Add new url fields to vendors

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2025-05-27 20:07:15 -07:00
parent a4a279c5de
commit 6eb3332103
15 changed files with 837 additions and 359 deletions
--- a/pkg/agents/vendor_assessment.go
+++ b/pkg/agents/vendor_assessment.go
@@ -39,19 +39,21 @@ type (
 	}

 	vendorInfo struct {
-		Name                       string   `json:"name"`
-		Description                string   `json:"description"`
-		Category                   string   `json:"category"`
-		HeadquarterAddress         string   `json:"headquarter_address"`
-		LegalName                  string   `json:"legal_name"`
-		PrivacyPolicyURL           string   `json:"privacy_policy_url"`
-		ServiceLevelAgreementURL   string   `json:"service_level_agreement_url"`
-		DataProcessingAgreementURL string   `json:"data_processing_agreement_url"`
-		SecurityPageURL            string   `json:"security_page_url"`
-		TrustPageURL               string   `json:"trust_page_url"`
-		TermsOfServiceURL          string   `json:"terms_of_service_url"`
-		StatusPageURL              string   `json:"status_page_url"`
-		Certifications             []string `json:"certifications"`
+		Name                          string   `json:"name"`
+		Description                   string   `json:"description"`
+		Category                      string   `json:"category"`
+		HeadquarterAddress            string   `json:"headquarter_address"`
+		LegalName                     string   `json:"legal_name"`
+		PrivacyPolicyURL              string   `json:"privacy_policy_url"`
+		ServiceLevelAgreementURL      string   `json:"service_level_agreement_url"`
+		DataProcessingAgreementURL    string   `json:"data_processing_agreement_url"`
+		BusinessAssociateAgreementURL string   `json:"business_associate_agreement_url"`
+		SubprocessorsListURL          string   `json:"subprocessors_list_url"`
+		SecurityPageURL               string   `json:"security_page_url"`
+		TrustPageURL                  string   `json:"trust_page_url"`
+		TermsOfServiceURL             string   `json:"terms_of_service_url"`
+		StatusPageURL                 string   `json:"status_page_url"`
+		Certifications                []string `json:"certifications"`
 	}
 )

@@ -70,6 +72,8 @@ const (
 		- privacy_policy_url: URL to privacy policy page
 		- service_level_agreement_url: URL to SLA page
 		- data_processing_agreement_url: URL to DPA page
+		- business_associate_agreement_url: URL to BAA page
+		- subprocessors_list_url: URL to subprocessors/subcontractors list page
 		- security_page_url: URL to security information page
 		- trust_page_url: URL to trust/compliance page
 		- terms_of_service_url: URL to terms of service page
@@ -116,11 +120,15 @@ const (
 			"privacy_policy_url": "https://stripe.com/privacy",
 			"service_level_agreement_url": "https://stripe.com/sla",
 			"data_processing_agreement_url": "https://stripe.com/dpa",
+			"business_associate_agreement_url": "https://stripe.com/baa",
+			"subprocessors_list_url": "https://stripe.com/subprocessors",
 			"security_page_url": "https://stripe.com/security",
 			"trust_page_url": "https://stripe.com/trust",
 			"terms_of_service_url": "https://stripe.com/terms",
 			"status_page_url": "https://status.stripe.com",
-			"certifications": ["SOC1", "SOC2", "PCI DSS Level 1", "ISO 27001"],
+			"business_associate_agreement_url": "https://stripe.com/baa",
+			"subprocessors_list_url": "https://stripe.com/subprocessors",
+			"certifications": ["SOC1", "SOC2", "PCI DSS Level 1", "ISO 27001"]
 			"category": "FINANCE"
 		}

