Privacy Policy

To monitor vendor risk, we process the vendor and dependency information you provide, the risk signals we track against those vendors, and the account information needed to run your workspace.

This typically includes vendor identities, the dependency weight you assign or we infer, delivery and performance data relevant to reliability tracking, and the financial and regional signals that feed a vendor risk score.

Data is used to map your vendor network, calculate and update risk scores, surface delivery, financial and regional risk, and identify concentration. In short, it is used to deliver the monitoring you signed up for, and to keep that monitoring current.

Vendor and financial signals are handled as sensitive commercial data. They are used to inform your risk view and are not sold. Access is limited to what is required to provide and support the service.

We do not sell your vendor or supply chain data. Information is shared only with the service providers needed to operate the platform, and only to the extent required to run it. Those providers are bound to handle it in line with this policy.

Data is encrypted in transit and at rest, and access is scoped by role so that vendor and financial detail is not exposed more widely than the work requires. Our broader approach is described on the security page.

We keep your data for as long as your account needs it to keep monitoring your network. On request, or when an account is closed, data is removed within a defined window rather than retained indefinitely.

You can request access to, correction of, or deletion of the data associated with your account. You can also ask us to stop processing specific vendor information, subject to the effect that has on the monitoring we can provide.

Where data is processed across regions to deliver the service, we apply the same handling and protection standards described here regardless of where processing takes place.