Vendor Relationships for Third-Party Risk

Relationship Type

Description

Vendor / Service Provider

General third party providing goods or services that support business operations. May or may not handle data.

Examples: IT consultants, Big 4 firms

Subprocessor

Engaged by your data processor to handle personal data on their behalf (used by your vendor).

Examples: AWS, Google Cloud, Snowflake

Processor (acts on our behalf)

Processes personal data strictly under your organization’s instructions and for your purposes.

Examples: ADP (payroll), HubSpot (marketing automation), Zendesk (customer support)

Controller (peer data controller)

Independently determines how and why data is processed but shares data with you for mutual objectives.

Examples: A financial institution sharing customer data for a joint offering, or an insurance partner

Joint Controller

Jointly determines with your organization how and why personal data is processed; shared accountability.

Examples: A co-branded marketing initiative with Meta (Facebook) or a research partnership with a university.

Software / SaaS Provider

Provides software applications delivered over the internet; often stores or accesses company data.

Examples: Mycroft, Salesforce, Slack, Notion, Microsoft 365, Atlassian (Jira, Confluence).

Cloud / Infrastructure Provider (IaaS/PaaS, DNS, CDN)

Supplies computing infrastructure or networking services for hosting, storage, or delivery.

Examples: Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), Cloudflare, Akamai.

Managed Service Provider (MSP/MSSP)

Remotely manages IT systems or security functions, often with privileged access.

Examples: Kyndryl, Arctic Wolf, Datto, CDW Managed Services.

Identity & Security Provider (SSO/IAM/EDR)

Provides authentication, identity, and endpoint protection tools to secure access and data.

Examples: Okta (SSO/IAM), Duo Security (MFA), CrowdStrike (EDR), Microsoft Defender.

Payment / Financial Services (Gateway/Processor/Bank)

Handles or facilitates payments, fund transfers, or financial data processing.

Examples: Stripe, PayPal, Square, Visa, RBC

Data / Analytics / Enrichment Provider

Supplies, analyzes, or enriches datasets, often combining internal and external data sources.

Examples: Snowflake, Segment, ZoomInfo, Databricks

Professional Services / Consultant

Provides specialized expertise or advisory services, often with access to internal systems or information.

Examples: PwC, Deloitte, Gartner, legal or compliance consultants

Contractor / Individual

Independent person engaged for a project or role with system or data access.

Examples: Independent developers, fractional executives, freelance designers

Integration / Technology Partner

Provides APIs, connectors, or integrations between your systems and other platforms.

Examples: Zapier, Workato, Mulesoft, Segment

Marketplace Partner / Seller

Offers apps, plug-ins, or solutions through a marketplace ecosystem connected to your platform.

Examples: Salesforce AppExchange, AWS Marketplace, Shopify App Store

Channel / Reseller / Distributor

Sells or distributes your products or services through their own channels.

Examples: Ingram Micro, CDW, SHI

OEM / Embedded Technology Partner

Provides software, firmware, or hardware components embedded into your product or platform.

Examples: Intel, NVIDIA, Twilio, Stripe Connect

Critical Infrastructure Vendor (Telco/Colo/Network)

Provides essential communication, hosting, or networking infrastructure services.

Examples: Bell, Rogers, Equinix, Verizon

Open-Source Project / Maintainer

Community or individual providing open-source components integrated into your systems.

Examples: Linux Foundation, Apache Software Foundation, NPM maintainers

University / Research Partner

Academic or research institution collaborating on data analysis, innovation, or studies.

Examples: MIT, University of Toronto, Standford

Other

Vendor that does not fit any of the default relationships