The signature file: due diligence for a B2B lead supplier

Definition

The final diligence boundary

Final due diligence starts after a lead-generation company has passed preselection. The buyer is no longer deciding which category looks attractive. It is testing whether one named supplier, one method and one contract can be operated safely and measured consistently.

The vendor preselection guide defines the earlier shortlist. This article closes the next decision. Its output is a signed evidence memo with one of three verdicts:

• sign, because all mandatory evidence and annexes pass;
• sign with named conditions, because a limited gap has an owner, deadline and contractual remedy;
• do not sign, because a critical claim, right, control or exit path cannot be verified.

A persuasive proposal is not evidence. A policy link is not evidence that the method is followed. A replacement promise is not evidence that a “lead” has a stable definition. Final diligence connects each claim to a dated document, a tested sample, a contract term and an owner.

Prerequisites

Before starting, name the expected outcome, owner, acceptable sources and stopping condition. Keep unknowns visible. Missing data is neither negative proof nor permission to invent a conclusion.

Steps

Step 1: open a bounded evidence room

Create one index for the exact supplier and service being purchased. Do not accept a folder full of undated marketing files. Every item should have a title, owner, version date, scope and status: accepted, rejected, expired or open.

Request only material needed for the decision. The core file normally includes:

1. contracting entity, authorised signatory and service scope;
2. current product or service description and all commercial schedules;
3. data-source register and example provenance record;
4. list of subprocessors and processing locations;
5. privacy, security and incident documents that actually apply to the service;
6. operating method, quality controls and change process;
7. a controlled sample and its result log;
8. proposed definition of an accepted lead or meeting;
9. price, credit, replacement and invoice rules;
10. export, handover, return and deletion plan.

Record the date each external source was checked. Attach a question log so a verbal answer becomes either a written contract clarification or an unresolved issue. Do not let the salesperson's assurance silently replace the supplier's legal or operating owner.

The NIST due-diligence quick-start guide treats due diligence as a structured assessment of supplier risk rather than a one-time collection of documents. For a small sales team, the practical lesson is proportionality: investigate the service, access and data actually in scope, then preserve the evidence behind the decision.

Step 2: verify the entity, service and claims

Match the proposal, order form, data-processing agreement, invoice entity, subprocessors and security documentation. If a parent brand sells the service but another entity processes the data, the roles and obligations must be explicit. Confirm which promises belong to the current paid plan, which require another provider and which are still planned.

Build a claim register with five columns:

Do not use a weighted score to hide a critical failure. Corporate identity, right to process, objection handling, security access and a workable exit are gates. A polished methodology cannot offset the absence of one of them.

Step 3: test a controlled sample

The sample is the bridge between sales claims and contract acceptance. Freeze the buyer's specification before the supplier produces it. Use a batch small enough for the team to inspect every record, while still containing realistic edge cases such as exclusions, subsidiaries, ambiguous roles, duplicates and stale information.

For each record, log:

• source and source date;
• account and contact matching evidence;
• required fields and missing fields;
• duplicate status;
• verification method and timestamp;
• exclusion and known-objection checks;
• qualification verdict: accepted, rejected or unknown;
• reviewer, review date and reason code;
• any change made by the supplier after review.

Separate two tests. The first tests data and qualification without sending. The second, only if authorised and necessary, tests the operating workflow with buyer-approved identities and limits. A supplier should not need unrestricted access or a live campaign merely to demonstrate record provenance and its acceptance logic.

Use pre-agreed arithmetic. Sample acceptance rate equals accepted units divided by all delivered units, not only the units the supplier calls reviewable. Report unknown and duplicate separately. A replacement changes inventory, but it does not erase the original defect from the quality result.

Step 4: define “lead” in a contract schedule

Never leave the billable unit inside a proposal paragraph. Put it in a signed schedule with entry evidence, exclusions and an acceptance process.

For a contact lead, define at least:

• named account and territory fit;
• relevant role or documented reason for inclusion;
• current source and collection date;
• required contact fields and verification rule;
• problem, event or selection reason when promised;
• duplicate window and matching fields;
• exclusions, objections and prohibited sources;
• permitted use and retention context;
• buyer acceptance window and reason codes.

For an appointment, add attendee identity, actual attendance, qualification evidence, required notes, rescheduling treatment and the stage that follows. A booked calendar event is not automatically an accepted meeting.

Define what never counts: a record already owned within the duplicate window, a person outside the role, an unverifiable source, a known objection, a meeting with no attendance or a unit missing mandatory evidence. Define unknown separately instead of allowing it to pass by default.

