Vendor & Subprocessor Risk
If your vendor gets breached, you get breached. You are the Data Controller; they are the Processor. The liability flows upwards.
Data Processing Agreements (DPAs)
A DPA is a legally binding contract that stipulates exactly how a vendor can use your data. Without an executed DPA, sharing PII with a SaaS vendor is an illegal disclosure.
| Certification | Meaning |
|---|---|
| SOC 2 Type II | Audited proof that security controls operate effectively over time. |
| ISO 27001 | International standard for Information Security Management Systems. |