The wellbeing vendor due diligence checklist enterprise buyers need before they sign

Most wellbeing and EAP contracts get evaluated on the wrong things. A glossy demo, a reference call with a happy customer, a per-employee-per-month rate that fits the budget. Then eighteen months in, Finance asks what the spend actually returned, utilization numbers turn out to be indefensible, or a security review that should have happened before signature happens after an incident.

None of that is a vendor problem. It is a process problem. If your organization doesn't have a repeatable, documented due diligence process for wellbeing and EAP vendors, every renewal and every new purchase is being evaluated from scratch, by whoever happens to be in the room, using whatever criteria feel relevant that quarter. That doesn't hold up when Finance asks for the business case, when the board asks what duty-of-care coverage actually looks like, or when a regulator asks how a vendor handling employee mental health data was assessed before you gave them access to your workforce.

This guide gives CHROs and VPs of Benefits a structured, five-domain due diligence framework for evaluating any wellbeing or EAP vendor, built to be genuinely repeatable across every renewal and every new RFP rather than usable once and forgotten.

Wellbeing and EAP vendors sit in an unusual spot. They handle some of the most sensitive data in the organization, mental health disclosures, crisis contacts, therapy records, while being procured, in many companies, with less scrutiny than a payroll system or a CRM. Part of the reason is historical. EAPs were built and bought as a compliance line, a duty-of-care box to tick, rather than a system whose performance gets measured the way other enterprise software is measured.

That gap shows up clearly in utilization data. Across the category, average EAP engagement sits under 2%, and a legacy EAP running at 2 to 4% utilization is providing legal cover rather than care. Those numbers exist because most EAP contracts were never built with a due diligence process that asked the right question at signature: how will we know if this is working, and what happens if it isn't? One enterprise that finally asked found utilization in its own prior international EAP running as low as 1% in some regions and never above 3% in any of them, discovered only when it reviewed the contract itself rather than renewing on autopilot.

This also connects to a broader pattern in how organizations manage change. 72% of organizational transformations fail not because of strategy or technology, but because they ignore the human cost. A wellbeing vendor selected without rigor is one more instance of that same failure mode: buying something because it addresses a stated need on paper, without building in the mechanism to check whether it is actually addressing it in practice.

The fix isn't a better vendor. It's a better process, applied consistently, that produces a defensible answer regardless of which vendor is in front of you.

Every wellbeing or EAP vendor evaluation should be assessed against five domains. Skipping any one of them is how organizations end up with a contract that looks fine on paper and fails silently in practice, discovered only when someone finally asks how many people are actually using it.

1. Clinical governance

This is the domain most buyers assume is fine because the vendor says "clinical" somewhere on their site. It needs specifics.

• Who designs the clinical content and care pathways, and what are their credentials? Is there a named clinical leadership function, or is clinical oversight outsourced or informal?
• What is the escalation pathway from self-guided tools or an AI-assisted first point of contact into human clinical care? Ask the vendor to walk through, step by step, what happens when a user discloses something serious.
• Is there a documented boundary between what an AI tool is permitted to do (guidance, triage, signposting) and what requires a human clinician (diagnosis, crisis intervention, treatment)? A vendor that can't clearly state what its AI tool does not do is a governance red flag rather than a feature gap.
• How is care quality monitored across the provider network, and what happens when it falls short?

Ask for this in writing rather than as a verbal assurance in a sales call. If a vendor can't produce a documented clinical governance model, that's your answer.

2. Data security and compliance

Mental health data is among the most sensitive categories an employer will ever hold on an employee, and a wellbeing vendor is, functionally, a data processor for it.

• What independent security certifications does the vendor hold, and are they current? Look for recognized frameworks like ISO 27001, which covers information security management, and country-specific schemes like the UK's Cyber Essentials, which are audited by a third party rather than self-attested.
• Where is data hosted, and does that satisfy your organization's data residency requirements across every region you operate in?
• What is the vendor's data retention and deletion policy, and can an employee request their own data be deleted?
• How is data anonymized or aggregated before it reaches the employer, and is there a documented threshold below which team-level data is suppressed to protect individual privacy?
• Has the vendor had a breach, and what was the disclosure timeline?

This is a domain where "trust us" is not an acceptable answer, and it's the one place where a paper trail should already exist before the sales conversation starts. As a reference point for what independently audited good practice looks like in this category, Unmind publishes its security certifications, including ISO 27001 and Cyber Essentials, as a baseline other vendors can be measured against, rather than the only acceptable standard.

