The average digital agency kept a 13% after-tax net margin in 2025, according to Promethean Research, down from 14% in 2024. At that margin, one white-label project that has to be rebuilt in-house can erase the profit on several others. Choosing the partner is the decision that protects the margin, and it deserves a method rather than a good call with a friendly founder.
This page is that method: 20 checks scored 0, 1 or 2, a total out of 40 and four knock-outs. It draws on Webflow's plan and partner pages, Google's field-data documentation, WebAIM's 2026 survey, the GDPR text and Deloitte's outsourcing research.
Why a scorecard, and not just a list of questions
We have already written the 14 questions to ask a white-label web development agency, each with the answer that should disqualify. Questions work in one call. They work less well when three people run different calls and compare notes from memory.
A scorecard makes two partners comparable on one scale, separates what a partner says from what it shows, and leaves a record to revisit after the first project. The scale is coarse on purpose. A 0 means no, refused or not available. A 1 means a credible answer with nothing behind it. A 2 means you saw it: a document, a link, a contract clause or a measured result.
The 20 checks at a glance
Copy this table into a sheet with one column per partner. The groups run from cheapest to most expensive to check, so a weak partner drops out early.
| # | Check | What earns a 2 |
|---|---|---|
| 1 | Own site passes Core Web Vitals | Field data passes LCP, INP and CLS in PageSpeed Insights |
| 2 | Own site accessibility basics | No low-contrast text, missing alt text or unlabelled form fields on the homepage |
| 3 | Platform credentials and plan | Certified Partner listing or verifiable platform work, and a Freelancer or Agency Workspace |
| 4 | A checkable client | One named client or a case study with dates and scope you can confirm |
| 5 | CMS model document | A redacted example from a past project |
| 6 | QA record | Browsers, widths, fixed and deliberately left issues, from a past project |
| 7 | Tracking map | Forms, events and integrations listed with owners |
| 8 | Handover walkthrough | A sample recording or editing guide, partner branding removed |
| 9 | Named lead developer | A name, a portfolio and a call with that person |
| 10 | Cover for absence | A named second developer who has touched a live project |
| 11 | Capacity next month | A number of sites or days, in writing |
| 12 | Response time and overlap | Hours of overlap and a reply window in the contract |
| 13 | Written scope | Pages, templates, collections, integrations and review rounds |
| 14 | Change-request rate | A price per change or per hour, written in the quote |
| 15 | IP transfer | Assignment of the build on payment, written |
| 16 | Data processing terms | Processor terms and a sub-processor list, where clients have EU users |
| 17 | Visibility and non-solicitation | Agreed visibility level and a no-contact clause |
| 18 | Pilot delivered on time | Paid pilot shipped on the agreed date at the agreed scope |
| 19 | Pilot quality measured | Pilot pages pass lab speed and accessibility checks you ran yourself |
| 20 | Pilot leak check | No partner name in forms, code, assets or Workspace names |
Source: Octo Agency scorecard; thresholds from web.dev, WebAIM and GDPR Art. 28 as cited below
Group one: what you can verify without asking (checks 1 to 4)
These four need no permission from anyone.
Check 1, field speed on their own site. Run the partner's homepage through PageSpeed Insights and read the top section, not the score: Google's documentation says it is Chrome UX Report field data over the previous 28 days at the 75th percentile, while the score is one Lighthouse run on a simulated mid-tier phone. Google's thresholds for good are LCP of 2.5 seconds or less, INP of 200 milliseconds or less and CLS of 0.1 or less. A pass on all three scores 2. CrUX only includes origins with enough traffic, so a small studio may have no field data; score its lab result as a 1 at most.
Check 2, accessibility basics. WebAIM's February 2026 analysis of one million home pages found detectable WCAG failures on 95.9% of them, with an average of 56.1 errors per page. The most common were low-contrast text on 83.9% of pages, missing image alt text on 53.1%, missing form labels on 51% and empty links on 46.3%. A free browser checker finds all four in a minute. None on the partner's homepage scores 2; one or two scores 1. WCAG 2.2, a W3C Recommendation since December 2024, sets the AA contrast floor at 4.5:1 for normal text.
Check 3, platform credentials and Workspace. Webflow lists over 1,200 Certified Partners, so the badge separates few. The Workspace plan decides whether handover works. Webflow's pricing page lists the Freelancer Workspace at $16 a month billed yearly, with free guest access in client Workspaces and client payments, and the Agency Workspace at $35 a month billed yearly, with unlimited staging sites, three free client seats per site, site-level roles and publishing permissions. Our guide to Webflow white-label agency agreements explains why the Workspace clause comes before the IP clause.
Check 4, a client you can check. White-label partners cannot name most of their work, but they can usually name one relationship. When we checked 17 white-label web development partners on their own sites, only three of the seventeen both stated an NDA and named clients. A named client you can confirm scores 2; anonymised but specific work scores 1; a logo wall with no detail scores 0.
