Duke Chapel standing over campus building

Category: Digital

Working with Vendors

The abundance of work across Duke can’t be met by the in-house resources alone. We utilize vendors from around the area including some in other areas of the country and abroad. The following guidelines have been developed to streamline the process of working with external vendors.

What You Need to Know

There are some areas of the web design process that are non-negotiable. Meaning, requirements in these areas must be met for the safety and security of our digital presence and the integrity of the brand.


Web security is a critical component of online information. Requirements for meeting security standards can be found at the Security site.


Assuring that Duke’s digital content is accessible to all requires meeting the WCAG 2.0AA requirement. Meeting this is both a content AND development concern. Color, documents, code, and videos must all be compliant before being posted. Visit the Accessibility site for more information.


Unless a justifiable business need has been identified, all sites and content related to Duke should be hosted using internal resources. Vendors can be granted affiliate netid’s so that they can build your project within the Duke environment saving both time and money. Please visit the Office of Information Technology for more information.


URL’s should build upon the duke.edu extension. Third-level domains require approval through University Communications. External domains must be purchased through the central IP registry process.

The Process

Communications projects over $5k should have at least three bids, including one from an internal resource if Duke has a resource in that area. For example, if you are completing a web redesign a bid should be obtained from Duke Web Services. We should make every effort to keep Duke money in-house whenever possible.


  • Clients should develop a scope document. This should be no longer than 3 – 5 pages and should include the project objective, audience, timeframe and a range of cost. (ex. $10-15k) This should NEVER represent your entire budget.
  • RFP’s should be requested to be received within 2 weeks. *Note: you may also need to leave time for addressing vendors questions in this phase.
  • a project kickoff is held.


  • Once bids are received, the decision of the vendor is left up to the client/department.
  • RFP’s should be requested to be received within 2 weeks. *Note: you may also need to leave time for addressing vendors questions in this phase.
  • Once chosen, a project kickoff is held.
  • A purchase requisition should be requested with Procurement for the entire amount of the project. You will bill against that amount throughout.

Managing Your Vendor

  • At the project kick-off establish your method of project management. Identify someone from the vendor team and someone from your team (usually yourself) to be the primary contact.
  • Request status updates bi-weekly or weekly. These updates should always include where you are on time, scope and budget. (If these are out of synch, this will help do avoid derailing the project.)

Review of Work

  • It is important that you allow adequate review and revision periods for work both before and after the launch of a site. If you are suspicious about the back-end development and would like additional support, Duke Web Services can review the work for a small fee.
  • It is also worth noting that the review period is not the time for design changes.


  • All work that exceeds $5,000 will be flagged for approval within the Procurement system. To maximize the use of Duke resources, one of the competitive bids must be from a qualified internal service provider if one exists in that category. For example, bids for video work over the $5,000 threshold should include a bid from Duke Media Services. The remainder of the bids must be from approved Duke external vendors.

Payment of Vendors

  • Approval from appropriate parties is needed for getting a vendor paid. All communications projects utilizing an external vendor should be put forth on a Purchase Requisition order, not on an AP Check Request. If a Purchase Requisition is presented to the Procurement or Financial Services without prior approval, it will not be paid.
  • Please do not submit an AP Check for communications projects over $2,500, as the request will be denied which will slow the payment process. AP Check requests are reserved for goods and services of $2,500 or less.
  • Vendor names are managed in conjunction with Duke Procurement and Accounts Payable.
  • Payment terms should never be less than 2 installments (at least 1/3’s preferred) and all invoices are net 30 days.
  • Please note: vendor services should not be charged to your P card.

!!Important: Special guidelines exist for the use of freelancers or vendors that are former employees of the University or Health System. These circumstances involve a separate process and/or the use of multiple groups within Duke – Duke Temporary Services, Procurement, HR, etc.

Powerpoint & Letterhead

PowerPoint Slide Templates

Duke offers a number of branded Powerpoint themes in light and dark variants for you to use to create both internal and external presentations. Additionally, the backgrounds are available for download before for use in other applications as well, such as Prezi, Keynote, etc.

Download All Background Images

Word Templates with Letterhead

Basic Word templates are available for university letterhead. If creating your own, please reference Duke’s branding guidelines when creating your own.

Download University Letterhead (Word)

Digital Signage at Duke

Duke’s Digital Signage program is a centrally managed/locally controlled electronic sign and interactive display platform powered by technology from Four Winds Interactive. Digital signage is a powerful way to communicate your message to many university locations. The service is offered at no charge and administered by the Office of Information Technology (OIT). For more information about the service, or would like to participate in the digital signage program, see the Duke Digital Signage section of the OIT Website.

