Tools and providers
Part of Procuring corporate communications tools with a dossier before a shortlist
Corporate communications best tools: what to ask each vendor to prove
Corporate communications best tools, function by function: ten named products, the evidence each vendor still owes and a fixture test before you sign.
What to take away
- No tool is ranked first, second or otherwiseevery candidate named below fails at least one hard gate until its evidence is on file.
- Each function has its own missing proof, so ask each vendor for that specific record, not for a general demonstration.
- Gates come before preferencelegal identity, privacy, security, accessibility and exit.
- A name enters the shortlist only when a repeatable fixture passes and the dossier closes.
- If you need a tool this quarter, buy the narrowest single job as a paid pilot, not a suite.
Six functions, ten names
Each product type has one gap its vendor must close with evidence, not a brochure. The table pairs six functions with the ten names that came up and the proof still missing for each.
| Function | Candidates | Evidence still to request |
|---|---|---|
| Publishing and CMS | WordPress VIP | Publishing states, preview, rollback, permissions |
| Employee communication | Staffbase, Firstup | Delivery evidence kept apart from readership claims |
| Email and contact handling | Mailchimp | Recipient provenance, message purpose, PECR review |
| Media monitoring | Cision, Meltwater, Brandwatch | Collection boundaries, account recovery, export |
| Research and workflow | Qualtrics | A record of approval, separate from survey participation |
| Incident and analytics | ServiceNow, Datadog | Alerts and measured events, kept as different records |
This is not a recommendation to buy six systems. A vendor that names every function still needs module-level proof, because a publishing claim says nothing about incident recovery.
What to ask for, function by function
Publishing and employee communication tools need proof of states and delivery. For WordPress VIP, ask how a post moves through publishing states, how preview and rollback work and who holds which permission.
For Staffbase and Firstup, ask for delivery evidence kept apart from readership claims. A count of people who opened a message does not show that the right people were sent it, so the record should hold both facts separately.
Mailchimp raises a different question: where did each recipient come from, and what was the message for? Ask for recipient provenance and message purpose, then put the campaign through a PECR review before any list is loaded.
Cision, Meltwater and Brandwatch need three answers: what the collection covers and excludes, how an account is recovered if its owner leaves, and how the data is exported. A team that cannot recover the account or export the data cannot leave.
Qualtrics is a survey platform, and survey participation is not an approval record. If a survey response is being used as sign-off on a message, ask where the actual approval is stored and who gave it.
ServiceNow and Datadog sit nearest incidents and analytics. An alert and a measured event are different records, so ask which the product keeps and how each is tied to a communications action.
The five gates every name must clear
Legal identity comes first. A Companies House register match establishes the stated filing facts only, and the register does not verify or validate what is filed. Match the trading name to the entity that will sign the contract.
Privacy comes second. If the tool touches personal data, the buyer must establish who is controller and who is processor, then examine the subprocessor chain. The vendor due diligence guide takes that from identity to a verified exit.
Security comes third. The NCSC's cloud security principles set out how to choose, configure and use cloud services securely. They are buyer questions, not product ratings.
Accessibility comes fourth. Evidence has to come from the task, not from a certificate. GOV.UK's guidance on publishing accessible documents is a method source, not a supplier award.
Exit comes fifth. Correction route, version export and data return at the end of the contract must be written into the terms before signature. The contract clauses worth reading twice decide whether you can actually leave.
The fixture that would admit a name
- Freeze the exact edition and written terms, with a date.
- Recheck UK availability for that service and that legal entity.
- Run a production-disabled fixture with synthetic contacts: publish, correct, export and delete a test item.
- Record tenant configuration, expected event, actual observation, reviewer and date.
- Repeat the fixture after any change to the version, the terms, a subprocessor or support.
A name enters the shortlist only when the fixture passes and the dossier closes. Until then the honest output is a hold, not a preference.
Checklist before you sign
- Edition and written terms frozen and dated.
- UK availability confirmed for the exact service.
- Controller and processor roles mapped, with subprocessors listed.
- Correction route and exit terms in writing.
- Security and accessibility evidence tied to the task.
If you need a tool this quarter
You do not have to wait for a complete dossier before making progress. Narrow the job to a single task, such as correcting a published notice or tracking mentions of your organisation. Run a paid pilot against that task, with a named exit date and a written decision rule.
Keep the manual route running until the pilot passes, then extend, replace or stop. The manual route stays the baseline, and our step-by-step costing method shows how to price it before you sign a licence.
Common questions
Why is no tool ranked first?
Ranking needs one shared measurement across candidates. Any order without a complete dossier and a hands-on test against the same task would be invented rather than observed.
What should I ask a vendor for first?
The record named against its function in the table: publishing states for a CMS, delivery evidence for employee communication, recipient provenance for email, and so on. If the vendor cannot supply it, the name stays on hold. If you are weighing several at once, shortlisting providers sets out how to score evidence without inventing an order.
What does security and accessibility evidence look like?
Security evidence should answer buyer questions of the kind the NCSC principles raise. Accessibility evidence should come from a task test rather than a badge.