--- a/pkg/coredata/migrations/20250528T001641Z.sql
+++ b/pkg/coredata/migrations/20250528T001641Z.sql
@@ -0,0 +1,86 @@
+ALTER TABLE vendors
+  ADD COLUMN business_associate_agreement_url TEXT,
+  ADD COLUMN subprocessors_list_url TEXT;
+
+UPDATE vendors SET
+  business_associate_agreement_url = CASE name
+    WHEN 'Notion' THEN 'https://www.notion.so/notion/Business-Associate-Agreement-909d9f4ccca041b1a23d0fe6e56fa111'
+    WHEN 'OpenAI' THEN 'https://openai.com/policies/business-terms/'
+    WHEN 'Amazon Web Services (AWS)' THEN 'https://aws.amazon.com/compliance/hipaa-compliance/'
+    WHEN 'Google Cloud Platform' THEN 'https://cloud.google.com/terms/hipaa-baa'
+    WHEN 'Microsoft Azure' THEN 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech'
+    WHEN 'Cal.com' THEN 'https://app.cal.com/apps/baa-for-hipaa'
+    WHEN 'Fly.io' THEN 'https://fly.io/documents'
+    WHEN 'New Relic' THEN 'https://newrelic.com/termsandconditions/hipaabaafaq'
+    WHEN 'Gusto' THEN 'https://support.gusto.com/article/152166121100000/The-Health-Insurance-Portability-and-Accountability-Act-of-1996-HIPAA'
+    WHEN 'Microsoft 365' THEN 'https://learn.microsoft.com/en-us/compliance/regulatory/offering-hipaa-hitech'
+    WHEN 'Monday.com' THEN 'https://monday.com/l/privacy/hipaa-baa'
+    WHEN 'Atlassian' THEN 'https://www.atlassian.com/legal/business-associate-agreement'
+    WHEN 'Resend' THEN 'https://newrelic.com/termsandconditions/hipaabaafaq'
+    END,
+  subprocessors_list_url = CASE name
+    WHEN 'Github' THEN 'https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors'
+    WHEN 'Notion' THEN 'https://www.notion.so/notion/Notion-s-List-of-Subprocessors-268fa5bcfa0f46b6bc29436b21676734'
+    WHEN 'Mintlify' THEN 'https://security.mintlify.com'
+    WHEN 'Segment' THEN 'https://www.twilio.com/en-us/legal/sub-processors'
+    WHEN 'Heroku' THEN 'https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf'
+    WHEN 'Linear' THEN 'https://linear.app/dpa'
+    WHEN 'Hubspot' THEN 'https://legal.hubspot.com/sub-processors-page'
+    WHEN 'Google Workspace' THEN 'https://workspace.google.com/terms/subprocessors/'
+    WHEN 'Algolia' THEN 'https://www.algolia.com/policies/infrastructure-and-sub-processors'
+    WHEN 'PostHog' THEN 'https://posthog.com/dpa'
+    WHEN 'Airtable' THEN 'https://www.airtable.com/company/subprocessors'
+    WHEN 'OpenAI' THEN 'https://openai.com/policies/sub-processor-list/'
+    WHEN 'Anthropic' THEN 'https://trust.anthropic.com/subprocessors'
+    WHEN 'Amazon Web Services (AWS)' THEN 'https://aws.amazon.com/compliance/sub-processors/'
+    WHEN 'Calendly' THEN 'https://help.calendly.com/hc/en-us/articles/360047345493-Calendly-sub-processors-GDPR-CCPA'
+    WHEN 'jsDelivr' THEN 'https://www.jsdelivr.com/terms/sub-processors'
+    WHEN 'Clerk' THEN 'https://clerk.com/legal/subprocessors'
+    WHEN 'Plausible Analytics' THEN 'https://plausible.io/privacy'
+    WHEN 'Docker' THEN 'https://www.docker.com/trust/privacy/sub-processors/'
+    WHEN 'Brex' THEN 'https://trust-portal.brex.com'
+    WHEN 'Ramp' THEN 'https://trust.ramp.com/'
+    WHEN 'ClickHouse' THEN 'https://clickhouse.com/legal/agreements/subprocessors'
+    WHEN 'Tailscale' THEN 'https://tailscale.com/dpa-subprocessors'
+    WHEN 'Probo' THEN 'https://www.getprobo.com/subprocessors'
+    WHEN 'folk' THEN 'https://www.folk.app/privacy-policy#3-list-of-sub-processors'
+    WHEN 'Claap' THEN 'https://www.claap.io/legal/privacy-policy#sub-processors'
+    WHEN 'Pitch' THEN 'https://pitch.com/dpa#annex-7-2'
+    WHEN 'Spendesk' THEN 'https://www.spendesk.com/legals/subprocessors/'
+    WHEN 'Lever' THEN 'https://www.lever.co/subprocessors-archive-june-2023/'
+    WHEN 'Google Cloud Platform' THEN 'https://cloud.google.com/terms/subprocessors'
+    WHEN 'Microsoft Azure' THEN 'https://www.microsoft.com/en-us/download/details.aspx?id=50426'
+    WHEN 'Fly.io' THEN 'https://fly.io/legal/sub-processors/'
+    WHEN 'Upstash' THEN 'https://trust.upstash.com/subprocessors'
+    WHEN 'bunny.net' THEN 'https://bunny.net/gdpr/sub-processors/'
+    WHEN 'ClickUp' THEN 'https://clickup.com/terms/dpa/subprocessors'
+    WHEN 'New Relic' THEN 'https://newrelic.com/sub-processors'
+    WHEN 'Pylon' THEN 'https://usepylon.com/subprocessors'
+    WHEN 'Loops' THEN 'https://loops.so/subprocessors'
+    WHEN 'Perplexity' THEN 'https://trust.perplexity.ai/'
+    WHEN 'Mailchimp' THEN 'https://mailchimp.com/legal/subprocessors/'
+    WHEN 'Otter.ai' THEN 'https://otter.ai/subprocessors'
+    WHEN 'Resend' THEN 'https://newrelic.com/sub-processors'
+    WHEN 'OVHcloud global' THEN 'https://www.ovh.ie/support/termsofservice/OVH%20IE%20Sub%20processors.pdf'
+    WHEN 'OVHcloud US' THEN 'https://storage.gra.cloud.ovh.net/v1/AUTH_325716a587c64897acbef9a4a4726e38/contracts/30c4ab8-OVH_Sub_processors-IE-2.0.pdf'
+    WHEN 'Pipedrive' THEN 'https://www.pipedrive.com/en/subprocessors'
+    WHEN 'Plesk' THEN 'https://www.plesk.com/wp-content/uploads/legal/gdpr3.pdf'
+    WHEN 'Brevo' THEN 'https://www.brevo.com/legal/termsofuse/#sub-processors'
+    WHEN 'Better Stack' THEN 'https://betterstack.com/dpa/schedules'
+    WHEN 'PlanetScale' THEN 'https://planetscale.com/legal/subprocessors'
+    WHEN 'Microsoft 365' THEN 'https://www.microsoft.com/en-us/download/details.aspx?id=50426'
+    WHEN 'Bitwarden' THEN 'https://bitwarden.com/help/subprocessors/'
+    WHEN 'Framer' THEN 'https://www.framer.com/legal/sub-processors/'
+    WHEN 'Cal.com' THEN 'https://security.cal.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57'
+    WHEN 'monday.com' THEN 'https://monday.com/l/privacy/sub-processors-subsidiaries-support'
+    WHEN 'Carta' THEN 'https://carta.com/legal/carta-europe/data-processor-agreement/'
+    WHEN 'Apollo.io' THEN 'https://trust.apollo.io/'
+    WHEN 'Atlassian' THEN 'https://www.atlassian.com/legal/sub-processors'
+    WHEN 'Webflow' THEN 'https://uploads-ssl.webflow.com/5d80c03f1edd7bd68fcdb623/657c411c020d1ee5f047f6ab_20231207%20-%20List%20of%20approved%20Sub-processors.pdf'
+    WHEN '1Password' THEN 'https://1passwordstatic.com/files/legal-center/notice-of-updates-to-the-1password-subprocessor-list.pdf'
+    WHEN 'Checkr' THEN 'https://checkr.com/sub-processor-list'
+    WHEN 'Rippling' THEN 'https://app.rippling.com/legal/subprocessors'
+    WHEN 'Twilio' THEN 'https://www.twilio.com/en-us/legal/sub-processors'
+    WHEN 'Cursor' THEN 'https://trust.cursor.com/subprocessors'
+    WHEN 'Pulley' THEN 'https://large-walk-bd5.notion.site/6449d3ecd2854af0a313b6e8679b5795?v=d61abc36355842bb939d49544f18dc95'
+    END;
--- a/pkg/coredata/vendor.go
+++ b/pkg/coredata/vendor.go
@@ -28,26 +28,28 @@ import (

