Supplier Security Policy (A.5.19)

Document ID: supplier-security-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Annual (policy) + Quarterly (vendor register review)

note

This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.

---

Purpose

Ensure that suppliers and sub-processors who access, process, or store SigmaShake or customer information maintain appropriate security standards.

Supplier categories

Category	Examples	Security requirement
Critical (outage causes Tier-1 service unavailability)	Cloudflare, GitHub, Stripe	Annual DDQ + SOC 2 Type 2 or ISO 27001 report required
Important (outage causes degraded operations or feature loss)	Resend, Anthropic, npm	Annual DDQ + security questionnaire + DPA where customer or personal data flows (see the open exception under "Sub-processor list")
Standard (outage is inconvenient but not customer-impacting)	Discord, HIBP, Google (GA4 and Fonts), Cerebras, jsDelivr	Vendor register entry. A Standard vendor that is also a sub-processor (Google, Cerebras, jsDelivr) still needs a DPA (see the open exception under "Sub-processor list").

The tiers follow outage impact, as in the vendor risk assessment policy (docs/compliance/vendor-risk-assessment.md, sections 3 and 5). Whether a vendor is a sub-processor is a separate flag in the vendors table.

Supplier security requirements

Before onboarding a new Critical or Important supplier:

1. Review their latest SOC 2 Type 2, ISO 27001 certificate, or equivalent
2. Complete the vendor DDQ template in the compliance portal
3. Confirm they state an incident notification time (record the time in the DDQ; this policy sets no fixed number of hours)
4. Register in the vendors table with data access level
5. Obtain a DPA if the supplier processes personal data (GDPR Article 28)

Physical controls inheritance

SigmaShake has no physical infrastructure. All A.7 (Physical) controls are inherited from:

• Cloudflare — data centres, hardware security, environmental controls
• GitHub / Microsoft — repository hosting physical security

Quarterly attestation: physical-controls-inheritance attestation type in the attestations table.

Sub-processor list

The current public sub-processor list is the feed at compliance.sigmashake.com/api/v1/sub-processors.json. The staff-only vendor register in the compliance portal holds the full records. As of 2026-10-10, the feed lists eight sub-processors:

Vendor	Role	Location	DPA status
Cloudflare	Compute, storage, CDN, WAF, DNS, email routing, Workers AI. Hosts all customer content and account data.	USA (SCCs apply for EEA data)	On file
Stripe	Payment processing and billing	USA	On file
GitHub	Source hosting and GitHub App / OAuth sign-in for staff and customers	USA	On file (Microsoft umbrella)
Anthropic	AI inference (chat, rule drafting, support triage, sales classification)	USA	On file
Resend	Transactional email	USA	On file
Google	Analytics (GA4, Consent Mode v2) and Fonts	USA — DPA and transfer assessment pending	Pending
Cerebras	AI inference for rule drafting	USA — DPA and transfer assessment pending	Pending
jsDelivr	CDN for browser libraries	Global CDN — DPA and transfer assessment pending	Pending

Note (2026-10-13): the GitHub purpose in this table now matches the feed. No CI runs on GitHub.

Open exception: this policy requires a DPA before onboarding (see "Supplier security requirements"). The DPA and transfer assessment for Google, Cerebras and jsDelivr are still pending. No transfer impact assessment records exist yet. SCCs are recorded only for Cloudflare.

Annual review

The vendor-refresh collector runs monthly and opens a gap if any vendor report is expiring within 90 days. Full annual review conducted via risk-register-review.

Evidence

Collector	Cadence	Control
vendor-refresh	Monthly	A.5.19–A.5.22
risk-register-review	Quarterly	A.5.4
physical-access-inheritance	Quarterly	CC6.4 (SOC 2)