basis and transparency route.
