Vendor Onboarding: What Procurement Should Require From Web Agencies

Vendor onboarding requirements for a web agency should cover four things before any work starts: a data processing agreement, completed security answers, evidence of appropriate insurance, and an agreed policy for access to your systems. Collecting them after award, but before the agency touches production systems or personal data, protects the organisation without slowing the project. This article lists what to request, why each item matters, and what a good response looks like.

It picks up where selection ends. If you are still choosing a supplier, see our guides to running a web agency RFP and scoring proposals with a weighted framework.

Why onboarding matters more for web agencies than most suppliers

A web agency is rarely a passive supplier. During a typical project it may hold administrator access to your content management system, connect to your CRM, handle form submissions containing personal data, manage DNS records, and deploy code to your production hosting. Many breaches and outages involving websites start with an over privileged account, a forgotten staging environment or credentials shared by email.

Onboarding is the moment to set the rules while both sides are motivated to get started. Retrofitting controls six months into a project is much harder.

Vendor due diligence: the core document set

Vendor due diligence for a web agency does not need to match the depth applied to a core banking supplier, but it should be proportionate to the access and data involved. The table below is a practical starting list.

The data processing agreement

If the agency will see, store or process personal data on your behalf, a data processing agreement sets out the terms. Website projects touch personal data more often than people expect: contact form entries, newsletter lists, customer accounts on ecommerce sites, analytics identifiers and CRM integrations all count.

Which law applies

The UAE's federal Personal Data Protection Law is Federal Decree-Law No. 45 of 2021. Entities in the DIFC and ADGM operate under their own data protection regimes, and some sectors such as health and financial services have additional rules. The UAE government portal summarises the main laws, and the ADGM Office of Data Protection publishes guidance for ADGM entities. Implementing rules and dates can change, so confirm the current position with your legal counsel or the relevant regulator rather than relying on a summary.

What the agreement should cover

• The categories of personal data and the purposes the agency may use them for.
• Where data will be stored and processed, including any hosting or tools outside the UAE.
• Security measures the agency must maintain.
• Use of sub processors, such as hosting providers, email services or freelancers, and how you will be told about changes.
• Incident notification: how quickly and through which channel the agency must tell you about a suspected breach.
• Return or deletion of data at the end of the contract.
• Your right to ask for evidence of compliance.

If hosting location is part of your data position, our article on UAE region cloud hosting and data residency explains the options to discuss with the agency.

The security questionnaire

A security questionnaire turns general assurances into specific, checkable answers. Keep it focused on what a web agency actually does. Fifty pages of infrastructure questions written for a data centre provider will get copied answers.

Questions worth asking

1. Access control: do staff use individual named accounts, and is multi factor authentication enforced on code repositories, hosting and CMS admin accounts?
2. Credential handling: where are passwords and API keys stored, and how are they shared within the team?
3. Code management: is all code held in version control, with review before changes reach production?
4. Environments: how are staging and development environments protected, and are they ever loaded with real personal data?
5. Dependencies: how are plugins, libraries and platform updates tracked and applied?
6. Devices: are staff laptops encrypted and managed?
7. Incidents: who is the named contact, and what is the process if the agency suspects a compromise?
8. Personnel: how are joiners and leavers handled, and how quickly is access removed when someone leaves?

Certifications versus answers

Some agencies hold formal certifications such as ISO/IEC 27001 for information security management. Where a certificate is offered, check its scope: it may cover a head office but not the team doing your work. Where none is held, well evidenced answers to the questions above can still give a clear picture. Ask for the evidence, such as a screenshot of enforced authentication settings or a sample access review, rather than a yes or no.

Professional indemnity insurance and other cover

Professional indemnity insurance covers claims arising from errors or negligence in professional services, such as a defect that causes financial loss. Some buyers also ask for cyber liability cover, given that agencies handle data and access production systems.

What to request:

• A current certificate showing the insurer, the policy period and the type of cover.
• Confirmation that the cover applies to the entity you are contracting with.
• Notice from the agency if cover lapses or changes materially during the contract.

Set cover levels in proportion to the project and the contract's liability terms. Your insurance adviser or risk team is better placed than a generic checklist to say what level is appropriate.

Access policy: granting, reviewing and removing

The access policy is where onboarding has the most practical effect. Agree it in writing and apply it from the first day.

Principles to apply

• Named accounts only. No shared logins for the CMS, hosting, DNS or analytics.
• Least privilege. Give each person the lowest role that lets them do their work. Content editors do not need server access.
• Your ownership of accounts. Domains, hosting, analytics, tag managers and app store accounts should be registered to your organisation, with the agency added as a user. This avoids the common problem of a supplier owning the keys to your own platforms.
• Time limits. Elevated access for launches or migrations should be granted for a defined window and then reduced.
• Regular review. Agree how often access lists are reviewed, for example at each project milestone and at contract renewal.

Offboarding

Plan the exit at the start. When the contract ends, or when an individual leaves the agency, accounts should be removed promptly, keys rotated, and documentation, code and credentials handed over. Write these steps into the contract so they do not depend on goodwill at the end of the relationship.

A sequenced onboarding checklist

Ordering matters. Data and access controls should be in place before the first credential is issued.

1. Contract, statement of work and data processing agreement signed.
2. Security questionnaire returned and reviewed; follow up questions closed.
3. Insurance certificates received and filed.
4. Named team and subcontractors confirmed.
5. Accounts created under your ownership with agreed roles and multi factor authentication.
6. Kick off meeting covering communication channels, escalation contacts and incident process.
7. First access review date set in the project plan.

Hypothetical example: a retail group appoints an agency to rebuild its ecommerce site. Procurement collects the contract and insurance certificates in the first week, but IT security finds that the agency planned to copy the live customer database into staging for testing. The onboarding review catches this before any data moves, and the parties agree to use anonymised test data instead. Nothing about the project timeline changes, but a real risk is removed.

Working with Codeeo through onboarding

Codeeo works with procurement, legal and IT teams across the UAE as part of starting projects in website design and development, ecommerce, custom software and business systems, and dedicated developers and teams. With 200+ projects delivered across the UAE and the US and an office in Dubai, your team can meet ours in person to work through the onboarding pack. Contact Codeeo to discuss your vendor onboarding requirements before the project starts. For public sector buyers, our guide to government and semi government web projects covers the additional steps those entities often apply.