
Tools and providers
Part of PR tools and providers for agencies: a 2027 guide to workflow fit and data provenance
Selecting PR software against the present method, with firm no-go gates
A practical method for selecting PR software in England, using a defined workflow, manual baseline, evidence requests, test cases and firm no-go gates.
PR agencies software selection should begin with an awkward work event, not a feature catalogue. For an agency serving an organisation in England, use a case such as correcting an approved statement after a pitch was queued. The buyer can then see whether its current inbox and register already provide enough control.
This method was assembled on 6 September 2026. No product or price comparison is offered here, so readers seeking a product shortlist should look elsewhere.
The piece names no preferred supplier and contains no product test. Pass thresholds and scoring weights depend on the buyer's harm assessment, contract value and sector rules; the buyer sets them.
What to take away
- Start software selection with a real work event, not a feature catalogue, to test control.
- Document the manual method as a genuine candidate and compare it on safety and reliability.
- Ask suppliers for dated certification scope, expiry and field-level contact-data sources.
- Test the whole decision path with synthetic data, including leaver accounts and failed integrations.
- Judge privacy, security and accessibility on separate lines, with no offsetting between them.
Write the service boundary
State which work the proposed system may perform. A useful boundary might include storing authorised contact records, recording provenance, managing an approval state, sending a permitted pitch, logging an objection and exporting the file at exit. Exclude monitoring, press-release distribution, social publishing and generative drafting unless the buyer has separately evidenced those needs.
Service boundary: include vs exclude
Include
- Contact records
- Store authorised
- Provenance
- Record
- Approval state
- Manage
- Pitch sending
- Permitted only
- Objections
- Log
- Exit
- Export file
Exclude
- Contact records
- Monitoring
- Provenance
- Press-release distribution
- Approval state
- Social publishing
- Pitch sending
- Generative drafting
- Objections
- Un-evidenced needs
- Exit
- Hidden copies
List the people too: buyer, contracting entity, agency user, client fact owner, approver, supplier, subprocessor, media contact and security administrator. The ICO's controller and processor guidance bases the roles on who decides purposes and means. A reseller label or supplier diagram cannot settle the allocation for the buyer's use.
Compare against the present method
Document the manual route as a genuine candidate. Record where the contact came from, who can open the file, how approval is captured, how a correction reaches saved lists, how an objection blocks a send and how records leave the agency.
Put blank cells beside four measures: staff time in minutes per action, delay in working days, error counts, and recovery effort in hours. Error counts include sends that ignore an objection and corrections made after a pitch has gone out. A cell stays blank until dated evidence fills it.
Worked example: a pitch is queued for a client contact. Before it sends, the fact owner corrects a statement in the approved briefing note.
On the manual route, the buyer times how long the correction takes to reach the queued send and counts the saved lists that still hold the old wording. That baseline shows whether the fix reached the queued item, every saved list and the people who had already acted on it.
Manual route vs software option
Manual route
- Contact origin
- Recorded
- File access
- Who can open
- Approval
- Captured
- Correction
- Reaches lists
- Objection
- Blocks send
- Exit
- Records leave
Software option
- Contact origin
- Field-level sources
- File access
- User controls
- Approval
- Approval state
- Correction
- Update routes
- Objection
- Suppression
- Exit
- Permitted exports
A software option advances only if it solves a defined failure more safely or reliably. Convenience is not enough where a product creates a second copy of personal data or hides the evidence needed for an exit.
Ask for inspectable evidence
Turn each requirement into a supplier request:
- a current product and edition description;
- the proposed contracting entity and governing documents;
- field-level contact-data sources and update routes;
- controller, processor and subprocessor allocations by activity;
- user, administrator and audit-log controls;
- accessibility evidence for the actual interface;
- permitted exports, formats, deletion and retention after termination;
- support, incident and material-change procedures.
The NCSC's cloud-provider guidance distinguishes an unsupported promise from higher-confidence assurance. Match the evidence depth to the harm that disclosure, loss or outage could cause. Certification scope and expiry matter; a logo alone does not establish that the purchased service or configuration was assessed.
Test the whole decision path
Use synthetic contacts and harmless copy. Have separate users research a profile, add a buyer-owned note, request approval, queue a pitch, receive an objection, correct a record and export the dossier. Test a leaver account and a failed integration. Capture screen-reader and keyboard behaviour rather than accepting an undated accessibility statement.
For public-sector buyers, the government's accessible technology guidance recommends specifying standards, assistive technologies and evidence. UK public sector bodies must also meet the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018 for their websites and mobile apps.
Other England buyers should have a qualified reviewer set the legal and contractual requirement for their circumstances.
Decide with non-compensating gates
Keep UK GDPR and PECR, security, accessibility, IP and database licensing, operational fit, finance, procurement and contract terms on separate lines. One pass cannot offset a failure elsewhere.
A supplier can clear a security review and still fail the accessibility gate if its interface cannot be driven by keyboard or screen reader. That failure alone stops the purchase.
Public-sector buyers in England must follow the Procurement Act 2023 when awarding and managing contracts. Record each owner, evidence, expiry, open question and stop condition.
Hold when the supplier identity is unclear, provenance cannot be traced, objections cannot suppress sends, privileged access is unexplained, required tasks are inaccessible, export is unusable or deletion is not evidenced.
If the buyer proceeds, name the implementation owner, rollback authority and recheck date. Publication in 2027 requires fresh supplier, regulatory and contract evidence.
Before you act
- Write the service boundary and list the people involved.
- Document the manual route with blank cells for staff time, delay, errors and recovery.
- Request the evidence listed above from each supplier.
- Test the whole decision path with synthetic contacts.
- Set separate gates for privacy, security and accessibility.
- Record stop conditions and recheck dates before proceeding.
Common questions
Why should PR software selection start with an awkward work event?
Starting with an awkward work event lets the buyer see whether its current inbox and register already provide enough control. It avoids beginning with a feature catalogue and focuses on actual failures.
What evidence should a buyer request from a supplier?
Buyers should request a current product and edition description, the proposed contracting entity and field-level contact-data sources. They should also ask for controller and processor allocations, user and audit-log controls, accessibility evidence, permitted exports and deletion terms, and support and incident procedures.
When should a buyer hold or stop the procurement?
Hold when the supplier identity is unclear, provenance cannot be traced, objections cannot suppress sends, privileged access is unexplained, required tasks are inaccessible, export is unusable or deletion is not evidenced. If proceeding, name the implementation owner, rollback authority and recheck date.



