PR tools and providers for agencies: a 2027 guide to workflow fit and data provenance

What to take away

Map nine workflow states first

Take one narrow appointment. A team in England researches contacts, approves a pitch, logs delivery, handles an objection and recovers records at exit.

Software is optional at every state. A manual register holds if it controls access, provenance, versions, objections and exit.

Product categories against those states

Vuelio Media Database, CisionOne UK and ResponseSource Media Contacts Database are the named contact databases here. Suppliers describe them as sources of profiles and outlet detail.

Outside contact data, the named monitoring services here are Meltwater and Kantar Media, which track coverage and feed states 7 and 8. ResponseSource's press release wire and PR Newswire handle distribution and log the send at state 5. Muck Rack and Prowly combine a media database, monitoring and pitch workflow, so one subscription can serve research, approval, send and reporting states.

Provenance questions shift by category. For coverage services, ask for the source outlet, capture date and the rights attached to each item, not only the contact fields set out below.

Ask for the exact edition quoted, because modules change between packages. Score Vuelio, CisionOne and ResponseSource against the states above with written tasks of your own. Wider supplier detail sits in our PR agency supplier comparison.

Example: an acceptance statement with a threshold

"Find contacts" cannot be scored by an outsider. Write something another person can mark.

In 20 searches against named outlets, the reviewer finds the outlet and its source in at least 18. Suppression holds in 20 of 20. Thresholds are illustrative, not a supplier benchmark.

Set thresholds from what an error costs. A wrong contact in a 500-recipient send differs from one in a press office of eight.

Provenance evidence field by field

Media records can hold personal data even when they describe professional work. Use the ICO controller and processor guidance to check who sets purposes and who acts on instruction.

Ask the supplier to state, per field:

The June 2026 Pulsar Group privacy policy covers data used across Vuelio and ResponseSource. That stated practice is not proof of provenance for one record, and public visibility is not permission to store, enrich, share or contact. Ask each named supplier for written answers to all four fields, then test those answers against a sample of records before you rely on them.

Pitch or direct marketing: keep the boundary

Editorial purpose matters, yet an agency can still send direct marketing to professional contacts. The ICO's business-to-business marketing guidance explains that PECR treatment differs between corporate subscribers and individual subscribers such as sole traders.

A tool cannot settle that boundary from a contact label. It should hold organisation type, source, purpose and lawful-basis assessment, then block a send while a required field is unresolved.

Ask that an objection never overwrites the original record.

Contract, licence and exit controls

The order form must identify the entity supplying each service, the legal entity buying it and the authorised users, plus territory, term and governing documents.

Read the data licence as closely as the feature list. Published ResponseSource terms restrict database use, user access and continuation after termination. Cision's general terms split company, client and third-party data.

Monitoring views are not reproduction rights, so check rights, users, permitted acts and duration with a named reviewer.

Exit testing comes before migration. Export a synthetic dossier, restore it in a buyer-owned format, check links and dates, revoke every test identity, then request deletion. Our PR agency data and sources page sits alongside this checklist.

Security, accessibility and a trial that can fail

Start with what the service would hold: embargoed announcements, spokesperson details, private notes, distribution history and contact data. The NCSC's cloud-provider selection guidance ties required confidence to the impact of loss or unavailability.

Ask for identity federation, multifactor authentication, role separation, audit logs and incident notification, each with an evidence owner and expiry date. Test accessibility separately, covering keyboard path and focus order.

Run the trial on synthetic contacts and non-confidential copy. Cover a duplicate, a correction after a saved list, an objection before a send and a leaver to revoke.

Common questions

Which categories does a small PR agency need first?

Usually the contact database, plus evidence kept for objections and exit. Monitoring and distribution can wait until the workflow states are defined.

Can a bought media list be used for pitching?

Not from the list alone. You need provenance per field, a lawful basis and a PECR review of recipient type and channel.

How do I make a trial able to fail?

Score it against written thresholds on awkward events such as corrections, objections and leavers, not the search screen.