 type (
 	Vendor struct {
-		ID                         gid.GID        `db:"id"`
-		OrganizationID             gid.GID        `db:"organization_id"`
-		Name                       string         `db:"name"`
-		Description                *string        `db:"description"`
-		Category                   VendorCategory `db:"category"`
-		HeadquarterAddress         *string        `db:"headquarter_address"`
-		LegalName                  *string        `db:"legal_name"`
-		WebsiteURL                 *string        `db:"website_url"`
-		PrivacyPolicyURL           *string        `db:"privacy_policy_url"`
-		ServiceLevelAgreementURL   *string        `db:"service_level_agreement_url"`
-		DataProcessingAgreementURL *string        `db:"data_processing_agreement_url"`
-		Certifications             []string       `db:"certifications"`
-		BusinessOwnerID            *gid.GID       `db:"business_owner_id"`
-		SecurityOwnerID            *gid.GID       `db:"security_owner_id"`
-		StatusPageURL              *string        `db:"status_page_url"`
-		TermsOfServiceURL          *string        `db:"terms_of_service_url"`
-		SecurityPageURL            *string        `db:"security_page_url"`
-		TrustPageURL               *string        `db:"trust_page_url"`
-		CreatedAt                  time.Time      `db:"created_at"`
-		UpdatedAt                  time.Time      `db:"updated_at"`
+		ID                            gid.GID        `db:"id"`
+		OrganizationID                gid.GID        `db:"organization_id"`
+		Name                          string         `db:"name"`
+		Description                   *string        `db:"description"`
+		Category                      VendorCategory `db:"category"`
+		HeadquarterAddress            *string        `db:"headquarter_address"`
+		LegalName                     *string        `db:"legal_name"`
+		WebsiteURL                    *string        `db:"website_url"`
+		PrivacyPolicyURL              *string        `db:"privacy_policy_url"`
+		ServiceLevelAgreementURL      *string        `db:"service_level_agreement_url"`
+		DataProcessingAgreementURL    *string        `db:"data_processing_agreement_url"`
+		BusinessAssociateAgreementURL *string        `db:"business_associate_agreement_url"`
+		SubprocessorsListURL          *string        `db:"subprocessors_list_url"`
+		Certifications                []string       `db:"certifications"`
+		BusinessOwnerID               *gid.GID       `db:"business_owner_id"`
+		SecurityOwnerID               *gid.GID       `db:"security_owner_id"`
+		StatusPageURL                 *string        `db:"status_page_url"`
+		TermsOfServiceURL             *string        `db:"terms_of_service_url"`
+		SecurityPageURL               *string        `db:"security_page_url"`
+		TrustPageURL                  *string        `db:"trust_page_url"`
+		CreatedAt                     time.Time      `db:"created_at"`
+		UpdatedAt                     time.Time      `db:"updated_at"`
 	}

 	Vendors []*Vendor
@@ -83,6 +85,8 @@ SELECT
    privacy_policy_url,
    service_level_agreement_url,
    data_processing_agreement_url,
+    business_associate_agreement_url,
+    subprocessors_list_url,
    certifications,
    business_owner_id,
    security_owner_id,
@@ -141,6 +145,8 @@ INSERT INTO
        privacy_policy_url,
        service_level_agreement_url,
        data_processing_agreement_url,
+        business_associate_agreement_url,
+        subprocessors_list_url,
        certifications,
        business_owner_id,
        security_owner_id,
@@ -164,6 +170,8 @@ VALUES (
    @privacy_policy_url,
    @service_level_agreement_url,
    @data_processing_agreement_url,
+    @business_associate_agreement_url,
+    @subprocessors_list_url,
    @certifications,
    @business_owner_id,
    @security_owner_id,
@@ -177,27 +185,29 @@ VALUES (
 `

