Customer success software vendor due diligence without the guesswork

What to take away

Start with the data map

Before you look at a single vendor demo, write down what customer data the platform will touch. Account health scores, support tickets, usage telemetry and renewal notes all carry different risk. The UK GDPR and the Data Protection Act 2018 set the framework for handling that personal data. The ICO's “Data protection by design and default” guidance expects privacy to be built in from the start, not bolted on after procurement.

Build a named shortlist

Potential customer success software vendors to assess include Gainsight, ChurnZero, Planhat, Vitally and Custify. This is a shortlist, not a ranking or a claim that the products are like-for-like; compare each against your use cases, integrations, data requirements and written proposal.

In many deployments, your business is the controller and the vendor the processor, but the roles depend on who determines the purposes and means of processing. That distinction shapes the contract. The controller is generally responsible for answering a subject access request, normally within one month under the UK GDPR, subject to permitted extensions and exceptions.

Check the security questionnaire

Send a standard questionnaire covering encryption, access control, penetration testing frequency and incident notification windows. Ask whether the vendor has an ISO/IEC 27001 certificate and a SOC 2 Type II report, and request the current certificate or report with its scope. Ask for a recent independent penetration-test report or executive summary, including the test scope and remediation status, not a marketing page. A vendor that cannot produce dated security evidence is a risk you are choosing to carry.

Ask where data is stored and which sub-processors are used, including where they process data. If personal data is transferred outside the UK to a country without UK adequacy regulations, ask which safeguard applies, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), and request the transfer risk assessment. For each UK organisation acting as a controller, check whether it is required to pay the ICO data protection fee and, if so, appears on the ICO's register of fee payers. Your legal team will want the processing details and transfer terms in the data processing agreement.

Test the integration claims

Most retention failures start with bad data, not bad software. Ask the vendor to show a live sync from your CRM, helpdesk and billing system. The HubSpot developer documentation is a useful reference point for the API documentation a foundational system may expose, but it does not prove that a shortlisted customer success platform integrates with your CRM. Require the supplier to demonstrate that connection with your stack.

If the vendor cannot demonstrate a working connection to your stack during the pilot, assume the integration will cost you internal engineering time.

Model the full cost

The licence fee is rarely the whole bill. Build a three-year model with implementation, data migration, training, admin seats and any contact-tier uplift. For example, a team paying £400 a month for 10,000 contacts could face a £9,000 annual increase if growth pushes it into a higher band, so ask for the band thresholds in writing. Request the same written quote from each shortlisted vendor, with licence, implementation, migration, training, support and usage-based charges itemised; treat the example figures here as a scenario, not a market price benchmark.

Compare vendors using the same assumptions for contacts, users, implementation and support, and ask how renewal pricing changes if usage grows. Get any proposed uplift caps and pricing protections in writing rather than relying on an indicative sales estimate.

Interrogate the roadmap

Ask what shipped in the last two quarters and what slipped. A roadmap full of AI features with no delivery dates is a warning sign. Request release notes for the past year and check whether the cadence matches your own change window.

The Salesforce autonomous customer self-service page shows how a CRM and service provider frames self-service; it is not evidence about a shortlisted customer-success vendor. If your team relies on self-service deflection, ask each supplier for equivalent evidence from live accounts.

Take references seriously

Ask for two customers of similar size and sector, and one that left in the past 18 months. Former customers are harder to find but far more informative. Prepare questions about onboarding time, support response and renewal negotiations.

If the vendor resists the churned-customer reference, treat that as an answer in itself.

Agree the exit before you sign

Confirm the export format, how long data remains available after termination and what transition support is included, including the number of support hours. A retention platform that holds your health scores should not be able to lock them away. Our customer success software selection checklist covers the contract clauses that matter most at this stage.

Common questions

How long should due diligence take?

For a mid-market platform, allow four to six weeks from questionnaire to signature. Compress it only if you have already run the same process for a comparable tool.

What is the biggest red flag?

A vendor that cannot name its sub-processors or produce a recent security test summary. Both are basic and both are usually available on request.

Do we need a pilot before signing?

Yes, for anything touching customer health data. A 30-day pilot with a defined success measure is cheaper than a failed rollout.

Who should sign off?

Customer success owns the outcome, but legal, security and finance each hold a veto. Get all three into the same review meeting before the contract goes to signature.