Vendor management policy

Rules#

1. No vendor without a register entry. Before a new SDK, API, SaaS tool, AI provider, relay, or contractor touches in-scope data or systems, it is added to the vendor register with purpose, data, location and risk tier VND-01. The compliance ship gate requires the same for any third-party service.
2. High-risk vendors are reviewed before onboarding and yearly VND-02: collect the SOC 2 Type II or ISO 27001 report (and bridge letter if needed), read the opinion and exceptions, list the complementary user entity controls and map each to our controls, and record the decision. A vendor without a report needs a security questionnaire and a recorded risk acceptance.
3. Contracts for vendors processing customer data include confidentiality, security obligations, breach notification within a stated time, sub-processor disclosure, deletion at the end, and audit or report rights. Click-through terms are acceptable where the vendor offers a DPA that covers these VND-03.
4. Customer notice: business customers get 30 days' notice before a new sub-processor handles their data, and the public sub-processor page is updated at the same time VND-04.
5. AI providers follow the app register: only the providers it approves for a given app and data, with retention and no-training settings recorded.
6. Offboarding: credentials revoked, data deletion confirmed in writing, register updated with the end date.
7. Concentration: for each High vendor, the register notes what happens if it disappears, and 21 covers the critical ones.