Choosing a White-Label Platform Partner: Questions to Ask

Choosing a white-label platform is closer to choosing a business partner than buying a tool. Your clients will experience the provider's uptime, security and support as yours, and leaving later can be slow and expensive.

The questions below are organized around the areas that most often cause trouble after a contract is signed: data, availability, support, security, branding and commercial terms. They draw on guidance from the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA).

This is general information, not legal advice. Have an attorney review any agreement before you sign it.

Start with due diligence, not demos

Demos show what a platform does on a good day. Due diligence is about what happens on a bad one. NIST's Cybersecurity Framework 2.0 includes this outcome for supplier relationships: "Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships." It also calls for requirements to be "established, prioritized, and integrated into contracts and other types of agreements with suppliers."

Before talking to providers, write down your own requirements: the client types you serve, the data you will store, the messaging channels you need, and what you plan to promise clients. Then evaluate each provider against that list.

Data ownership and export

Ask:

• Who owns the data your clients put into the platform, and does the provider claim any right to use it?
• Can you export each client's data in full, in standard formats, at any time, without a support ticket?
• What is included in an export: contacts, conversation history, files, notes, consent and opt-out records, automation settings?
• How long is data kept after cancellation, and can you request deletion sooner?

NIST's public cloud guidance (SP 800-144) describes what an ideal contract says about ownership: "that the organization retains exclusive ownership over all its data; that the cloud provider acquires no rights or licenses through the agreement, including intellectual property rights or licenses, to use the organization's data for its own purposes." It adds that these terms "must not be subject to unilateral amendment by the cloud provider."

Exports are not the same as portability. NIST's cloud synopsis (SP 800-146) cautions that "formats for exporting and importing data may not be fully compatible among SaaS clouds," and that customized workflows, business rules and settings "can also be provider specific and not easily transferable." The same document, reviewing typical terms in 2012, found that when access is terminated for cause, such as nonpayment, most providers state they have no obligation to preserve remaining data.

Uptime and service level agreements

Ask:

• Is there a written service level agreement, and does it apply to partners like you?
• How is availability measured, and what counts as "down"?
• What is excluded, such as scheduled maintenance or third-party carrier outages?
• What remedies apply if targets are missed, and how do you claim them?
• Is there a public status page, and how are partners notified of incidents?

The details matter. SP 800-146 explains that availability is often measured in time intervals, and gives this example: "if a provider specifies an availability interval of 15 minutes, and the service is not functional for 14 minutes, 100% availability is preserved using this metric." It also notes that unless an agreement is negotiated, "remedies for any failures are likely to be extremely limited."

CISA's advisory for managed service provider customers recommends confirming "how and when MSPs notify the customer of an incident affecting the customer's environment." That question belongs in any platform evaluation.

Support

Ask:

• Who supports whom? Does the provider support only you, or also your clients directly?
• What hours, channels and response targets apply, and are they in writing?
• How are urgent issues escalated, especially outside business hours?
• Is there partner training, documentation you can rebrand, and a sandbox for testing?

Your clients will judge you by response time. Make sure your own support promises fit inside the provider's.

Security

Ask:

• Is multi-factor authentication available for every user, including client users, and can you require it?
• Are access logs available to you, and for how long?
• How are backups handled, and how often are restores tested?
• Has the provider undergone independent assessments, such as a SOC 2 examination, and can you review the report under a nondisclosure agreement?
• How do they isolate one tenant's data from another's?

The AICPA describes SOC 2 reports as covering controls at a service organization "relevant to security, availability, processing integrity, confidentiality, or privacy." Ask which of those categories a provider's report includes and what period it covers.

CISA's Secure by Design initiative calls for products to include "multi-factor authentication (MFA), logging, and single sign-on (SSO) available at no extra cost." Its managed service provider advisory recommends that customers' contracts "mandate the use of MFA" and "include backup services that meet their resilience and disaster recovery requirements."

Branding and the client experience

Ask:

• Which surfaces can you brand: login domain, app, emails, mobile app, help center, invoices?
• Where might the provider's name still appear, such as system emails, app store listings or payment descriptors?
• Does the provider ever market directly to your clients?
• Can you control which features each client sees?

Contracts and commercial terms

Ask:

• What are the term length, renewal and cancellation terms?
• How much notice is given before price changes or feature removals?
• Are there minimum commitments or volume requirements?
• What happens to your clients if the provider is acquired, changes direction or shuts down?
• What limits on liability apply, and do they match the risks you are taking with client data?

NIST's framework also looks past the end of the relationship. CSF 2.0 calls for plans that "include provisions for activities that occur after the conclusion of a partnership or service agreement." SP 800-144 adds that, regardless of the type of service agreement, "obtaining adequate legal and technical advice is recommended to ensure that the terms of service adequately meet the needs of the organization."

Key takeaways

• Write your own requirements first, then evaluate providers against them rather than against their demos.
• Get data ownership, full export and deletion terms in writing, and test an export before you commit.
• Read how uptime is measured and what remedies exist, not just the headline number.
• Confirm MFA, logging, backups, incident notification and independent assessments.
• Plan for the end of the relationship before it begins, and have counsel review the agreement.

Sources

• National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)
• National Institute of Standards and Technology, SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing (December 2011)
• National Institute of Standards and Technology, SP 800-146: Cloud Computing Synopsis and Recommendations (May 2012)
• Cybersecurity and Infrastructure Security Agency, Protecting Against Cyber Threats to Managed Service Providers and their Customers, AA22-131A (May 11, 2022)
• Cybersecurity and Infrastructure Security Agency, Secure by Design
• AICPA & CIMA, System and Organization Controls: SOC Suite of Services