The schedule should also state who decides a dispute, what evidence controls, when the acceptance clock starts and how corrections work. Replacement may remedy an individual defect. Repeated failure above an agreed tolerance should trigger root-cause review, suspension or termination rather than endless substitutions.

Step 5: inspect the method, not only the output

Ask the supplier to walk one sample record from origin to delivery. The method description should show:

1. how accounts and people enter the process;
2. which sources are queried and under what authority;
3. where automation and human review occur;
4. how data is refreshed and conflicts are resolved;
5. how qualification rules are applied;
6. how duplicates and exclusions are checked;
7. how messages or actions are approved;
8. how outcomes, complaints and corrections return to the system;
9. which evidence appears in the buyer's export;
10. which changes require notice or revalidation.

Review failure modes. What happens when a source disappears, a verifier returns uncertainty, a subprocessor changes, a mailbox is blocked, a person objects or the buyer pauses work? The answer should be a runbook with an owner and trace, not “the platform handles it”.

Preserve method changes. If the supplier materially changes a source, scoring rule, sending system or human-review step, the contract should require notice and, where the change affects acceptance or risk, buyer approval or a new sample.

Step 6: assign data rights and responsibilities

Map roles by purpose. The same company may be a controller for its own database and a processor when executing the buyer's instructions. Do not label the supplier once for every activity.

For European processing, Article 28 as published by the CNIL requires the processor contract to describe the subject, duration, nature and purpose, data types, people concerned and each party's duties. It also covers documented instructions, subprocessors, assistance, return or deletion and audit information. The European Commission's guidance likewise requires sufficient guarantees and a contract or legal act when another party processes data on the organisation's behalf.

The final data schedule should resolve:

• purpose and legal role for every processing operation;
• source categories and notices;
• data fields and people concerned;
• documented instructions and prohibited uses;
• subprocessor names, locations and change notice;
• transfers and applicable safeguards;
• security measures and access roles;
• incident notice and cooperation;
• requests for access, correction, objection and deletion;
• retention, return, deletion and audit evidence;
• whether and how buyer data may be reused, aggregated or used to improve models.

For French professional email prospecting, the CNIL's current guidance requires information and a simple, free way to object, and the solicitation must relate to the person's profession when legitimate interest is used. For United States commercial email, the FTC's CAN-SPAM guide says business-to-business messages are covered and hiring a sender does not remove the promoted company's responsibility.

This article is not a legal opinion. The buyer should have qualified counsel resolve the actual roles, countries and channels before signature.

Step 7: verify identities and operating controls

List every domain, inbox, social account, API key, CRM connection and shared file the supplier may touch. For each asset, record owner, administrator, permitted action, access method, audit source and revocation procedure. The buyer should control recovery for assets that represent its brand or hold its commercial history.

For email, inspect authentication, bounce treatment, complaint monitoring, suppression, send limits and stop controls. Google's current Gmail sender guidelines require authentication for senders to personal Gmail accounts and add further requirements for senders over 5,000 daily messages, including DMARC alignment and one-click unsubscribe for relevant marketing traffic. Do not accept a guaranteed deliverability percentage in place of these controls.

Run three tabletop tests before signature:

1. a prospect objects and must disappear from all active work;
2. the supplier detects a wrong source or material data defect;
3. the contract ends today and all access must be revoked.

The supplier should identify the person, system, log and contractual obligation involved in each test. If the answer depends on one employee's memory, the control is not ready.

Step 8: reconcile price with acceptance

Rebuild the commercial model from the contract, not the proposal headline. Include setup, retainer, platform, data, enrichment, domains, mailboxes, sending, integrations, human review, minimums, overages, credits, replacement work and termination fees.

Tie invoices to explicit events. If the unit is an accepted lead, define whether rejected, duplicate, unknown, corrected or replaced units are billable. If the service is a retainer, define the capacity, deliverables, review rights and work that continues during a pause. If a meeting is billable, define attendance and qualification separately.

Calculate three buyer scenarios: expected operation, lower acceptance and early exit. Include internal review and follow-up time. There is no universal acceptable cost per lead or meeting. The useful comparison is total cost per accepted unit that progresses under the buyer's own definition.

Step 9: make the exit clause operational

Write the exit as a runbook attached to the contract. It should cover ordinary termination, material breach, security incident, repeated quality failure and supplier insolvency where relevant.

