Vendor & Subprocessor Management Policy
| Owner | [Security Owner — to be named: founder/CTO] |
| Approved by | [signatory] |
| Effective date | [set on approval] |
| Review cadence | Annual |
| Version | 0.1 — DRAFT |
| TSC mapping | CC9.2 |
1. Purpose
Section titled “1. Purpose”Ensure third parties that process Company or customer data meet the Company’s security commitments, and that the Company can demonstrate oversight of them.
2. Subprocessor inventory
Section titled “2. Subprocessor inventory”The Company maintains a register of all subprocessors that store or process customer data. Current subprocessors (from the CASA self-assessment §1):
| Subprocessor | Purpose | Data |
|---|---|---|
| Clerk | Authentication / identity | User identity |
| Google Cloud | Application hosting (Cloud Run), infra | All platform data |
| Neon | Application database (Postgres) | Orders, PII |
| Cloudflare | R2 object storage, Access, edge/CDN | Documents, PO files |
| Stripe | Billing | Company billing data |
| WhereFour | ERP integration | Order/PO data |
| Prophet21 (Epicor) | Customer ERP integration | Order/PO data |
| Infisical | Secrets management | Credentials |
| 1Password | Secrets / credential vault | Credentials |
| Google Workspace | Email, identity, docs | Company data |
3. Onboarding a new vendor
Section titled “3. Onboarding a new vendor”Before a vendor processes Company or customer data, the Security Owner:
- Confirms the business need and the data the vendor will touch.
- Collects the vendor’s SOC 2 / ISO 27001 report (or equivalent) as inherited evidence; records the report date and any exceptions.
- Signs a Data Processing Agreement (DPA) where the vendor processes personal data.
- Records the vendor in the register with owner, data class, and review date.
4. Ongoing review
Section titled “4. Ongoing review”- The vendor register is reviewed annually: re-collect current SOC 2/ISO reports, re-confirm DPAs, and re-assess risk.
- Subprocessor SOC 2 reports also serve as the Company’s inherited evidence for physical security and data-center controls (CC6.4), since all infrastructure is cloud-hosted.
5. Public subprocessor list
Section titled “5. Public subprocessor list”The Company publishes a current subprocessor list to customers (trust center / website) and updates it when subprocessors change.
6. Review
Section titled “6. Review”Reviewed at least annually by the Security Owner.