What GEO evidence should a supplier retain—and what should the buyer own?

Keep a decision record, not an indefinite evidence heap

A GEO supplier may produce question sets, screenshots, source extracts, crawl observations, monitoring exports, content drafts, technical recommendations, approvals and change records. Keeping too little makes a recommendation difficult to reconstruct or challenge. Keeping everything forever creates cost, security and data-protection risk. The buyer therefore needs an agreed evidence model: what proves the decision, who controls it, how versions are identified, how long it remains useful and what happens at the end.

The UK government's March 2026 Contract Management Playbook recommends defined and standardised record-keeping processes and notes that meeting minutes, agreed actions and contract variations create a clear audit trail. GovS 008 similarly expects an audit trail for contractual changes, approvals before implementation and retained evidence for future procurement or disputes. These public-sector standards do not prescribe every private GEO engagement, but they provide a useful discipline for a proportionate buyer-controlled record.

Create one six-part evidence-retention record

Agree the record before delivery begins, then complete it for each material finding, recommendation, approval or change. Every row should point to an actual artefact and state its status; labels such as 'evidence available' are not enough.

Preserve enough context to reproduce the reasoning

A screenshot alone rarely proves a GEO conclusion. Record the exact buyer question, market and language, date and interface, signed-in or public state where relevant, source or page tested, sample boundaries, and the method used to interpret the observation. For monitoring, retain the question-set version and denominator as well as any positive result. For technical work, link the finding to the affected URL, template, field or configuration and keep the validation evidence after the change.

The Teal Book says information and knowledge assets should have an identified owner and that externally received or multi-source information should be checked for completeness, security and sensitivity. Apply that discipline to GEO: assign ownership, validate metadata at capture, flag known limitations and distinguish a raw observation from a reviewed conclusion.

• Use stable evidence IDs so that a recommendation, approval and later retest refer to the same record.
• Do not overwrite the baseline when a new result arrives; mark which version is current and why.
• Record unavailable or inconclusive evidence explicitly instead of converting it into a zero or a negative result.
• Keep factual source material separate from supplier interpretation and buyer approval.

Set ownership, access and retention by evidence category

The buyer should normally control the evidence needed to understand accepted recommendations, approvals, material changes and current operating state. The supplier may retain a working copy for delivery, assurance or agreed legal purposes, but the contract should identify the system of record, permitted use, access boundaries and what happens when the purpose ends. A shared folder is not sufficient if only the supplier can administer, export or interpret it.

Not every record needs the same retention period. Stable approved facts, decision logs and change evidence may remain useful for longer than transient test captures or duplicated working files. If evidence contains personal data, ICO storage-limitation guidance says the organisation must justify how long it is kept, establish standard periods where possible, review it and erase or anonymise it when no longer needed. This guide does not choose a legal retention period: the buyer's legal, records-management and data-protection owners should set the applicable rule.

• Create categories such as approved facts, source captures, monitoring observations, working drafts, approvals, changes and incidents.
• For each category, state the purpose, owner, location, access roles, retention rule and disposal action.
• Use a documented hold where a dispute, investigation or other legitimate requirement pauses scheduled disposal.
• Record deletion or anonymisation decisions so disposal is also part of the audit trail.

Test the handover before relying on it

Select one completed GEO recommendation and ask a person outside the delivery team to reconstruct it from the retained record. They should be able to find the source and collection context, identify the method and version, follow the review and approval, see what action was taken, and locate the later validation result. Then export the relevant records into the agreed buyer-controlled format and confirm that links, timestamps, attachments and relationships survive the transfer.

Treat the test as failed if the reviewer needs an undocumented explanation, a departed employee, an inaccessible supplier account or a proprietary dashboard with no usable export. Record the gap, owner and remediation date. Repeat the test after a material tool, workflow, team or scope change and before renewal or exit.

• Can the buyer search by evidence ID, URL, topic, date, language, owner and status?
• Can one sampled recommendation be traced from observation to approval, implementation and retest?
• Does the export contain readable files plus an index and enough metadata to interpret them?
• Are supplier access, residual copies and disposal confirmation covered at closure?

Ask SALIENS for source-linked, versioned GEO delivery

SALIENS provides GEO audits, AI visibility monitoring, content and technical improvements, and ongoing GEO delivery. A scoped engagement can include source-linked findings, question and method versions, buyer-controlled evidence packs, named review and approval roles, English and Simplified Chinese review, retention categories, change logs and export acceptance checks.

Email info@oxfordintelligence.co.uk with your website, markets and languages, procurement stage, current evidence systems, required owners and reviewers, sensitive information, retention constraints and exit needs. SALIENS is operated by Oxford Intelligence Limited. Evidence controls support accountable delivery but do not guarantee crawling, indexation, AI mentions, citations, rankings, traffic or enquiries. This guide is a procurement framework, not legal, records-management, data-protection or commercial advice.