You found the right agency. The strategy deck was good, the pilot is approved, and then procurement sends a 47-page security questionnaire, and the deal sits for six weeks while someone figures out who owns the answers.

This is the pattern for any marketing agency selling into enterprise or upper mid-market accounts. The work itself is not the bottleneck. The vendor risk assessment marketing teams never planned for, is. This piece walks through what procurement actually asks, what a search and AI visibility agency handles in terms of data, and how to pre-empt the delays that kill deals between "yes" and a signed contract.

Why Marketing Agencies Now Face Security Reviews

Five years ago, a search agency could close an enterprise deal with a proposal and a handshake. That changed as marketing vendors started touching more first-party data, integrating with analytics platforms, and running AI tools that process client content at scale.

Enterprise procurement teams now treat marketing vendors the same way they treat any SaaS provider that touches company data. The marketing agency vendor security questionnaire has become a standard gate, not an edge case. If the agency cannot produce the right documents within a reasonable window, the deal either stalls or the budget moves to a vendor that can.

What Triggers The Review

The threshold varies by company, but the pattern is consistent. Any vendor that will access Google Search Console, GA4, CRM data, or customer lists will typically trigger a marketing vendor security review. Agencies running AI-powered workflows, where client data passes through third-party models or proprietary platforms, face additional scrutiny around subprocessor disclosure and data residency.

What Procurement Is Actually Evaluating

Procurement is not evaluating your SEO strategy. They are checking three things: whether you have a formal security programme with independent verification, whether you can document exactly what data you touch and where it goes, and whether your contracts include the right data processing terms for their regulatory environment.

SOC 2: What It Is And Whether Your Agency Needs It

SOC 2 is the most common certification enterprise procurement asks about. It is a framework defined by the American Institute of CPAs covering five trust service criteria: security, availability, processing integrity, confidentiality, and privacy.

There are two types. 

• Type 1 confirms controls were in place at a single point in time. 

• Type 2 confirms controls operated effectively over a sustained period, typically 6-12 months, with an independent auditor sampling evidence throughout. 

For any serious vendor risk assessment, Type 2 is the version that matters.

Required Versus Preferred

Agency SOC 2 is not legally required. It is a voluntary attestation. But in practice, enterprise buyers increasingly treat it as a prerequisite. The distinction between "required" and "preferred" on a procurement form often comes down to deal size and data sensitivity. For contracts involving access to customer PII, revenue data, or analytics platforms, SOC 2 Type 2 is effectively required. For smaller engagements with limited data access, procurement may accept alternative evidence like completed security questionnaires and a penetration test summary.

The honest read: if your agency regularly sells into accounts with formal procurement functions, SOC 2 Type 2 removes friction from every future deal. Without it, each new client triggers a bespoke review cycle that costs weeks. 

What Data Does A Search Agency Actually Touch

This is the question most agencies answer poorly, not because the answer is complicated but because nobody has mapped it. Procurement needs a clear data inventory, and vague language like "we access your analytics" does not pass review.

A typical SEO and GEO agency touches several categories of client data. These include Google Search Console query and click data, GA4 traffic and conversion data, keyword and ranking data tied to specific domains, CMS access for publishing and on-page changes, and, in some cases, CRM or revenue data for attribution reporting.

Documenting The Data Flow

The documentation that satisfies procurement is an agency data processing agreement, or DPA. This is a contract addendum that specifies what personal data the agency processes, the legal basis for processing, retention periods, subprocessor lists, and breach notification procedures. For clients operating under GDPR, the DPA also needs to reference Standard Contractual Clauses if data crosses borders.

The detection test for readiness: if your agency cannot produce a DPA template, a subprocessor list, and a data flow diagram within 48 hours of a procurement request, the review will stall. Pre-building these documents is the single highest-ROI compliance task a marketing agency can do.

How AI Tools And Subprocessors Change The Conversation

This is where marketing vendor security reviews have shifted most in 2026. Enterprise procurement now routinely asks whether client data passes through AI models, and if so, which ones, where the data is processed, and whether the model provider retains any training rights over the input.

For agencies running GEO and AI visibility workflows, this means disclosing every AI tool in the stack, from proprietary platforms to third-party APIs. Passionfruit's GEO service runs on its own platform, Passionfruit Labs, which means the subprocessor list is defined and controlled rather than assembled ad hoc from a rotating set of point tools.

What Procurement Expects To See

A current subprocessor list with the name, purpose, and data residency of each provider. A contractual commitment that subprocessors are bound by equivalent data protection terms. And a process for notifying the client before adding new subprocessors. If the agency cannot answer "which AI tools touch our data" with a specific list, the review will escalate.

What Typically Delays A Marketing Vendor In Security Review

The delays are predictable because the gaps are always the same.

The most common stall is not having a DPA ready. The second is not being able to name subprocessors. The third is not having any independent security verification, whether SOC 2, ISO 27001, or even a recent penetration test report.

The fix is preemption. Agencies that close enterprise deals consistently maintain a security package that can ship within two business days: a DPA template, a subprocessor register, a completed SIG or CAIQ questionnaire, evidence of independent security testing, and SOC 2 documentation if available. Our guide on questions to ask an SEO agency before hiring covers the operational readiness signals that separate agencies built for enterprise from those that are not.

Treat Security Readiness As A Growth Function, Not A Compliance Task

Security documentation is not overhead. For any agency selling into enterprise accounts, it is pipeline infrastructure. The deal that stalls in procurement for six weeks is the deal that loses executive sponsorship, gets re-scoped, or goes to the vendor who had the paperwork ready.

The first move is an internal audit: can you produce a DPA, a subprocessor list, and a completed security questionnaire within 48 hours? If the answer is no, that is the project before the next enterprise pitch. See how Passionfruit runs SEO and GEO as one managed programme with the operational and security infrastructure enterprise procurement expects, and talk to the team about what that looks like for your brand.

Frequently Asked Questions

Which Certifications Does Enterprise Procurement Require Versus Prefer?

SOC 2 Type 2 is the most commonly requested. ISO 27001 may appear for international accounts. Neither is legally required, but both are treated as prerequisites for contracts involving PII or analytics platform access. Smaller engagements may accept a completed security questionnaire and penetration test summary instead.

What Data Does A Search Agency Touch And How Should It Be Documented?

A typical agency accesses Search Console data, GA4 analytics, CMS platforms, and sometimes CRM data for attribution. Document it in an agency data processing agreement that specifies data categories, processing purposes, retention periods, subprocessors, and breach notification terms.

How Do You Handle A Security Review When AI Tools Are Involved?

Maintain a current subprocessor list naming every AI tool that touches client data, including purpose and data residency. Confirm contractually that subprocessors are bound by equivalent data protection terms. Notify clients before adding new subprocessors to the stack.

What Typically Delays A Marketing Vendor In Security Review?

Missing DPA templates, undefined subprocessor lists, and no independent security verification. Pre-building a security package that ships within 48 hours of request removes the most common delays.

Does A Marketing Agency Need SOC 2 To Work With Enterprise Clients?

Not in every case, but increasingly in practice. Agency SOC 2 Type 2 removes friction from procurement cycles and avoids bespoke reviews with each new client. Without it, agencies face longer sales cycles and may lose deals to vendors with documentation ready.