Sharing Digital Flyers

Digital flyers can be requested to be added to other department signs by submitting flyers using DukeFlyer.

Content Guidelines for Digital Flyers

In an effort to maintain consistency in message and branding, we have established some basic content guidelines that should be met before displaying content. By following these simple guidelines, your message will look more professional and reach more people.


We strongly encourage the use of Duke logos and branding. These standards extend to the use of wordmarks, logos, signature colors, type fonts and other matters that affect Duke’s visual identity.


Overall, keep it simple. Too much text or too many images on a digital flyer will clutter your message and decrease readability. Try to use fewer than 30 words on any one flyer in order to make the greatest impact. Each flyer is only visible for 5-15 seconds so there’s no time to read much more than these 30 words.


All flyers to be posted on digital signage must be sized at 1920 x 1080 pixels (horizontal) or 1080 x 1920 (vertical). Full technical details are available in OIT’s Flyer Creation Guide.


Consider the colors used in your flyer carefully and maintain consistency with the Duke color palette. Ensure strong contrast between your image background colors and the text colors so that your sign can be easily read when displayed. Be sure to test the colors on the screen output before committing to the final color scheme.


The text on your digital flyer needs to be readable. Use large font sizes so your message can be read without the need to stand directly in front of the screen. Try at least 40 pt for headlines and at least 24 pt for the body text. Object Strokes Use bold lines when designing objects for digital signage. Lines that are too thin do not display well and may appear broken or look invisible.

Social Media Guidelines

The purpose of these guidelines is to help Duke communicators understand how Duke policies apply to digital communications such as blogs and social media, and to guide them in using social media platforms. The guidelines apply to material that Duke communications offices and related units publish on Duke-hosted websites and branded Duke unit profiles such as those on Facebook and Instagram. Any questions about these guidelines should be directed to socialmedia@duke.edu. Duke Health employees should refer to the specific standards and guidelines established for Duke Health sites and digital channels.

Duke units and departments have wide latitude to create and maintain a presence on social media channels such as Facebook and Twitter. They should do so in ways that are professional, technically secure and transparent. Units and departments are responsible for ensuring that content posted by, or on behalf of, any unit or department adheres to all Duke University policies and to appropriate laws that govern the public dissemination of information. To that end, units and departments should periodically review the guidelines for social media established by University Communications and consult with University Communications if they have questions about their implementation:

Understand your strategy. Social media efforts should be part of a larger communications strategy. Know what you’re trying to accomplish, and why. Before launching a social media program, you should be able to answer these questions:

  • Who is your audience?
  • What do you want them to do?
  • Is social media the best way to do this?

Remember that everything is public. There’s no such thing as a private or temporary social media post. Search engines can turn up your posts years later and screen captures live forever. Don’t post something today that may haunt you later.

Be respectful. As a general rule, be respectful and don’t post anything you would be uncomfortable saying in a public setting. Follow Duke’s values and the Duke Community Standard.

Be transparent about your role at Duke. If you participate in or maintain a social media site on behalf of the university, clearly state your role and goals. Strive for accuracy, correcting errors quickly and visibly. If you have questions about whether it is appropriate to write about certain material, ask your supervisor first.

Maintain confidentiality and follow all applicable Duke University policies. Do not post confidential, proprietary or protected health information about students, employees, patients or other members of the Duke community. Use good ethical judgment. All federal guidelines such as FERPA, HIPAA and university policies such as the Duke Confidentiality Agreement must be observed on Duke-sponsored or Duke-maintained social media sites.

Actively moderate comments and discussions on your channels. By their nature, social networking sites are participatory and involve sharing among multiple users. However, it is important to monitor live discussions for off-topic or abusive comments.

Respect university time and property. As stated in Duke’s OIT policies, university computers and work time are to be used for university-related business. It’s appropriate to post at work if your comments are directly related to accomplishing work goals, but maintain your personal social media on your own time using non-Duke computers.

Set up your accounts with Duke in mind. Use shared email addresses for registration and keep track of passwords (we recommend using LastPass) so that others in your office have access to your accounts if needed, or in case you move on to another position.

Duke University Comment Moderation Policy

Duke University reserves the right to hide or delete off-topic, vulgar or abusive comments. We do not permit comments selling products or promoting commercial ventures. Students should adhere to the Duke Community Standard when posting or commenting on social media.