 	args := pgx.StrictNamedArgs{
-		"tenant_id":                     scope.GetTenantID(),
-		"vendor_id":                     v.ID,
-		"organization_id":               v.OrganizationID,
-		"name":                          v.Name,
-		"description":                   v.Description,
-		"category":                      v.Category,
-		"headquarter_address":           v.HeadquarterAddress,
-		"legal_name":                    v.LegalName,
-		"website_url":                   v.WebsiteURL,
-		"privacy_policy_url":            v.PrivacyPolicyURL,
-		"service_level_agreement_url":   v.ServiceLevelAgreementURL,
-		"data_processing_agreement_url": v.DataProcessingAgreementURL,
-		"certifications":                v.Certifications,
-		"business_owner_id":             v.BusinessOwnerID,
-		"security_owner_id":             v.SecurityOwnerID,
-		"status_page_url":               v.StatusPageURL,
-		"terms_of_service_url":          v.TermsOfServiceURL,
-		"security_page_url":             v.SecurityPageURL,
-		"trust_page_url":                v.TrustPageURL,
-		"created_at":                    v.CreatedAt,
-		"updated_at":                    v.UpdatedAt,
+		"tenant_id":                        scope.GetTenantID(),
+		"vendor_id":                        v.ID,
+		"organization_id":                  v.OrganizationID,
+		"name":                             v.Name,
+		"description":                      v.Description,
+		"category":                         v.Category,
+		"headquarter_address":              v.HeadquarterAddress,
+		"legal_name":                       v.LegalName,
+		"website_url":                      v.WebsiteURL,
+		"privacy_policy_url":               v.PrivacyPolicyURL,
+		"service_level_agreement_url":      v.ServiceLevelAgreementURL,
+		"data_processing_agreement_url":    v.DataProcessingAgreementURL,
+		"business_associate_agreement_url": v.BusinessAssociateAgreementURL,
+		"subprocessors_list_url":           v.SubprocessorsListURL,
+		"certifications":                   v.Certifications,
+		"business_owner_id":                v.BusinessOwnerID,
+		"security_owner_id":                v.SecurityOwnerID,
+		"status_page_url":                  v.StatusPageURL,
+		"terms_of_service_url":             v.TermsOfServiceURL,
+		"security_page_url":                v.SecurityPageURL,
+		"trust_page_url":                   v.TrustPageURL,
+		"created_at":                       v.CreatedAt,
+		"updated_at":                       v.UpdatedAt,
 	}
 	_, err := conn.Exec(ctx, q, args)
 	return err
@@ -241,6 +251,8 @@ SELECT
    privacy_policy_url,
    service_level_agreement_url,
    data_processing_agreement_url,
+    business_associate_agreement_url,
+    subprocessors_list_url,
    certifications,
    business_owner_id,
    security_owner_id,
@@ -295,6 +307,8 @@ SET
 	privacy_policy_url = @privacy_policy_url,
 	service_level_agreement_url = @service_level_agreement_url,
 	data_processing_agreement_url = @data_processing_agreement_url,
+	business_associate_agreement_url = @business_associate_agreement_url,
+	subprocessors_list_url = @subprocessors_list_url,
 	certifications = @certifications,
 	status_page_url = @status_page_url,
 	terms_of_service_url = @terms_of_service_url,
@@ -309,24 +323,26 @@ WHERE %s
 	q = fmt.Sprintf(q, scope.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_id":                     v.ID,
-		"updated_at":                    time.Now(),
-		"name":                          v.Name,
-		"description":                   v.Description,
-		"category":                      v.Category,
-		"headquarter_address":           v.HeadquarterAddress,
-		"legal_name":                    v.LegalName,
-		"website_url":                   v.WebsiteURL,
-		"privacy_policy_url":            v.PrivacyPolicyURL,
-		"service_level_agreement_url":   v.ServiceLevelAgreementURL,
-		"data_processing_agreement_url": v.DataProcessingAgreementURL,
-		"certifications":                v.Certifications,
-		"status_page_url":               v.StatusPageURL,
-		"terms_of_service_url":          v.TermsOfServiceURL,
-		"security_page_url":             v.SecurityPageURL,
-		"trust_page_url":                v.TrustPageURL,
-		"business_owner_id":             v.BusinessOwnerID,
-		"security_owner_id":             v.SecurityOwnerID,
+		"vendor_id":                        v.ID,
+		"updated_at":                       time.Now(),
+		"name":                             v.Name,
+		"description":                      v.Description,
+		"category":                         v.Category,
+		"headquarter_address":              v.HeadquarterAddress,
+		"legal_name":                       v.LegalName,
+		"website_url":                      v.WebsiteURL,
+		"privacy_policy_url":               v.PrivacyPolicyURL,
+		"service_level_agreement_url":      v.ServiceLevelAgreementURL,
+		"data_processing_agreement_url":    v.DataProcessingAgreementURL,
+		"business_associate_agreement_url": v.BusinessAssociateAgreementURL,
+		"subprocessors_list_url":           v.SubprocessorsListURL,
+		"certifications":                   v.Certifications,
+		"status_page_url":                  v.StatusPageURL,
+		"terms_of_service_url":             v.TermsOfServiceURL,
+		"security_page_url":                v.SecurityPageURL,
+		"trust_page_url":                   v.TrustPageURL,
+		"business_owner_id":                v.BusinessOwnerID,
+		"security_owner_id":                v.SecurityOwnerID,
 	}

 	maps.Copy(args, scope.SQLArguments())
@@ -344,7 +360,7 @@ func (v Vendor) ExpireNonExpiredRiskAssessments(

 	q := `
 	UPDATE vendor_risk_assessments
-	SET 
+	SET
 		expires_at = @now,
 		updated_at = @now
 	WHERE
--- a/pkg/probo/vendor_service.go
+++ b/pkg/probo/vendor_service.go
@@ -31,43 +31,47 @@ type (
 	}

