Vendor Assessment

While security was a conversation about your own servers, everything under review was internal. Who holds access, whether data is encrypted, whether departing employees' accounts get locked — check those and the job was done.

Theo found where that assumption broke two months before a compliance audit. Going through the card statements, the company was paying for twenty-three outside tools, and customer data flowed into nine of them. The notification provider held every customer's email address; the support tool held fragments of documents customers had pasted in. Of the nine, two had supplied a security certification and one had a data processing agreement in place. None of these tools had been attached in secret. They attach the same day you enter a card number, so nobody had built a step in between.

Vendor assessment is the process of checking those nine before they get attached. It passes the question customers asked you down one level, which is why your own certification covers those providers too.

Six steps, from building the list to setting how often you look again.

1. Write down every tool in use. Memory misses things, so pull from card statements and single sign-on logs — that's what surfaces the ones an individual attached on a free plan.
2. Grade them. The test is whether customer data reaches the tool and, if so, what kind. Whole customer documents rank highest, email addresses sit in the middle, internal staff calendars rank low. Defining what each grade has to supply is what keeps you from digging equally deep into all twenty-three.
3. Request material. High grades get asked for a SOC 2 report or an ISO 27001 certificate, and a questionnaire goes out where neither exists. Ask for their own list of sub-processors too: your customer data travels that far.
4. Review what arrives. What you are reading is not whether a certificate exists but its scope and its dates — which services were assessed, whether the period has lapsed, and whether the specific product you use falls inside.
5. Align the contracts. Put a data processing agreement in place to set the scope and responsibility of processing on your behalf, require notice before they hand work to another provider, and write the incident notification window as a number of hours.
6. Set the re-review cycle. Annually is typical, every six months for high grades, because certificates renew yearly and their sub-processors change.

One more gate keeps this from being a one-time exercise. Add a field to the purchase approval flow asking whether this assessment was passed, and the list maintains itself. Without that field, you are emailing twenty companies again two months before the next audit, and half of them take six weeks to reply.

Legal owns the paperwork and Theo handles the technical check. Whether a certificate's scope covers the feature you actually use, and how far the data really travels, are not judgments anyone can make without knowing the code. Grace decides the grading thresholds and the exceptions — the case where no certificate exists and no alternative tool exists does come up, and accepting that is a company-level call.

Sofia meets the same process from the opposite direction, because enterprise customers ask Pagedeck these questions when they adopt it. The document that arrives then is a security questionnaire, nearly identical in form to what you send your own providers. Keeping the answers you collected shortens the time it takes to answer theirs, which is why a process that reads as pure overhead ends up paying for itself in the sales cycle.

There are four moments. The first is before adoption, and it is the cheapest one: a problem found in a tool already in use takes weeks to migrate away from, while before adoption you simply pick a different tool. The rest are contract renewal, compliance audit preparation, and the day news breaks that the provider had an incident.

Removal belongs in the process too. An account still live at a tool nobody has opened in six months still holds customer data. When the list gets reviewed, unused providers get cancelled, deletion gets requested, and the confirmation gets filed as evidence. An assessor asked about a provider you stopped using wants that confirmation, not a recollection.

"Did we get a SOC 2 report before attaching this? Customer emails go into it."

Checking the gate that belongs before adoption.

"They have a certificate and the product we use is outside its scope."

The name is there and nothing was actually verified.

"We need their sub-processor list too. Our customer data travels that far."

The assessment reaches one level further down.

After building the list of twenty-three, Theo sorted them into three grades. Requests went to the nine high-grade providers first, and seven returned a certificate or a completed questionnaire within six weeks. Of the remaining two, one said it had no certification and one did not reply.

How Grace handled those two says something about the process. The one that never replied had an alternative, so the migration happened within two weeks. The one with no certification had no alternative, so it stayed — with the data sent to it changed from email addresses to internal customer identifiers. The outcome is not always pass or fail; reducing what gets sent so the grade drops is the third available answer.

The most common belief is that obtaining the certificate completes the job, since collecting a document looks like the point. Certificates carry a scope and a period, though. The company name matches while the assessed service is not the product you use, and a report dated a year ago leaves everything since then unverified. The type that checks whether controls held for six months also differs from the type that examines the design at a single point in time. Filing the PDF and marking it passed is how a company ends up getting cited on that same item during its own audit.

The other one is that small tools can be skipped, since a small invoice suggests a small risk. The test here is what data travels, not what it costs. A $23-a-month notification tool holds every customer's email address, and a free survey tool accumulates customer names and companies. A $2,300-a-month tool may handle nothing but staff calendars. Sort the list by price and work down from the top, and the genuinely risky entries stay near the bottom, unexamined until something goes wrong at one of them.