The Australian marketing vendor due-diligence checklist.

Privacy + data handling

1. Privacy Policy aligned with Privacy Act 1988 (Cth) and APPs
2. Data residency declaration (preferably australia-southeast1 or equivalent for AI processing)
3. Sub-processor list (named providers like Google Workspace, Cloudflare, Xero, etc.)
4. Data Processing Agreement (DPA) available for execution
5. Breach notification commitment + notifiable data breach scheme (NDB) awareness

Security

1. Identity provider (Google Workspace SSO + Cloudflare Access for internal tools)
2. Encryption at rest + in transit declared
3. Access control documented per engagement (per-engagement client-data isolation)
4. Audit logging on access events
5. Incident response procedure with named escalation paths

AI governance

1. Documented AI Governance Policy
2. Statement on AI training data (no client-confidential data on general-purpose models)
3. Provenance metadata on AI-generated outputs (model + prompt + reviewer)
4. Human review gate before AI-generated content ships externally
5. Compliance review pipeline for AI-generated regulated content

Vertical-specific compliance

1. Healthcare: AHPRA review pipeline + named accountable reviewer
2. Consumer: Australian Consumer Law claim review
3. Industrial: Tier-1 procurement-claim review where applicable

Commercial transparency

1. Ad spend pass-through (no markup) on every engagement
2. Management fees disclosed as named line items on Xero invoices
3. Block Hours rate published
4. Month-to-month contract terms (no lock-ins)

Operational

1. Senior strategist on the engagement (same person from pitch to delivery)
2. Documented onboarding process (Day 0 to Day 30)
3. Reporting cadence documented (weekly + monthly + quarterly)
4. Long-tenure track record (multi-year average tenure on material engagements, ours is 47 months across 52 engagements)

Read more:

• Security & data vendor due-diligence (our pack) →
• AI Governance Policy →
• Privacy Policy →