 	CreateVendorRequest struct {
-		OrganizationID             gid.GID
-		Name                       string
-		Description                *string
-		HeadquarterAddress         *string
-		LegalName                  *string
-		WebsiteURL                 *string
-		Category                   *coredata.VendorCategory
-		PrivacyPolicyURL           *string
-		ServiceLevelAgreementURL   *string
-		DataProcessingAgreementURL *string
-		Certifications             []string
-		SecurityPageURL            *string
-		TrustPageURL               *string
-		TermsOfServiceURL          *string
-		StatusPageURL              *string
-		BusinessOwnerID            *gid.GID
-		SecurityOwnerID            *gid.GID
+		OrganizationID                gid.GID
+		Name                          string
+		Description                   *string
+		HeadquarterAddress            *string
+		LegalName                     *string
+		WebsiteURL                    *string
+		Category                      *coredata.VendorCategory
+		PrivacyPolicyURL              *string
+		ServiceLevelAgreementURL      *string
+		DataProcessingAgreementURL    *string
+		BusinessAssociateAgreementURL *string
+		SubprocessorsListURL          *string
+		Certifications                []string
+		SecurityPageURL               *string
+		TrustPageURL                  *string
+		TermsOfServiceURL             *string
+		StatusPageURL                 *string
+		BusinessOwnerID               *gid.GID
+		SecurityOwnerID               *gid.GID
 	}

 	UpdateVendorRequest struct {
-		ID                         gid.GID
-		Name                       *string
-		Description                *string
-		HeadquarterAddress         *string
-		LegalName                  *string
-		WebsiteURL                 *string
-		TermsOfServiceURL          *string
-		Category                   *coredata.VendorCategory
-		PrivacyPolicyURL           *string
-		ServiceLevelAgreementURL   *string
-		DataProcessingAgreementURL *string
-		Certifications             []string
-		SecurityPageURL            *string
-		TrustPageURL               *string
-		StatusPageURL              *string
-		BusinessOwnerID            *gid.GID
-		SecurityOwnerID            *gid.GID
+		ID                            gid.GID
+		Name                          *string
+		Description                   *string
+		HeadquarterAddress            *string
+		LegalName                     *string
+		WebsiteURL                    *string
+		TermsOfServiceURL             *string
+		Category                      *coredata.VendorCategory
+		PrivacyPolicyURL              *string
+		ServiceLevelAgreementURL      *string
+		DataProcessingAgreementURL    *string
+		BusinessAssociateAgreementURL *string
+		SubprocessorsListURL          *string
+		Certifications                []string
+		SecurityPageURL               *string
+		TrustPageURL                  *string
+		StatusPageURL                 *string
+		BusinessOwnerID               *gid.GID
+		SecurityOwnerID               *gid.GID
 	}

 	AssessVendorRequest struct {
@@ -158,6 +162,14 @@ func (s VendorService) Update(
 				vendor.DataProcessingAgreementURL = req.DataProcessingAgreementURL
 			}

+			if req.BusinessAssociateAgreementURL != nil {
+				vendor.BusinessAssociateAgreementURL = req.BusinessAssociateAgreementURL
+			}
+
+			if req.SubprocessorsListURL != nil {
+				vendor.SubprocessorsListURL = req.SubprocessorsListURL
+			}
+
 			if req.Category != nil {
 				vendor.Category = *req.Category
 			} else {
@@ -276,22 +288,24 @@ func (s VendorService) Create(
 ) (*coredata.Vendor, error) {
 	now := time.Now()
 	vendor := &coredata.Vendor{
-		ID:                         gid.New(s.svc.scope.GetTenantID(), coredata.VendorEntityType),
-		Name:                       req.Name,
-		CreatedAt:                  now,
-		UpdatedAt:                  now,
-		Description:                req.Description,
-		HeadquarterAddress:         req.HeadquarterAddress,
-		LegalName:                  req.LegalName,
-		WebsiteURL:                 req.WebsiteURL,
-		PrivacyPolicyURL:           req.PrivacyPolicyURL,
-		ServiceLevelAgreementURL:   req.ServiceLevelAgreementURL,
-		DataProcessingAgreementURL: req.DataProcessingAgreementURL,
-		Certifications:             req.Certifications,
-		SecurityPageURL:            req.SecurityPageURL,
-		TrustPageURL:               req.TrustPageURL,
-		StatusPageURL:              req.StatusPageURL,
-		TermsOfServiceURL:          req.TermsOfServiceURL,
+		ID:                            gid.New(s.svc.scope.GetTenantID(), coredata.VendorEntityType),
+		Name:                          req.Name,
+		CreatedAt:                     now,
+		UpdatedAt:                     now,
+		Description:                   req.Description,
+		HeadquarterAddress:            req.HeadquarterAddress,
+		LegalName:                     req.LegalName,
+		WebsiteURL:                    req.WebsiteURL,
+		PrivacyPolicyURL:              req.PrivacyPolicyURL,
+		ServiceLevelAgreementURL:      req.ServiceLevelAgreementURL,
+		DataProcessingAgreementURL:    req.DataProcessingAgreementURL,
+		BusinessAssociateAgreementURL: req.BusinessAssociateAgreementURL,
+		SubprocessorsListURL:          req.SubprocessorsListURL,
+		Certifications:                req.Certifications,
+		SecurityPageURL:               req.SecurityPageURL,
+		TrustPageURL:                  req.TrustPageURL,
+		StatusPageURL:                 req.StatusPageURL,
+		TermsOfServiceURL:             req.TermsOfServiceURL,
 	}