Posted comments and replies do not necessarily reflect the opinions or policies of the university. All content and posts are bound by the individual platform’s terms of service.

If you have any concerns about the content posted on Duke University’s social media, please email us at socialmedia@duke.edu. We welcome all of your feedback.

Branding and Graphics

Representing the Duke brand on Social Media

When you post to social networks from an official Duke University account, you are representing the Duke brand. Here are some simple guidelines to help put your best foot forward. If you have specific questions on branding, please contact socialmedia@duke.edu.

  • Begin with “Duke” when creating a name for your Facebook Page, Twitter account or other social media presences
  • Use of the Duke logo is reserved for Duke’s institutional departments, centers and units
  • Where available, departments, schools and units should use their official logos and iconic images to build their profiles

Please follow Duke’s policies and procedures regarding copyright, privacy and sharing of information.

Images for Albums and Sharing

Duke’s Asset Management System (NETID required) is a wonderful collection of thousands of current photos and videos of Duke’s campus, programs, people and more. It is refreshed regularly with community-sourced images as well as new content captured by the University Communications team.

Mobile Developer Resources & Guidelines

Mobile App Development Resources

Office of Information Technology

(contact Mobile Development Duke OIT mobiledev@oit.duke.edu for more details)

If you’re doing app development on behalf of the University with the goal to publish your app under the Duke University brand on Apple’s App Store, you can use University app development resources. OIT has built a team of mobile app development expertise to help develop, test and launch your apps.

What We Offer

  • Enterprise Distribution. If you have an iOS app that you would like to distribute internal to Duke University (i.e. to staff, faculty, students) then this is what you want. We can host a build of your application and make it available on dukeapps.duke.edu site, which will require a Duke NetID for authentication of users to download and install your app.
  • Beta Distribution. When you have tested your application and are ready to distribute it to external testers we can help with that too. We will work with your sign your application for distribution and set up Duke’s TestFlight platform for iOS.
  • Publishing on the App Store. If you are ready to release your application to the general public under Duke University brand on the App Store we will work with you to sign your application for distribution, navigate Apple’s review process, and finally, make your app available under Duke University’s account. For security reasons we maintain strict control over Duke University App Store account. When distributing an iOS apps on the Apple App Store or using our Enterprise Distribution services this security restriction means that we will need access to your source code base.


Student Resources for development projects.

If you’re a student or faculty doing app development inside the University for use by students or staff, you can use University Co-Lab development resources.

What We Offer

  • Co-Lab Tech Resources, including Office Hours and Slack: lab.duke.edu/resources
  • Co-Lab Developer Documentation: documentation.colab.duke.edu
  • Student App store: appstore.colab.duke.edu
  • Co-Lab APIs: apidocs.colab.duke.edu
  • Co-Lab App Manager: appmanager.colab.duke.edu
  • Streamer: https://streamer.oit.duke.edu
  • VM-Manage: vm-manage.oit.duke.edu
  • Gitlab: gitlab.oit.duke.edu

External App Development Vendors

We maintain a list of approved app development vendors who other members of staff/faculty have used to develop mobile apps.

List of approved mobile app development vendors – contact mobiledev@oit.duke.edu for details.

Mobile App Directory

Duke University Released Applications

Public iOS applications produced by Duke University are published on Apple’s App Store. Search your iPhone App Store for “Duke University” for the latest applications.

Duke App Icons

Duke University internal Applications

Other mobile applications, intended for Duke employees/student use are available on Duke’s internal App store: dukeapps.duke.edu for details (NetID/Shiboleth authentication required).

Duke Apps website

Duke University Student Applications

Student developed applications are made available on the Colab App Store (visit appstore.colab.duke.edu for latest releases.)

Duke University App Store

Building a Website

Sites are complex digitals spaces with evolving digital standards that can have very steep learning curves. It takes multiple teams of people to keep sites running securely and smoothly. Accessibility, security, design, and development are areas that most communicators must have a basic understanding of in order to produce an effective digital product.

Building a site at Duke may seem a little daunting but the guide below can act as a starting point for building secure, accessible, on-brand sites for your organization.

Domains – What is the url?


  • Third-level domains: (require University Communications approval)
    ex. trinity.duke.edu, publicaffairs.duke.edu
  • Fourth-level domains:
    labs.trinity.duke.edu, project.chemistry.duke.edu
    does not require ONC approval and are managed through system administrators


Web Accessibility – Who can see it?

