Martech audit checklist: stack, data quality, consent and the records a client owns

Why a martech audit needs a records section

A martech audit checklist should cover the tool inventory, adoption, integrations, data quality, consent and contracts, and then one thing most audits skip: the history the stack has accumulated. Where do CRM, call recording, support and content records live, how many years do they cover and who controls them?

That last section earns its place for two reasons. It protects the client, because history is easy to lose in a tool switch. And it shows whether the client might hold licensable operating records of the kind AI labs and data buyers license through SourceX. You can answer it from admin screens and contracts alone: system names, date ranges and admin ownership, never the records themselves.

The checklist

1. Stack inventory and ownership

• List every tool: CRM, marketing automation, ad platforms, analytics, CMS, conversation intelligence, help desk, live chat, survey and enrichment tools.
• Record a business owner and a technical admin for each.
• Compare seats purchased with seats active in the last 90 days.
• Capture renewal date, term length and notice period.
• Flag tools bought on a card outside procurement.

2. Adoption and process fit

• Map each tool to a documented process, such as lead routing, lifecycle stages or the sales handoff.
• Identify overlapping tools doing the same job.
• Interview two or three heavy users per tool about workarounds.

3. Integrations and data flow

• Name the system of record for contacts, accounts and opportunities.
• Map every sync, with its direction and frequency.
• Find broken, duplicated or orphaned integrations.
• Check campaign and UTM naming conventions against what is actually used.

4. Data quality

• Estimate duplicate contacts and accounts.
• Check that lifecycle stage and lead status definitions are written down and followed.
• Confirm closed-lost reasons are captured consistently.
• Turn on field history tracking for stage, owner and amount if it is off.

5. Consent, privacy and compliance

• Locate where consent and opt-outs are stored, and confirm suppression lists sync across tools.
• Record how people are told that calls are recorded, and in which states the client records calls.
• Compare the privacy policy with how data is actually used, including AI features.
• Collect the data processing agreement for each vendor.

6. Contracts and exit

• Note export rights and formats on termination for each tool.
• Note what each vendor deletes after cancellation, and when.
• Read each vendor's own data use rights, including aggregated-data and AI training clauses.

7. Records and data asset section

• CRM: the earliest record date, and whether won and lost outcomes and reasons are recorded for most opportunities.
• Previous CRMs and marketing platforms: whether full exports still exist and who holds them.
• Call recordings and transcripts: the retention setting, years kept and the notice used.
• Support and help desk: when ticket history starts and whether resolution codes are used.
• Content library: years covered, and whether the company or an agency owns it.
• Email campaign history: how far back sends, results and creative are archived.
• Retired tools: what happened to their data when they were switched off.
• Control: who holds admin and export rights for each system.
• Subject matter: whether records mostly concern businesses or consumers.
• Size: whether the company reached 50+ full-time employees at peak (contractors excluded).

The data inventory builder can help turn section 7 into a tidy list of systems and years.

Recording and privacy rules behind sections 5 and 7

Call recordings are where marketing data most often carries legal limits. Federal law lets a person who is a party to a call, or who has one party's prior consent, record it under 18 U.S.C. 2511(2)(d). California's Penal Code section 632 prohibits recording a confidential communication without the consent of all parties, so the notice a client uses matters.

Consumer marketing lists raise separate questions. The CCPA gives California consumers the right to opt out of the sale or sharing of their personal information, one reason records that are mainly consumer personal data make weak licensing candidates.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

How to read the results

Raising it with the CEO

Present the records section as part of the audit readout, not as a separate pitch. One slide covering systems, years and owners is enough. If the CEO is interested, offer an introduction to SourceX and disclose any referral relationship in the same breath.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable only after the buyer pays and SourceX receives its fee; no reward is guaranteed. The fractional CMO playbook covers the rest of the referral side, and the CEO's likely first question, whether this is a real market, is answered in is AI data licensing legitimate.

Red flags in the records section

• Contact databases built from purchased lists.
• Call recordings made without a clear notice.
• Content and campaign assets owned by an agency under its contract.
• Records that salespeople imported from previous employers.
• History padded with AI-generated content.
• A retired platform whose data was deleted at cancellation.
• Customer agreements that restrict use of customer information; the guide to customer contract data use restrictions explains what counsel reads.

Next step

Add section 7 to your next audit and check the result against who qualifies. When a CEO wants to explore, register as a partner and share your referral link, or have the company apply directly at sourcex.si/apply.