 	err := s.svc.pg.WithTx(
@@ -439,22 +453,24 @@ func (s VendorService) Assess(
 	}

 	vendor := &coredata.Vendor{
-		ID:                         req.ID,
-		Name:                       vendorInfo.Name,
-		WebsiteURL:                 &req.WebsiteURL,
-		Description:                &vendorInfo.Description,
-		Category:                   coredata.VendorCategory(vendorInfo.Category),
-		HeadquarterAddress:         &vendorInfo.HeadquarterAddress,
-		LegalName:                  &vendorInfo.LegalName,
-		PrivacyPolicyURL:           &vendorInfo.PrivacyPolicyURL,
-		ServiceLevelAgreementURL:   &vendorInfo.ServiceLevelAgreementURL,
-		DataProcessingAgreementURL: &vendorInfo.DataProcessingAgreementURL,
-		SecurityPageURL:            &vendorInfo.SecurityPageURL,
-		TrustPageURL:               &vendorInfo.TrustPageURL,
-		TermsOfServiceURL:          &vendorInfo.TermsOfServiceURL,
-		StatusPageURL:              &vendorInfo.StatusPageURL,
-		Certifications:             vendorInfo.Certifications,
-		UpdatedAt:                  time.Now(),
+		ID:                            req.ID,
+		Name:                          vendorInfo.Name,
+		WebsiteURL:                    &req.WebsiteURL,
+		Description:                   &vendorInfo.Description,
+		Category:                      coredata.VendorCategory(vendorInfo.Category),
+		HeadquarterAddress:            &vendorInfo.HeadquarterAddress,
+		LegalName:                     &vendorInfo.LegalName,
+		PrivacyPolicyURL:              &vendorInfo.PrivacyPolicyURL,
+		ServiceLevelAgreementURL:      &vendorInfo.ServiceLevelAgreementURL,
+		DataProcessingAgreementURL:    &vendorInfo.DataProcessingAgreementURL,
+		BusinessAssociateAgreementURL: &vendorInfo.BusinessAssociateAgreementURL,
+		SubprocessorsListURL:          &vendorInfo.SubprocessorsListURL,
+		SecurityPageURL:               &vendorInfo.SecurityPageURL,
+		TrustPageURL:                  &vendorInfo.TrustPageURL,
+		TermsOfServiceURL:             &vendorInfo.TermsOfServiceURL,
+		StatusPageURL:                 &vendorInfo.StatusPageURL,
+		Certifications:                vendorInfo.Certifications,
+		UpdatedAt:                     time.Now(),
 	}

 	return vendor, nil
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -593,6 +593,8 @@ type Vendor implements Node {
  privacyPolicyUrl: String
  serviceLevelAgreementUrl: String
  dataProcessingAgreementUrl: String
+  businessAssociateAgreementUrl: String
+  subprocessorsListUrl: String
  certifications: [String!]!
  securityPageUrl: String
  trustPageUrl: String
@@ -1144,6 +1146,8 @@ input CreateVendorInput {
  category: VendorCategory
  serviceLevelAgreementUrl: String
  dataProcessingAgreementUrl: String
+  businessAssociateAgreementUrl: String
+  subprocessorsListUrl: String
  certifications: [String!]
  securityPageUrl: String
  trustPageUrl: String
@@ -1162,6 +1166,8 @@ input UpdateVendorInput {
  privacyPolicyUrl: String
  serviceLevelAgreementUrl: String
  dataProcessingAgreementUrl: String
+  businessAssociateAgreementUrl: String
+  subprocessorsListUrl: String
  websiteUrl: String
  legalName: String
  headquarterAddress: String
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
@@ -673,28 +673,30 @@ type ComplexityRoot struct {
 	}

 	Vendor struct {
-		BusinessOwner              func(childComplexity int) int
-		Category                   func(childComplexity int) int
-		Certifications             func(childComplexity int) int
-		ComplianceReports          func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorComplianceReportOrderBy) int
-		CreatedAt                  func(childComplexity int) int
-		DataProcessingAgreementURL func(childComplexity int) int
-		Description                func(childComplexity int) int
-		HeadquarterAddress         func(childComplexity int) int
-		ID                         func(childComplexity int) int
-		LegalName                  func(childComplexity int) int
-		Name                       func(childComplexity int) int
-		Organization               func(childComplexity int) int
-		PrivacyPolicyURL           func(childComplexity int) int
-		RiskAssessments            func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorRiskAssessmentOrder) int
-		SecurityOwner              func(childComplexity int) int
-		SecurityPageURL            func(childComplexity int) int
-		ServiceLevelAgreementURL   func(childComplexity int) int
-		StatusPageURL              func(childComplexity int) int
-		TermsOfServiceURL          func(childComplexity int) int
-		TrustPageURL               func(childComplexity int) int
-		UpdatedAt                  func(childComplexity int) int
-		WebsiteURL                 func(childComplexity int) int
+		BusinessAssociateAgreementURL func(childComplexity int) int
+		BusinessOwner                 func(childComplexity int) int
+		Category                      func(childComplexity int) int
+		Certifications                func(childComplexity int) int
+		ComplianceReports             func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorComplianceReportOrderBy) int
+		CreatedAt                     func(childComplexity int) int
+		DataProcessingAgreementURL    func(childComplexity int) int
+		Description                   func(childComplexity int) int
+		HeadquarterAddress            func(childComplexity int) int
+		ID                            func(childComplexity int) int
+		LegalName                     func(childComplexity int) int
+		Name                          func(childComplexity int) int
+		Organization                  func(childComplexity int) int
+		PrivacyPolicyURL              func(childComplexity int) int
+		RiskAssessments               func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorRiskAssessmentOrder) int
+		SecurityOwner                 func(childComplexity int) int
+		SecurityPageURL               func(childComplexity int) int
+		ServiceLevelAgreementURL      func(childComplexity int) int
+		StatusPageURL                 func(childComplexity int) int
+		SubprocessorsListURL          func(childComplexity int) int
+		TermsOfServiceURL             func(childComplexity int) int
+		TrustPageURL                  func(childComplexity int) int
+		UpdatedAt                     func(childComplexity int) int
+		WebsiteURL                    func(childComplexity int) int
 	}

