VENDOR & THIRD-PARTY RISK POLICY

1. PRINCIPLES

• Use the fewest providers that can safely run the platform.
• Share the minimum data a provider needs to perform its function.
• Prefer providers with recognised security certifications and a published transfer mechanism.
• No provider is added for advertising or cross-site tracking purposes.

2. ASSESSMENT BEFORE ONBOARDING

Before a provider processes any personal data we review:

• What categories of data it will handle and why that is necessary.
• Its security posture and independent assurance (for example SOC 2, ISO 27001).
• Its data protection terms, subprocessing rules and breach notification commitments.
• Processing locations and the transfer mechanism relied on for any export from the UK/EEA.
• Business continuity and our ability to migrate away if the provider fails.

3. RISK TIERS

• Tier 1 — critical: hosting, database, authentication, payments. Assessed in full, monitored continuously, contractually bound by data processing terms.
• Tier 2 — supporting: email delivery, AI model serving. Assessed for data handling and transfers, reviewed annually.
• Tier 3 — incidental: tooling with no access to member personal data. Lightweight review.

4. CONTRACTS

Providers handling personal data must be bound by a data processing agreement containing confidentiality, security, subprocessing, assistance, deletion and audit obligations, with Standard Contractual Clauses or an equivalent safeguard where data leaves the UK/EEA.

5. ONGOING MONITORING

We monitor provider status pages and security bulletins, review the provider list at least annually, and re-assess whenever a provider materially changes its processing, ownership or subprocessors. Software dependencies are scanned for known vulnerabilities and patched by severity.

6. OFFBOARDING

When a provider is retired we revoke credentials, export or migrate data, and require deletion or return of the personal data it held.

7. THE CURRENT LIST

Our live providers, what they process and where, are published in the Subprocessor List. Questions: privacy@reggaeverseos.com.