3. Outcomes and utilization measurement

This is the domain most incumbent EAP contracts are weakest on, because a service network's commercial model doesn't depend on people actually using it.

• What utilization data will you receive, how often, and at what level of granularity? Aggregate annual numbers are not the same as ongoing, segmentable data.
• Does the vendor report engagement (who logged in) or outcomes (what changed for the people who used it)? These are different questions, and a vendor should be able to answer both.
• What benchmarks exist for utilization in this category, and where does the vendor's own book of business sit against them? A vendor unwilling to share a category benchmark is asking you to evaluate them with no reference point.
• Can utilization and outcomes data be connected to workforce metrics you already track, absence, attrition, engagement survey results, so the spend can be discussed in the same terms as any other line item?
• What happens contractually if utilization falls below an agreed threshold? Is there a remediation clause, or does the contract simply renew regardless?

Building this in before signature is what makes the difference between an outcome another enterprise can now point to, after replacing a legacy EAP and watching engagement move from a low single-digit rate to 43% within three months and 52% within six, and a retrospective nobody wants to run because nobody knows what the numbers will show.

4. Operational readiness

A vendor can pass every clinical, security, and measurement test and still fail in practice if the operational basics aren't there.

• What is the actual rollout timeline, from contract signature to first employee access, and what does the vendor need from your team to hit it?
• What languages and countries are genuinely supported with local clinical networks, versus supported only by a translated app interface?
• What is the integration path into your existing HR systems, single sign-on, and communication channels, and who owns that work, the vendor or your internal IT team?
• What does day-to-day support look like for employees, and what does account support look like for your internal team managing the relationship?
• Has the vendor handled a rollout at your scale before, and can they name a comparable reference?

5. Commercial and contract risk

The last domain is the one Finance and Legal will scrutinize hardest, and it deserves the same rigor from HR before it gets to them.

• What exactly is included in the base contract versus billed as an add-on, and is that itemized clearly enough that a renewal three years from now won't surprise you?
• What are the termination and data-return provisions if the relationship ends? What happens to the data the vendor is holding on your employees?
• Is there a defined path to consolidate other point solutions or an existing EAP into this contract, or does this purchase add a new line without retiring an old one? A buying committee under cost pressure needs an honest answer to this before signature.
• What contractual commitments exist around uptime, breach notification, and utilization reporting, and are they enforceable terms or marketing language repeated in the contract?
• Who is your renewal negotiating against: is pricing structured to reward genuine usage growth, or does it scale regardless of whether anyone uses the product?

A due diligence framework only works if it survives contact with a second vendor evaluation eighteen months from now, run by someone who wasn't in the room for the first one. Three things make that happen.

Score every vendor against all five domains using the same rubric, before any reference calls happen. Reference calls are useful for texture rather than for scoring, because a happy customer reference tells you a vendor performs well for at least one account. It doesn't tell you how the vendor performs against your specific security, geography, or measurement requirements.

Put the outcomes and utilization domain into the contract itself, beyond the evaluation stage. A vendor that scores well on measurement in the RFP but has no contractual reporting cadence will quietly stop reporting once the ink is dry.

Revisit the same five domains at renewal rather than a fresh set of criteria. The point of a standardized checklist is that a three-year-old contract gets held to the same bar as a brand-new RFP. That's what makes it defensible in front of Finance and the board: not that you evaluated a vendor rigorously once, but that you evaluate every wellbeing vendor, incumbent or new, the same way, every time.

If your organization is applying this checklist to its current EAP and the utilization domain is coming back thin, under 2% engagement or a legal-cover-only utilization rate, that's the finding this process is designed to surface. It's also, directly, the pattern that leads most enterprises to move off a legacy EAP once they finally look.

Unmind positions itself in this category around the outcomes and utilization domain specifically: an EAP model designed to be proactive and measurable rather than reactive and unmeasured, with organization-level reporting built to answer the exact questions this checklist asks in domain three, beyond individual-level usage stats.

If the finding from this process is that your current vendor relationship needs to change, and the underlying question is whether to consolidate what's currently spread across an EAP, a wellbeing app, and separate point solutions, that's a related but distinct decision from the one this checklist is built for. It's covered in the case for consolidating employee wellbeing programs, which addresses whether to consolidate. This guide is about how to evaluate whatever you land on, incumbent, challenger, or consolidated platform, before you sign.