 	VendorComplianceReport struct {
@@ -3507,6 +3509,13 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin

 		return e.complexity.UserEdge.Node(childComplexity), true

+	case "Vendor.businessAssociateAgreementUrl":
+		if e.complexity.Vendor.BusinessAssociateAgreementURL == nil {
+			break
+		}
+
+		return e.complexity.Vendor.BusinessAssociateAgreementURL(childComplexity), true
+
 	case "Vendor.businessOwner":
 		if e.complexity.Vendor.BusinessOwner == nil {
 			break
@@ -3643,6 +3652,13 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin

 		return e.complexity.Vendor.StatusPageURL(childComplexity), true

+	case "Vendor.subprocessorsListUrl":
+		if e.complexity.Vendor.SubprocessorsListURL == nil {
+			break
+		}
+
+		return e.complexity.Vendor.SubprocessorsListURL(childComplexity), true
+
 	case "Vendor.termsOfServiceUrl":
 		if e.complexity.Vendor.TermsOfServiceURL == nil {
 			break
@@ -4686,6 +4702,8 @@ type Vendor implements Node {
  privacyPolicyUrl: String
  serviceLevelAgreementUrl: String
  dataProcessingAgreementUrl: String
+  businessAssociateAgreementUrl: String
+  subprocessorsListUrl: String
  certifications: [String!]!
  securityPageUrl: String
  trustPageUrl: String
@@ -5237,6 +5255,8 @@ input CreateVendorInput {
  category: VendorCategory
  serviceLevelAgreementUrl: String
  dataProcessingAgreementUrl: String
+  businessAssociateAgreementUrl: String
+  subprocessorsListUrl: String
  certifications: [String!]
  securityPageUrl: String
  trustPageUrl: String
@@ -5255,6 +5275,8 @@ input UpdateVendorInput {
  privacyPolicyUrl: String
  serviceLevelAgreementUrl: String
  dataProcessingAgreementUrl: String
+  businessAssociateAgreementUrl: String
+  subprocessorsListUrl: String
  websiteUrl: String
  legalName: String
  headquarterAddress: String
@@ -9860,6 +9882,10 @@ func (ec *executionContext) fieldContext_AssessVendorPayload_vendor(_ context.Co
 				return ec.fieldContext_Vendor_serviceLevelAgreementUrl(ctx, field)
 			case "dataProcessingAgreementUrl":
 				return ec.fieldContext_Vendor_dataProcessingAgreementUrl(ctx, field)
+			case "businessAssociateAgreementUrl":
+				return ec.fieldContext_Vendor_businessAssociateAgreementUrl(ctx, field)
+			case "subprocessorsListUrl":
+				return ec.fieldContext_Vendor_subprocessorsListUrl(ctx, field)
 			case "certifications":
 				return ec.fieldContext_Vendor_certifications(ctx, field)
 			case "securityPageUrl":
@@ -25673,6 +25699,10 @@ func (ec *executionContext) fieldContext_UpdateVendorPayload_vendor(_ context.Co
 				return ec.fieldContext_Vendor_serviceLevelAgreementUrl(ctx, field)
 			case "dataProcessingAgreementUrl":
 				return ec.fieldContext_Vendor_dataProcessingAgreementUrl(ctx, field)
+			case "businessAssociateAgreementUrl":
+				return ec.fieldContext_Vendor_businessAssociateAgreementUrl(ctx, field)
+			case "subprocessorsListUrl":
+				return ec.fieldContext_Vendor_subprocessorsListUrl(ctx, field)
 			case "certifications":
 				return ec.fieldContext_Vendor_certifications(ctx, field)
 			case "securityPageUrl":
@@ -27046,6 +27076,88 @@ func (ec *executionContext) fieldContext_Vendor_dataProcessingAgreementUrl(_ con
 	return fc, nil
 }