At minimum, define:

• notice, renewal and termination dates;
• export scope, format, deadline and responsible owner;
• ownership and handover of domains, inboxes, accounts, copy and research;
• open leads, scheduled meetings and pending follow-ups;
• suppression and objection data needed to prevent recontact;
• revocation of users, tokens, integrations and credentials;
• return or deletion of buyer and prospect data;
• deletion confirmation and lawful exceptions;
• subprocessor handling and backup lifecycle;
• transition assistance, price and duration;
• obligations that survive termination.

The CNIL's processor security guidance specifically calls for contract conditions governing the return and destruction of data at the end of the relationship. Test a sample export before signing. A promise to export later is not enough if field definitions, evidence history or suppression status are missing.

Decision criteria

Sign only when all mandatory items are closed:

1. The legal entity, service scope and current plan match across documents.
2. Every material supplier claim has dated evidence and a buyer test.
3. The controlled sample uses the same rules that will govern production.
4. Lead, meeting, duplicate, unknown, rejection and replacement are defined.
5. Data roles, sources, subprocessors, transfers and rights are resolved.
6. The operating method exposes human steps, automation, changes and failures.
7. Brand identities, credentials, objections and stop controls have named owners.
8. Commercial charges reconcile with acceptance and lower-performance scenarios.
9. The exit has been tested with an export and access-revocation walkthrough.
10. Open conditions have an owner, deadline, remedy and signing authority.

Do not sign if a critical item is merely “to be agreed after onboarding”. Onboarding executes the contract. It should not define the buyer's basic rights after commitment.

Worked example

Worked example: a conditional sign becomes a no-go

A six-person B2B software team has preselected an appointment company. The supplier claims verified contacts, qualified meetings and a simple monthly exit.

The controlled sample contains 30 records, an illustrative size chosen because the buyer can inspect every one. Twenty pass the account and role rules, four are duplicates, three have no reproducible source and three remain unknown. The supplier initially reports 20 out of 23 because it removes duplicates and unknown records from the denominator. The buyer's schedule reports 20 out of 30 and preserves every reason code.

The supplier corrects the sample and accepts the denominator. The parties then test the exit. The supplier can export contact fields but not source history or the suppression list, and it owns the mailboxes used for sending. Its proposed deletion language does not name backup treatment or a confirmation owner.

The decision is not rescued by the sample acceptance rate. The buyer issues a conditional sign memo requiring buyer-owned mailboxes, a complete export, suppression transfer, backup treatment and deletion confirmation. The supplier refuses the mailbox and suppression changes. The final verdict becomes do not sign because identity control and safe exit are critical gates.

Common mistakes

Common mistakes include confusing activity with progression, turning an unknown into certainty, changing several variables in one test and postponing an action without revisiting its reason. Each mistake should leave a visible correction.

Tools

In Ember, Lead Intelligence prioritises opportunities from the available context. It classifies accounts into explained opportunities to watch, act on or set aside. It proposes the next action and channel that fit the lead situation. These capabilities support the method but do not prove buyer intent, consent, budget or an outcome.

Where Lead Intelligence fits

Those capabilities can help a buyer inspect priority reasons, sources and next-action decisions during a sample. They do not perform legal due diligence, certify another supplier, replace the signed lead definition, own the buyer's contract decision or guarantee a commercial outcome.

When to use this method

Use this method when several options appear plausible, evidence is scattered or the team must explain why one action comes before another. It is most useful for decisions that can be reviewed against an observable result.

When not to use it

Limits

The method cannot prove future performance. It tests whether current claims, controls and terms are coherent and reproducible. A supplier can pass diligence and still underperform because the buyer's market, offer or follow-up is weak.

Finally, a sample is not permission to launch. Any live processing or outreach still requires the buyer's authority, applicable notices, channel controls and agreed limits.

Action plan

Start with a small set of records. Apply the same decision contract, record exceptions and review outcomes on the chosen date. Keep what remains reproducible, change one rule at a time and explicitly close actions that no longer produce useful learning.

Ember data

No approved first-party aggregate dataset was supplied for this article. The method therefore makes no quantitative product performance claim. Product statements remain limited to published product context, and the team must measure effects on its own records and decisions.

Sources and methodology

External sources are listed with their URLs to separate published facts from editorial recommendations. They frame the method rather than promise a universal outcome. Assumptions and limitations remain identified in the article.

• NIST Cybersecurity Supply Chain Risk Management Due Diligence Assessment Quick-Start Guide
• CNIL publication of GDPR Chapter IV and Article 28
• CNIL security guidance for managing processors
• CNIL guidance on commercial prospecting by email
• FTC CAN-SPAM compliance guide for business
• Google email sender guidelines
• European Commission guidance on appointing a data processor