# 07 Vendor register

Every organization that stores, processes, transmits, or can reach data or systems inside the [SOC 2 scope](/soc2/01-scope). The customer-facing sub-processor list in [legal/orbit/sub-processors](/legal/orbit/sub-processors) is a subset of this page and must never contradict it.

Risk tier:

- **High**: stores or processes customer data, or holds administrative access to in-scope systems. Needs a security report (SOC 2 Type II or ISO 27001), a DPA, and a yearly review.
- **Medium**: sees limited customer data in transit or metadata, or supports operations. Needs a DPA or equivalent terms and a review every two years.
- **Low**: no customer data, no system access. Recorded only.

"Report" below records what we have **collected and read**, not what the vendor advertises. Until a report is on file, the column says "request".

| Vendor | Purpose | Data or access | Location | Tier | Report on file | DPA on file | Last review |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [Cloud provider] | Production hosting | All in-scope data | India region | High | request | request | never |
| Cloudflare, Inc. | DNS, TLS, WAF, tunnel, inbound email routing | All traffic in transit; inbound mail for routed domains | Global, US company | High | request | request | never |
| GitHub, Inc. | Source code, CI, reviews | Source code; CI secrets | US | High | request | request | never |
| Resend, Inc. | Outbound transactional email | Recipient addresses, subjects, message content | US | High | request | request | never |
| Stripe, Inc. | Card payments | Payment tokens, billing contact | US and global | High | request | request | never |
| Razorpay Software Pvt Ltd | Indian payments | Payment tokens, billing contact | India | High | request | request | never |
| Google LLC (Workspace, OAuth, Gemini where approved) | Calendar sync on customer request; AI for apps the app register approves | Data the customer authorises; prompts for approved apps | US and global | High | request | request | never |
| Domain registrar [name] | Domain ownership | Control of every hostname | [ ] | High | n/a | n/a | never |
| ntfy.sh | Operational alerts | Alert text | [ ] | Medium | n/a | n/a | never. **Replace with a private channel before Phase 2**: public topics are readable by anyone who knows the name, and alert text can carry log lines |
| Log platform [name] | Central logs | Logs (no customer content by policy) | [India] | High | request | request | never |
| Uptime monitor [name] | External checks | Public URLs only | [ ] | Low | n/a | n/a | never |
| Compliance platform [name, if chosen] | Evidence collection | Read access to GitHub, cloud, identity | [ ] | High | request | request | never |
| Penetration test firm [name] | Annual pentest | Test access to in-scope surfaces | [ ] | Medium | n/a | NDA | never |
| CPA firm [name] | SOC 2 examination | Evidence and policies under NDA | [ ] | Medium | n/a | engagement letter | never |
| Anthropic (Claude Code) | AI coding agents used by personnel | Source code and anything an agent session reads, including files on the host it runs on | US | High | request | request | never. Agent sessions must not run on production hosts (see [17](/soc2/17-ai-agents)) |

## Review procedure

1. Before onboarding a High vendor: collect the report, read the opinion and the exceptions section, list its complementary user entity controls, map each to one of our controls or record the gap, sign or accept the DPA, add the vendor to the customer sub-processor page if it touches customer data, and give business customers 30 days' notice.
2. Yearly: repeat with the newest report. Check for a bridge letter if the report period ended more than three months ago.
3. Offboarding: revoke credentials and API keys, confirm deletion of our data, record the date.