Options Data Vendor Due Diligence: The Checklist a Fund Should Run

An options analytics vendor is not a market data feed. A feed either delivers the exchange's bytes or it does not. An analytics vendor is selling an opinion: a model of dealer positioning, a volatility surface fit, a set of derived levels. Two vendors reading the same OPRA tape will publish different gamma exposure for the same symbol on the same day, and both can be defensible. Diligence on an analytics vendor is therefore diligence on a methodology, not just an SLA.

The sections below are ordered by how often they kill a deal late. Methodology and point-in-time integrity almost never come up in the first call and almost always come up before signature.

1. Methodology: can you evaluate the model, or only the output?

If a vendor cannot tell you how a number is computed, you cannot use it in research. You can only use it in a dashboard.

• Is the pricing model documented? Which model prices the contracts, what rate and dividend assumptions are used, and is the rate a curve or a scalar? For American-style single names, is there an early-exercise adjustment, or are European Greeks being applied to American contracts?
• What is the dealer-positioning convention? Aggregate gamma exposure requires an assumption about who is long what. Ask them to state it explicitly. Any vendor who describes dealer positioning as measured rather than assumed is either using classified trade flow, in which case ask how it is classified, or is overselling.
• How is the volatility surface fitted? Which parameterisation, what happens in the wings, and is the surface arbitrage-checked (butterfly and calendar) or only bounded?
• What is dropped, and when? Every chain has broken quotes. Ask what filters exist for one-sided markets, stale contracts, unsolvable implied volatilities, and thin strikes, and whether a filtered aggregate is flagged as such.
• Is there a written methodology document, versioned, at a stable URL? A PDF emailed by a salesperson is not a methodology. You need something you can cite in a research note and re-check after a vendor changes a definition.

2. Point-in-time integrity: will the backtest survive contact with production?

This is the section that separates a research input from a chart. A historical value is only usable if it is what would have been observable at that timestamp.

• Is history restatement-versioned? If the vendor re-pulls a day from upstream, does the old value survive as an as-reported version, or is it overwritten in place? Overwriting is common and not automatically disqualifying, but you must know, because it means a backtest re-run next quarter can produce different numbers for the same past date.
• Are derived statistics leak-bounded? Percentiles, z-scores and rank measures are the easiest place for look-ahead to enter. Ask whether they are constructed using only data prior to their own timestamp.
• What is the survivorship posture? Are delisted underlyings and expired contracts retained and queryable? Is there symbol-change remapping? A universe that silently drops dead names will flatter every cross-sectional study you run.
• Do live and historical share a response contract? If the historical API returns a different shape from the live API, every strategy gets rewritten on the way to production, and the rewrite is where the disagreement enters.
• Are live and historical computed by the same code? Ask directly whether there is an automated test asserting parity between the two engines. Shared response shapes with divergent computation is the failure mode that is hardest to detect and most expensive to discover late.
• What are the known gaps? Every archive has them. Ask for the coverage report rather than the coverage claim, and ask per symbol rather than accepting a single blanket start date.

3. Licensing and exchange-fee exposure: what are you actually buying?

This is where compliance stops a deal that research already approved, usually late.

• Where does licensed raw data end and derived analytics begin? If you ingest computed aggregates, does that expose you to exchange redistribution or non-display fees? Ask for the boundary in writing.
• What rights does the subscription actually grant? Internal research and trading only, or redistribution? Can outputs appear in a client-facing report, a marketing chart, a regulatory filing? Most analytics vendors licence internal use only. Assume nothing.
• Seats and entities. Does the licence cover a team, a legal entity, or a group? What happens with an affiliate in another jurisdiction?
• What happens at termination? Can you retain derived research and historical extracts produced during the term, or must they be destroyed? This one is frequently unaddressed and matters enormously if a signal built on the data is in production.

4. Operations: what happens when it breaks at 09:31?

• Is availability measured externally? Self-reported uptime measures whether the vendor's monitor can reach the vendor. An off-fleet probe over the real request path measures what you experience. Ask which one the status page reflects.
• Does the service fail closed or fail quiet? When upstream data is stale or missing, does the endpoint return an explicit error, or the last known value with a fresh timestamp? The second is far more dangerous, because a systematic strategy cannot tell the difference.
• What reconciliation runs, against what truth source, and how often? "We monitor data quality" is not an answer. Ask what is compared, at what threshold, and what happens when the comparison source itself returns nothing - a vendor whose monitor scores an empty upstream as agreement is not monitoring.
• Who is paged, and what is the escalation path? Ask for the realistic answer, not the aspirational one. A small vendor answering honestly that alerts reach two engineers by email is more useful than a vague claim of 24/7 coverage.
• How are methodology changes communicated? A silent definition change is a silent backtest invalidation. There should be a changelog and a version.

5. Continuity and concentration: what if the vendor disappears?

Specialist analytics vendors are usually small. That is often why they are good, and it is a real risk that deserves a direct question rather than a polite silence.

• Key-person concentration. How many people can operate and repair the platform? Ask it plainly; the answer tells you what response times to expect as well as what the risk is.
• Data retention and extraction. Can you take a bulk extract of the history you have licensed, so a strategy is not stranded if the relationship ends?
• Backups and recovery. Frequency, off-host copies, retention, and whether restore is ever exercised or merely configured.
• Escrow and notice. For a business-critical dependency, source escrow, extended termination notice, and transition assistance are reasonable asks even from a small vendor.

6. Delivery and integration: how does it reach your stack?

• Which transports? REST is table stakes. Ask about push delivery if you react intraday, and bulk file delivery if you backtest across thousands of symbols. Pulling a multi-year cross-sectional study over REST is a bad time for everyone.
• Authentication and entitlement model. Per-key, per-seat, or per-entity, and how quickly an entitlement change takes effect.
• Rate limits and their failure mode. Per-day quota or per-second? Does the limiter fail open or closed when its own store is unavailable?
• Reproducibility. Can you recompute a published number from inputs the vendor also gives you? If not, you are trusting rather than verifying, which may be acceptable, but should be a decision rather than a discovery.

How FlashAlpha answers this checklist

We publish the answers rather than gate them behind a call, because the checklist above is the evaluation we would run ourselves.

• Methodology. A versioned methodology whitepaper at a stable URL covers the pricing model, surface construction, exposure definitions, derived levels, and validation, and includes an explicit assumptions-and-limitations section stating the dealer-positioning assumption, European pricing on American contracts, and the absence of halt detection.
• Point-in-time. The integrity section states plainly that history is retained but not restatement-versioned, that derived percentiles and z-scores are leak-bounded by design, and what the known gaps are. Live and historical share response shapes and are held in parity by an automated cross-engine test.
• Operations. Fleet monitoring and operational controls documents cross-source reconciliation and its thresholds, the job-health registry, which endpoints fail closed, and what these controls deliberately do not do.
• Security, continuity and company. Security and compliance covers hosting, topology, backups and retention, support and escalation, legal entity, and current attestation status, including that we are not currently SOC 2 or ISO 27001 certified.
• Licensing. All tiers are internal use only. FlashAlpha does not licence redistribution, embedding, white-label, or publishing. That is stated everywhere rather than discovered in a contract.
• Summary for a diligence pack. The institutional datasheet puts coverage, history, delivery, tiers and the diligence links on one page.

Good diligence on an analytics vendor is not adversarial, it is specific. The questions above are answerable in an afternoon by a vendor who has done the work, and unanswerable by one who has not, which is exactly what makes them useful. If you are running this checklist against FlashAlpha, the methodology whitepaper, security overview and institutional datasheet answer it in writing before you talk to anyone, and the commercial team is the engineering team.