Group two: documents to ask to see (checks 5 to 8)
Ask for redacted examples from a past build, not templates written for the sales call.
Checks 5 to 7, the working documents. The CMS model document lists every collection and field and what each one renders. The QA record lists the browsers and widths tested, what was fixed and what was deliberately left. The tracking map lists every form, event and integration with the account that owns it. A partner who sends all three quickly has them on file. One who promises to "put something together" scores 1.
Check 8, the walkthrough. Ask for a past handover video or editing guide with the partner's branding removed. It shows whether they hand over under someone else's name. Our Webflow client handover kit lists what a complete one contains, if you want a reference to score against.
Group three: people and capacity (checks 9 to 12)
Check 9, the named developer. This is the first knock-out. You need the name of the person who will build your first project, a look at their own work and a short call with them. A sales lead who "will assign the right person" scores 0.
Check 10, cover. Ask who takes over in week three if the lead developer is ill. A named second person who has worked on a live project with the lead scores 2. "We have a team" scores 1.
Check 11, capacity. Ask how many sites, or how many days, they can take next month, and get the number in an email. A specific number with a caveat is a better sign than "whatever you need".
Check 12, response time and overlap. Agree the hours of overlap with your team and a reply window for messages, and put both in the contract. For a partner in another time zone, the test is simple: is there a shared window for one review call a day? Written terms score 2, a verbal promise scores 1.
Group four: commercial and legal terms (checks 13 to 17)
Three of the four knock-outs sit here, because contract gaps cost money after the project ends.
Check 13, written scope (knock-out). A quote without pages, templates, collections, integrations and review rounds is a guess. Score 0 and stop.
Check 14, change-request rate. The rate for work outside scope should be in the quote. Without it, every "small change" becomes a negotiation.
Check 15, IP transfer (knock-out). The contract should assign the build, the design files and the CMS structure to the agency on payment. A partner that wants to keep ownership of the site, rather than of a reusable code base it licenses to you, scores 0.
Check 16, data processing (knock-out for EU work). If your clients have EU users, a partner with access to forms, CMS data or analytics is a processor. Article 28 of the GDPR says a controller may only use processors that provide sufficient guarantees, that a processor needs prior written authorisation before engaging another processor, and that personal data must be deleted or returned at the end of the service. A partner who has not heard of a data processing agreement, or who cannot list its own sub-processors, scores 0 when this applies. If your clients have no EU users, score the check 2 and note why.
Check 17, visibility and non-solicitation. Agree how visible the partner will be: invisible, introduced as your development team, or credited. Add a clause that the partner will not contact or take on your clients directly for a set period. Both in writing scores 2.
Group five: the paid pilot (checks 18 to 20)
The last three checks come from a small paid project: one landing page, one CMS collection or one template, scoped and dated like real work.
Check 18, on time at scope. The pilot ships on the agreed date, at the agreed scope, with the documents from group two. A one-day slip with notice scores 1. A silent slip scores 0.
Check 19, quality you measured. Run the pilot pages through Lighthouse and an accessibility checker yourself, before the partner's own QA record arrives. Pilot pages have no field data yet, so lab checks are the only measure. Compare what you found with what their QA record says. Agreement scores 2.
Check 20, the leak check. Look for the partner's name in form notification addresses, code comments, class prefixes, asset file names and the Workspace and site names. One leak on a pilot is a training issue; on a client project it is a client conversation.
How to read the total
| Total out of 40 | What it means | Next step |
|---|---|---|
| Any knock-out at 0 (checks 9, 13, 15, 16) | A structural gap the contract cannot fix later | Stop, whatever the total |
| 32 to 40 | Evidence on almost every check | First client project, review at day 30 |
| 24 to 31 | Credible but thin on proof | Paid pilot only, then rescore |
| Under 24 | Mostly promises | Decline, keep notes for next year |
Source: Octo Agency scorecard
The pilot checks (18 to 20) cannot score before a pilot exists, so a partner scored on paper is out of 34, not 40. Scale the threshold: 27 of 34 is roughly the same bar as 32 of 40. If a partner clears that on paper, the pilot is a confirmation; if they sit just under it, the pilot decides.
Deloitte's 2024 Global Outsourcing Survey of more than 500 executives found 80% planning to maintain or increase outsourcing, and half already outsourcing front-office work such as marketing, yet 70% said their vendor management office was not fully mature. A twenty-row sheet is a small stand-in for one: it turns a hunch into a record you can check against the first invoice.
What this means for an agency choosing its first partner
Score at least two partners, even if you already like one; a single score has nothing to stand against. Rescore the partner you pick after the first client project, using the same 20 checks, because the documents and response times you were promised are now things you have seen.
We sit on the partner side of this decision. In the last twelve months we have built 20 or more Webflow sites for Web Tonic under their name, at two to three weeks per site, the largest with a CMS of over 1,200 items. We would expect any agency to run this scorecard on us before a first project, and we quote per project rather than publishing a rate card. Our white-label service page explains how we scope it.
