Seven checks for shopping feeds vendor due diligence

What to take away

Most teams start with a feature list and a price. The costly mistakes sit in contracts, data handling and exit terms, and they surface months after go-live.
Ask for the security annex, the data processing agreement and the sub-processor list before any commercial conversation. Hesitation is an answer.
Confirm who owns the feed mappings, taxonomy and historical performance data when the contract ends.
Test the supplier's data quality on your own catalogue, not their demo data.
Set a decision date and a walk-away price before the first call.

Who owns the feed mappings

This question decides how painful a future migration will be. Feed mappings, category rules, title formulas and exclusion lists are operational assets. They should be documented, exportable and yours.

Feed Mapping Ownership Checks

Feed mappings documented and exportable
Category rules owned by you
Title formulas exportable
Exclusion lists exportable
Sample export requested
Mappings not trapped in supplier interface

Ask for a sample export. If mappings exist only inside the supplier's interface, you are renting your own trading logic. A short shopping feeds software selection in England process helps you score that before shortlisting.

Contract and pricing checks

Read the order form, not just the proposal. Look for auto-renewal windows, notice periods and channel-based fee changes.

Contract and Pricing Checks

Read order form, not just proposal
Check auto-renewal windows
Check notice periods
Check channel-based fee changes
Confirm SKU definition
Ask for worked example at current volume
Ask for worked example at twice volume
Confirm mid-month overage handling

Check the definition of a product SKU. Some suppliers price per SKU per channel, which doubles the bill when you list on a second marketplace. Ask for a worked example at your current volume and at twice that volume.

Confirm what happens if you exceed a usage tier mid-month. Surprise overage invoices are a budgeting failure, not a technical one.

Data protection and customer data

Any supplier touching customer records needs a lawful basis and a signed data processing agreement. The data protection principles set out by the ICO require personal data to be adequate, relevant and limited to what is necessary.

Ask where data is stored, which sub-processors are used, and how deletion requests are handled. Get the retention period in writing. If the supplier cannot name every sub-processor, pause.

Shipping and returns data

Feed accuracy depends on delivery promises. Google Merchant Centre requires accurate shipping settings, and its guidance on adding shipping information explains what must be supplied.

Ask how the supplier pulls shipping rates and cut-off times from your systems. Manual maintenance here creates mismatches and disapproved listings.

API and integration access

Confirm which APIs you get, at what rate limits, and whether access survives a downgrade. For paid search work, the Microsoft Advertising API documentation shows the endpoints and versioning a supplier should support.

Ask for a sandbox, then test a bulk update, a failed update and a rollback. A supplier that cannot demonstrate error handling hands you the problem later.

Proof of delivery and references

Request two references from businesses of a similar size and sector. Ask about support response times and what broke in the first ninety days.

If a supplier will not provide references, ask for a paid pilot instead. A four-week pilot on one channel is cheaper than a year you regret. Our shopping feeds tools and supplier guide for 2027 sets out the wider selection criteria to pair with this checklist.

Exit and portability terms

Agree the exit before you sign. Cover notice periods, export formats, transition support and any early termination fee.

Ask for the final export in a machine-readable format, and confirm how long the supplier keeps your data afterwards. If migration support is chargeable, get the rate card now rather than at renewal.

Glossary

DPA: data processing agreement between controller and processor.
Sub-processor: a third party the supplier uses to handle your data.
Rate limit: the maximum number of API calls allowed in a period.
Sandbox: a test environment that mirrors production.
SKU: stock keeping unit, a distinct sellable product variant.

Common questions

How long should due diligence take?

For a mid-market retailer, two to four weeks is realistic if you request documents at the first meeting. Anything under a week usually means skipping the security and exit checks.

Do I need a pilot before signing?

Not always, but a pilot is the cheapest way to test data quality, support response and API behaviour. Put written success criteria in the pilot agreement.

What should trigger a walk-away decision?

Refusal to sign a data processing agreement, refusal to document sub-processors, or mappings that cannot be exported. Any one is enough to stop.

Who should be in the review group?

Bring operations, finance and whoever owns customer data. A procurement-only review misses the operational risks that bite after go-live.