# Third-Party Management Policy

Last updated: October 22, 2026

Vendors that touch company or customer data are reviewed before use and yearly after, bound by a contract and DPA, and listed publicly when they are sub-processors.

## Scope

All vendors, SaaS tools, contractors and sub-processors that store, process or access company or customer data, or that the production service depends on.

## Vendor tiers

| Tier | Definition | Examples | Review |
| --- | --- | --- | --- |
| Critical | Hosts or processes customer data, or production depends on it | Google Cloud, email delivery, error tracking | Before use and yearly: SOC 2 / ISO 27001 report, DPA, transfer mechanism |
| High | Holds confidential company data | Identity provider, source control, password manager, HR system | Before use and yearly: security questionnaire or report |
| Low | No sensitive data | Design tools without customer data | Before use: owner approval |

## Policy

1. **Before use.** New vendors are recorded in the vendor list and approved by the Security Officer after a review proportionate to tier.
2. **Contracts.** Critical and High vendors have contracts covering confidentiality, security obligations and breach notification. Vendors processing personal data sign a DPA meeting GDPR Art. 28.
3. **Transfers.** For vendors outside the EU/EEA, the transfer mechanism (EU–US Data Privacy Framework certification, SCCs or other) is documented and a transfer impact assessment is done where required.
4. **Region alignment.** Sub-processors handling EU customer data must process it in the EU/EEA, or have an approved transfer mechanism that is disclosed to customers.
5. **Sub-processor list.** A public list of sub-processors, their purpose and location is kept at summerbase.com/policies/subprocessors, split into sub-processors for Customer Data and other service providers that receive only Summerbase's own customer data. Customers are notified at least 10 days before a new sub-processor is added, as the DPA requires.
6. **Annual review.** The Security Officer reviews Critical and High vendors yearly, including their SOC 2 report exceptions and complementary user entity controls (CUECs) that Summerbase must operate.
7. **Offboarding.** When a vendor is retired, data is returned or deleted with confirmation, and access is removed.