Build a Due Diligence Evidence Room for LinkedIn Outreach Provider Selection

Start with an evidence room, not a feature comparison. A provider can describe its process well and still leave the buyer without proof of who operates accounts and handles personal data, or what happens when an operating control fails.

The evidence room is a controlled index of questions and files. It separates a current answer from a promise, gives legal and security, plus procurement and the business owner the same record, and makes the selection decision reviewable.

• Create a question register before requesting files.
• Set one owner for each review lane.
• Record gaps before commercial terms are negotiated.
• Keep the selected provider's final evidence set with the signed agreement.

What belongs in a provider evidence room?

Use one row per question. The row should point to the specific file, plus its version and issuer; record its date. A sales deck can explain a service, but it is not automatically the authoritative document for privacy and insurance, along with staffing or incident handling.

For LinkedIn outreach, identity and account practice deserve a dedicated lane. LinkedIn's User Agreement says members may have only one account in their real name and must not share or transfer an account. Its Professional Community Policies also prohibit creating a profile for someone else or using another person's account.

Which identity and account questions must be answered?

Ask who will access each profile and what authority they have, how access is granted or removed, and whether the provider's operating model requires account sharing or profile creation for another person. Require a written operating description and a named accountable owner.

A provider should explain how it keeps profile information truthful and how it prevents unauthorized access. LinkedIn says members are responsible for protecting their accounts and should not share their account with anyone else. Treat any answer that depends on shared credentials or another person's account as a selection block.

• ID-01: Who is the account holder for every profile used?
• ID-02: Which people can access the profile, inbox, and connected systems?
• ID-03: What process removes access when a worker or contract ends?
• ID-04: Does any workflow depend on credential sharing, account transfer, or a profile created for someone else?

Which privacy and security documents are authoritative?

Ask for the provider's current privacy notice and data-processing terms, a data map and subprocessors list, an incident process and retention schedule, and the contract terms proposed for the engagement. The authoritative document is the current signed or publishable version, not a verbal answer.

The European Commission describes the GDPR as part of the EU data-protection legal framework and says it applies across the EEA. The European Data Protection Board's final Guidelines 07/2020 address the concepts of controller and processor. Use counsel to decide the role allocation and contract language for the actual processing arrangement.

Security evidence should describe control ownership and review dates, including exceptions. NIST frames cyber supply-chain risk management as identifying and assessing risks, then mitigating them across a technology supply chain's life cycle. That is a useful structure for asking what the provider handles from receipt through deletion.

• PRIV-01: What personal data enters the service, from whom, for what purpose, and in what form?

• PRIV-02: Which party determines the purpose and means of processing for each activity?
• SEC-01: What access controls and logging, together with what incident process, apply to systems holding client or prospect data?
• SEC-02: Which subprocessors receive data, and how are changes disclosed?
• PRIV-03: What retention and deletion commitments apply when the agreement ends?

What operating evidence separates a real process from a pitch?

Request the current operating manual for targeting and comment review, connection requests and reply handling, escalation and reporting, quality review, and offboarding. Ask which steps are performed by people or supported by systems, and who owns exceptions.

LinkedIn's Professional Community Policies say not to spam members or the platform, use invitations for promotional messages to people you do not know, or artificially increase engagement. The provider's operating evidence should show how it keeps outreach targeted and relevant, while remaining professional and subject to review.

For a service that reports booked calls, reply rate, or a unified inbox, require a metric definition alongside a sample report. A number without a denominator, period, owner, and source system cannot be reviewed.

• OPS-01: Show the documented review path for outreach copy and replies.
• OPS-02: Define each reported metric and identify its source system.
• OPS-03: Show the escalation path for complaints, inappropriate messages, access issues, and suspected incidents.
• OPS-04: Show the quality-review cadence and sample-size policy, plus the corrective-action record.
• OPS-05: State how work is handed back at the end of the engagement.

Which gaps block selection and which become contract conditions?

Block selection when the provider cannot document lawful account handling, cannot identify who accesses client or prospect data, or both name the entity contracting with you and produce current terms for material privacy and security obligations. These are missing foundations, not minor paperwork.

Use contract conditions for evidence that exists but needs a sharper commitment. Examples include a scheduled subprocessor update and named incident-notice route, a reporting definition and removal-of-access deadline, or a required insurance certificate before service starts.

Do not accept a future document without a disposition. Record the exact gap and document needed, the owner and due date if agreed, and whether the agreement may start before the gap closes.

• Selection block: missing evidence for identity and account access, or the contracting entity and material data handling.
• Remediation before start: an incomplete but plausible document set with a defined owner and deadline.
• Contract condition: a verified control that needs a binding cadence and notice requirement, plus a remedy.
• Accepted exception: a documented, approved exception with scope and expiry, with an accountable owner.

How should the review end?

Hold one decision review with the completed index. Each question should be marked verified, gap, exception, or not applicable. Do not collapse unresolved items into a generic risk note.

The selection record should name the provider and version of the evidence room reviewed, all open conditions and approving owners, and the next review date. That record gives the operating team a clean handoff and gives procurement a way to test whether pre-contract promises became obligations.