Vetting a marketplace agency: dossier, contract and tests

An agency that runs your marketplace seller software for you, maintaining listings and stock records on a marketplace account such as Amazon or eBay and handling order exceptions, holds real authority over your account. Before you hire one, vet it in three stages: a dossier that ties the agency's trading name to a legal entity and a service, a contract that allocates every duty, and an observed test on a fictional fixture rather than your live account. This page sets out each stage and the gates that must clear before the agency gets access. It names no agency and makes no judgement about any provider.

What to take away

The subject and the reviewer

The typical subject is an agency or managed provider contracted to maintain approved product and stock records and handle specified later order exceptions for one England seller's authorised marketplace account. Name it precisely: one service, one account, one contract.

The person who vets the agency should record their name, role, competence and independence. The agency dossier must connect trading identity to legal entity, service, contract party, staff access and subcontractors. Companies House register-search guidance can verify public register facts only. It cannot establish service quality, authority or capability.

Desk evidence to request

Open and date the agency's own service description, proposal, scope, contract, privacy terms, security material, accessibility evidence, support process, insurance evidence where relevant, correction route and exit plan. Record funding, referral fees, free work and affiliate relationships, including any commission the agency earns from software it recommends.

The contract dossier should allocate marketplace-account authority, product facts, safety evidence, listing approvals, customer communication, price changes, payments, refunds, disputes, tax records, data roles, incidents and credential removal. The ICO's controller and processor contracts guidance identifies data-contract subjects and is under review after DUAA changes. A qualified privacy adviser must assess the actual relationship.

NCSC supplier-assurance questions prompt examination of supplier governance, privileged access, incidents, recovery, offshoring and contractual matters. Ask for supporting records, not completed answers alone.

Keep an agency's own statements separate from your own records and independent authority material. A case-study page proves only what the agency states, not the client, configuration, result or permission to reuse details.

Customer ratings are not a substitute for the dossier. Do not contact or identify supposed clients without an authorised basis; ask the agency for references who have agreed to speak.

The observed test

If an agency passes desk admission, give it the same fictional fixture you would give any software route. Observe who approves an accepted or rejected product change, resolves conflicting stock, corrects total price, processes a cancellation and partial refund, handles a dispute, suppresses a product, honours tracking refusal, removes privileged access, rolls back, exports and restores records.

Record scripts, configuration, evidence IDs, deviations and hand-offs. Production listings, live orders, real payments, customer messages, personal data, penetration testing, service longevity and commercial outcomes stay outside the test unless later work is specifically authorised and documented.

Agency hand-offs need their own observations. Check whether the person receiving a failed product update can find the approved source evidence, whether access can be removed under your procedure, and whether you can continue the job after hand-back. These are fixture behaviours, not claims about normal staffing or service levels.

Specialist gates that must clear

OPSS product-safety guidance shows that safety responsibilities depend on the product and business role. GOV.UK online-selling guidance covers relevant information and ordering subjects. An agency action cannot transfer or settle the seller's legal position by itself.

Consumer, safety, privacy, accessibility, security, tax, marketplace authority, contract and exit decisions each need the named specialist. A single unresolved gate prevents release; no feature total can compensate.

When to hold, and what a decision covers

Hold the appointment while any stage is missing: no identified legal entity, an incomplete dossier, no agency evidence or observed test, or an open specialist gate. A hold says nothing about prices, staffing, customers, experience or suitability; it only records that the evidence is not yet there. A later decision must be confined to the exact agency service, people, contract and test date.

Record any later change as a new dated decision. Preserve the earlier evidence and note whether the subject, contract, personnel, marketplace permission or test result changed.

Before you act

Common questions

Why vet the agency rather than the software it uses?

Because the agency holds the authority: it approves listings, changes prices and touches refunds on your account. The software may be sound while the people, contract or access around it are not, so the dossier, contract and test all centre on the agency service itself.

What must the agency dossier connect?

It must connect trading identity to legal entity, service, contract party, staff access and subcontractors. The person vetting it should also record their own name, role, competence and independence. Companies House register-search guidance can verify public register facts only, not service quality, authority or capability.

What happens if an agency passes desk admission?

It receives the same fictional fixture used for other routes. Observers watch approvals, conflicting stock, price correction, cancellation and partial refund, disputes, product suppression, tracking refusal, access removal, rollback, export and restore. Production listings, live orders, real payments and personal data stay outside the test unless later work is specifically authorised and documented.