Everyone. Everyone should be able to access a public site at Duke. Duke’s Web Accessibility Initiative exists to ensure people with a wide range of abilities have equal access to Duke’s web content. It is the central resource for information, guidelines, and Duke’s official web accessibility guidelines.

Common Integration Areas – Can it work with…?

Integration with enterprise systems depends on the application and format. Please contact the applications support teams directly for more integration.

Web Security – Is it safe?

Security is CRITICAL. If a site is deemed to be a security risk (through a breach or lack of appropriate security or versioning upgrades) the IT Security Office reserves the right to take a site offline until that site is cleared to be restored.

You should be aware of the following security policies and guidelines:

  • Data Classification Standard. Duke has defined three classes of information: Sensitive, Restricted and Public.
  • Web Hosting Policy. Guidance and options for those managing websites at Duke.
  • Acceptable Use. Establish and promote the ethical, legal, and secure use of computing and electronic communications for all members of Duke University and its affiliated entities.

Service Level Agreements – How can I keep it up?

–What does maintenance really mean?

Once a site is launched and past its QA period, sites typically move into a “maintenance” phase. Maintenance can refer to the general updates of the site but the most critical component is the upkeep needed to keep the environment (infrastructure) up-to-date. Restated: the platform (Drupal/WordPress), as well as the hosting space, require regular attention and updates to keep them from becoming a security risk.

If you’re working with a vendor: Any work being done through a contract organization – internal or external – requires a minimum service-level agreement of 10 hours per year. Due to the changing nature of the web and the need for version and security upgrades on our preferred platforms, site owners need to identify some portion of their budget and calendar for updates and patching. Without this, sites are subject to vulnerability and attacks. Should a security breach occur, the security office may remove the affected site until it can be confirmed as no longer a risk. IT organizations such as OIT and DHTS cannot be held responsible for sites and actions that they did not create nor participate in.

Web Site Development – How do I make it?

Self Service Site Options – Sites@Duke

Duke Sites@Duke platform is WordPress build that offers a robust set of easy-to-use tools, including Duke-related themes and a Duke URL. The service also provides user and group management through the Duke NetID authentication system.

Duke’s WordPress service provides an easy way for Duke faculty, staff and students to set up a website or blog using predefined design templates (themes) and plugins that users can choose to enable within their sites as they see fit. There is no charge to users.

Semi-custom Using Existing Themes

There are several administrative themes or templates available as a base for Duke sites. The semi-custom options are offered through the Central Web Services group and through some preferred vendors. The use of an existing theme will ensure compliance with the Duke brand and is usually a more cost-effective solution for groups with limited budgets.

Custom internal – Duke Web Services, Trinity Technology Services, and the other web development groups across campus

Custom websites can be developed using internal and external resources. With custom site development a bidding process is required. (See Working with Vendors) After obtaining 3 bids (one of which MUST be from an internal service provider if the service is offered within Duke) you will also need to coordinate hosting and domains. (see below). Any custom work still has an expectation to meet technical and branding requirements. We encourage you to invite the Marketing office into your project as a liaison with your project, the service provider, and the broader Duke.

External Vendors

The abundance of work across Duke can’t be met by the in-house resources alone. We utilize vendors from around the area including some in other areas of the country and abroad. The following guidelines have been developed to streamline the process of working with external vendors. (See Working with Vendors)

Hosting – Where Does it Live?

Providers within Duke

  • OIT maintains a centralized web hosting environment that provides virtual servers (VMs) to both OIT supported services as well as applications and services supported by the departments and schools across Duke University. To meet the needs of a majority of OIT’s VM requests and to provide a consistent offering, a set of standard offerings and processes has been created and details can be found at the following links:
  • DHTS Centralized frameworks are based on the following technologies and platforms:
    • External Web Sites: DRUPAL Content Management Platform (Linux, Apache, MySQL and PHP based). Some of our old sites are in Xoops CMS until we migrate away to DRUPAL
    • Intranet Sites: Mocrosoft Sharepoint 2010 (Windows Server, IIS, MS SQL Server and .NET based)
    • Contact the DHTS web services group for more information.
  • Your school/dept/unit
  • External (requires Web Governance Group approval)
  • External vendors need to host through Duke

Types of Hosting

  • Sites@Duke: free
  • Virtual Machine: custom
    • Compliance with Duke’s security standards
    • Automatic OS updates/upgrade
    • Help with Shib and site set up
    • Backups and monitoring
    • DNS assistance
  • External (requires WGG review): really custom

Web Resources at Duke

Alert Bar

Syndication technology allows for a web bar to appear automatically on websites across the university to highlight emergency news and other alerts. The alert bar accommodates two levels of information. Level 1 alerts, represented by a red bar, will be used for emergencies and will link to the DukeALERT website for additional information. Level 2 alerts, represented by an orange bar, will be used for important messages such as pending severe weather or a gas leak in a building. Download instructions for adding the DukeALERT bar to your website.

