Third-Party Management Policy
Last updated: October 22, 2026
Vendors that touch company or customer data are reviewed before use and yearly after, bound by a contract and DPA, and listed publicly when they are sub-processors.
Scope
All vendors, SaaS tools, contractors and sub-processors that store, process or access company or customer data, or that the production service depends on.
Vendor tiers
| Tier | Definition | Examples | Review |
|---|---|---|---|
| Critical | Hosts or processes customer data, or production depends on it | Google Cloud, email delivery, error tracking | Before use and yearly: SOC 2 / ISO 27001 report, DPA, transfer mechanism |
| High | Holds confidential company data | Identity provider, source control, password manager, HR system | Before use and yearly: security questionnaire or report |
| Low | No sensitive data | Design tools without customer data | Before use: owner approval |
Policy
- Before use. New vendors are recorded in the vendor list and approved by the Security Officer after a review proportionate to tier.
- Contracts. Critical and High vendors have contracts covering confidentiality, security obligations and breach notification. Vendors processing personal data sign a DPA meeting GDPR Art. 28.
- Transfers. For vendors outside the EU/EEA, the transfer mechanism (EU–US Data Privacy Framework certification, SCCs or other) is documented and a transfer impact assessment is done where required.
- Region alignment. Sub-processors handling EU customer data must process it in the EU/EEA, or have an approved transfer mechanism that is disclosed to customers.
- Sub-processor list. A public list of sub-processors, their purpose and location is kept at summerbase.com/policies/subprocessors, split into sub-processors for Customer Data and other service providers that receive only Summerbase’s own customer data. Customers are notified at least 10 days before a new sub-processor is added, as the DPA requires.
- Annual review. The Security Officer reviews Critical and High vendors yearly, including their SOC 2 report exceptions and complementary user entity controls (CUECs) that Summerbase must operate.
- Offboarding. When a vendor is retired, data is returned or deleted with confirmation, and access is removed.