Vendor due diligence, simplified.

Short answer. Due diligence on a supplier is not one check, it is a set of registers, and the right depth is set by what the contract can cost you if it fails.

This page sets out the registers that are public and free, what each one proves, and where a small vendor differs from a large one.

Size the check before you run it

A one-off order of stationery and a three-year data-processing contract do not deserve the same effort.

Ask what breaks if this vendor disappears next month, and what they will hold that you cannot get back — money already paid, your customers' data, a single-record component, a regulated function.

That answer sets the depth. Everything below is ordered from the checks worth doing every time to the ones that earn their cost only on real exposure.

The registers that are public and free

Corporate registration. The Secretary of State in the state of incorporation publishes formation date, status, registered agent and often the officers.

Status matters as much as existence: administratively dissolved entities keep sending invoices.

Federal exclusion and sanctions lists. SAM.gov carries exclusions from federal contracting; OFAC publishes sanctions designations. Both are free, and both are a hard stop rather than a data point.

Professional and trade licences. State boards publish status, issue date and discipline history. A lapsed licence is a contract risk before it is a quality risk.

Court records. County and state portals, plus PACER for federal matters. What you are looking for is pattern, not a single suit: repeated wage claims, repeated non-payment actions, a bankruptcy mid-contract.

Regulator actions. Where the vendor is regulated — health, finance, food, environment — the regulator publishes enforcement. It is the most under-used free record in vendor work.

What a small vendor looks like when it is fine

Most suppliers are small, and small does not mean risky.

A sole trader with a five-year registration, a current licence, a consistent address history and no adverse filings is a normal business.

What matters is coherence: the same name across the registration, the licence, the bank account and the contract.

Incoherence is the signal — a different legal entity on the invoice than on the proposal, an account in a personal name, an address that belongs to a mail drop with no history.

The people behind the entity

For anything that touches money or data, the officers matter more than the letterhead.

Look for them under their own names: prior companies, licences, published mentions, court filings. A director whose previous three companies dissolved with claims outstanding is a pattern a company register alone will not show you.

A name search shows who shares a name, and the records anchored to the person you select are what make a connection more than a coincidence.

Recordwell does not carry phone or email data and is not a screening bureau: it shows the public-record footprint of a named person, which is exactly what pre-contract research is allowed to use.

Documents to ask the vendor for

A certificate of insurance naming the right coverage and limits, issued by the insurer rather than retyped by the vendor.

A W-9 or its equivalent, matching the legal entity name you verified.

Bank details on the entity's letterhead, confirmed by voice on a number you looked up yourself — not one supplied in the email thread.

For data work, a named security contact, a statement of where data will be stored, and their sub-processor list. Vendors that take this seriously answer in a day; the answer itself is the signal.

Where the real failures come from

Not from fraud, usually. From concentration and from drift.

Concentration: one supplier for a component with no alternative qualified, and a lead time you cannot absorb.

Drift: the vendor you vetted two years ago now subcontracts the work, changed owners, or moved the data offshore, and nobody re-checked.

Put a review date on every material contract, and re-run the cheap registers on that date. The five minutes cost nothing and catch the change of status that no one announces.

What this check is not

It is not a credit decision. Extending payment terms, financing or insurance uses consumer or commercial credit data under rules of its own, and consumer public-record research may not be used for FCRA-covered decisions.

It is not a background check on the vendor's staff. Screening people who will work on your site requires consent and an FCRA-compliant provider.

And it is not a guarantee. Registers prove existence, permission and history; they say nothing about whether the work will be good.

A checklist you can actually run

Verify the legal entity and its status. Match the name on the invoice and the bank account to it.

Check the licences the work requires, and the exclusion lists if federal money is involved.

Search the officers by name, and read what is anchored to them rather than what shares their name.

Confirm payment details by voice, put a review date in the contract, and keep what you checked in the file.

For a single invoice rather than a relationship, verifying a business contact is the shorter version of this page.