Web Fonts

Web fonts are a great way to enhance your site. They provide a more creative license in our communication materials and allow more flexibility and scalability across devices. Because they are vector based they render with crisp edges, clean lines and deep color.

Fonts affect load times as well as your sites’ aesthetic. Don’t use more than 2-3 fonts per site as this will negatively impact your sites’ performance. Since they play such a vital role in a consistent brand execution, refer to the university’s brand system for current font systems and use.

As always, our legacy fonts of Interstate and Garamond are available by request. See University Logos and Fonts in the Brand Guide.


A website has no value if no one can find it. Therefore, a critical component of any online strategy is search engine optimization (SEO). SEO is by no means an exact science. There is no single action or technique a website owner can employ to ensure his or her site will rank well. By following a basic set of principles for good web content design, the chances of achieving favorable rankings greatly increases.

Use this checklist.

Domain Names

Domain names require approval from the Office of Public Affairs. As a general rule, try to stay away from long, cumbersome spellings or ambiguous acronyms. Use fourth level domains if possible to show associations between units and schools.

Domains obtained by third party organization are the responsibility of the purchaser and should not utilize the duke brand without permission. Read the Duke Domain Request Policy and follow the link at the bottom of the page to complete the request form.


Duke’s preferred platform for measuring web site traffic is Google Analytics. If you are unfamiliar with Google analytics or need help getting started, check out Google’s tutorials.


Duke sites and applications must accommodate a baseline level of accessibility to ensure our content reaches as many people as possible.  Duke aims to meet the WCAG 2.0 AA standard. The Web Content Accessibility Guidelines (WCAG) are driven by the larger international standards organization for the internet, the W3C. These standards, published in 2008, are based on 4 key principles: Perceivable, Operable, Understandable and Robust. Within these standards are 3 levels on conformance. A, AA, AAA.

It is important to note that web accessibility is accommodated through both the back-end development of a website AND the content that website houses. PDF’s are a big culprit of accessibility violations and it is critical that our communications professional know and understand the pitfalls of the web accessibility from all angles. Duke also has dedicated resources for educating and addressing web accessibility. Please visit the Duke Web Accessibility site for more information.

Service Level Agreements

Any work being done through a contract organization – internal or external – requires a minimum service-level agreement of 10 hours per year. Due to the changing nature of the web and the need for version and security upgrades on our preferred platforms, site owners need to identify some portion of their budget and calendar for updates and patching. Without this, sites are subject to vulnerability and attacks. Should a security breach occur, the security office may remove the affected site until it can be confirmed as no longer a risk. IT organizations such as OIT and DHTS cannot be held responsible for sites and actions that they did not create nor participate in.


Duke websites present a very viable risk to the university and can provide an avenue of attack against other Duke systems. There is a direct relationship between website compromises and unpatched web environments and associated servers. In an effort to improve the security of all Duke’s websites, the IT Security Office (ITSO), Office of Information Technology (OIT) and University Communications have developed guidance and options for those managing websites at Duke.

Website Best Practices

A little goes a long way. Though there are a lot of industry standards with regards to mark up, responsive design, SEO, etc, here are general considerations to keep in mind when taking on a new project: (From Bean Creative)

  1. Go responsive — all design is responsive design. Your content needs to be accessible whether the user is on a mobile device with a 5″ screen or a desktop computer with a 30″ screen.
  2. Offer mobile-first design, with progressive enhancement for larger screens
  3. Optimize accessibility to create a user experience that is fully accessible to all viewers — everything from supporting people with disabilities to serving up clear images for devices that support 3x+
  4. Emphasize UX with good typography, leveraging the increasing number of web-specific typefaces and typekits, like Google Web Fonts, Adobe Typekit, etc.
  5. Focus on long-form content as opposed to click-thru content
  6. Provide CLEAR, real time feedback during form interactions. Don’t force users to guess the formatting needed, and consider small additions like auto tabbing between fields and formatting as you type to be super user-centric

Favicons and App Icons

The Garamond “D” makes is a great option to use as the favicon for a website or the home screen icon for your app. Download the full favicon pack or use the icons hosted below.

Powered by WordPress & Theme by Anders Norén