+func (ec *executionContext) _Vendor_businessAssociateAgreementUrl(ctx context.Context, field graphql.CollectedField, obj *types.Vendor) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Vendor_businessAssociateAgreementUrl(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.BusinessAssociateAgreementURL, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Vendor_businessAssociateAgreementUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Vendor",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _Vendor_subprocessorsListUrl(ctx context.Context, field graphql.CollectedField, obj *types.Vendor) (ret graphql.Marshaler) {
+	fc, err := ec.fieldContext_Vendor_subprocessorsListUrl(ctx, field)
+	if err != nil {
+		return graphql.Null
+	}
+	ctx = graphql.WithFieldContext(ctx, fc)
+	defer func() {
+		if r := recover(); r != nil {
+			ec.Error(ctx, ec.Recover(ctx, r))
+			ret = graphql.Null
+		}
+	}()
+	resTmp, err := ec.ResolverMiddleware(ctx, func(rctx context.Context) (any, error) {
+		ctx = rctx // use context from middleware stack in children
+		return obj.SubprocessorsListURL, nil
+	})
+	if err != nil {
+		ec.Error(ctx, err)
+		return graphql.Null
+	}
+	if resTmp == nil {
+		return graphql.Null
+	}
+	res := resTmp.(*string)
+	fc.Result = res
+	return ec.marshalOString2ᚖstring(ctx, field.Selections, res)
+}
+
+func (ec *executionContext) fieldContext_Vendor_subprocessorsListUrl(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "Vendor",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _Vendor_certifications(ctx context.Context, field graphql.CollectedField, obj *types.Vendor) (ret graphql.Marshaler) {
 	fc, err := ec.fieldContext_Vendor_certifications(ctx, field)
 	if err != nil {
@@ -27494,6 +27606,10 @@ func (ec *executionContext) fieldContext_VendorComplianceReport_vendor(_ context
 				return ec.fieldContext_Vendor_serviceLevelAgreementUrl(ctx, field)
 			case "dataProcessingAgreementUrl":
 				return ec.fieldContext_Vendor_dataProcessingAgreementUrl(ctx, field)
+			case "businessAssociateAgreementUrl":
+				return ec.fieldContext_Vendor_businessAssociateAgreementUrl(ctx, field)
+			case "subprocessorsListUrl":
+				return ec.fieldContext_Vendor_subprocessorsListUrl(ctx, field)
 			case "certifications":
 				return ec.fieldContext_Vendor_certifications(ctx, field)
 			case "securityPageUrl":
@@ -28249,6 +28365,10 @@ func (ec *executionContext) fieldContext_VendorEdge_node(_ context.Context, fiel
 				return ec.fieldContext_Vendor_serviceLevelAgreementUrl(ctx, field)
 			case "dataProcessingAgreementUrl":
 				return ec.fieldContext_Vendor_dataProcessingAgreementUrl(ctx, field)
+			case "businessAssociateAgreementUrl":
+				return ec.fieldContext_Vendor_businessAssociateAgreementUrl(ctx, field)
+			case "subprocessorsListUrl":
+				return ec.fieldContext_Vendor_subprocessorsListUrl(ctx, field)
 			case "certifications":
 				return ec.fieldContext_Vendor_certifications(ctx, field)
 			case "securityPageUrl":
@@ -28383,6 +28503,10 @@ func (ec *executionContext) fieldContext_VendorRiskAssessment_vendor(_ context.C
 				return ec.fieldContext_Vendor_serviceLevelAgreementUrl(ctx, field)
 			case "dataProcessingAgreementUrl":
 				return ec.fieldContext_Vendor_dataProcessingAgreementUrl(ctx, field)
+			case "businessAssociateAgreementUrl":
+				return ec.fieldContext_Vendor_businessAssociateAgreementUrl(ctx, field)
+			case "subprocessorsListUrl":
+				return ec.fieldContext_Vendor_subprocessorsListUrl(ctx, field)
 			case "certifications":
 				return ec.fieldContext_Vendor_certifications(ctx, field)
 			case "securityPageUrl":
@@ -31899,7 +32023,7 @@ func (ec *executionContext) unmarshalInputCreateVendorInput(ctx context.Context,
 		asMap[k] = v
 	}

-	fieldsInOrder := [...]string{"organizationId", "name", "description", "headquarterAddress", "legalName", "websiteUrl", "privacyPolicyUrl", "category", "serviceLevelAgreementUrl", "dataProcessingAgreementUrl", "certifications", "securityPageUrl", "trustPageUrl", "statusPageUrl", "termsOfServiceUrl", "businessOwnerId", "securityOwnerId"}
+	fieldsInOrder := [...]string{"organizationId", "name", "description", "headquarterAddress", "legalName", "websiteUrl", "privacyPolicyUrl", "category", "serviceLevelAgreementUrl", "dataProcessingAgreementUrl", "businessAssociateAgreementUrl", "subprocessorsListUrl", "certifications", "securityPageUrl", "trustPageUrl", "statusPageUrl", "termsOfServiceUrl", "businessOwnerId", "securityOwnerId"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -31976,6 +32100,20 @@ func (ec *executionContext) unmarshalInputCreateVendorInput(ctx context.Context,
 				return it, err
 			}
 			it.DataProcessingAgreementURL = data
+		case "businessAssociateAgreementUrl":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("businessAssociateAgreementUrl"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.BusinessAssociateAgreementURL = data
+		case "subprocessorsListUrl":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("subprocessorsListUrl"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.SubprocessorsListURL = data
 		case "certifications":
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("certifications"))
 			data, err := ec.unmarshalOString2ᚕstringᚄ(ctx, v)
@@ -33708,7 +33846,7 @@ func (ec *executionContext) unmarshalInputUpdateVendorInput(ctx context.Context,
 		asMap[k] = v
 	}

-	fieldsInOrder := [...]string{"id", "name", "description", "statusPageUrl", "termsOfServiceUrl", "privacyPolicyUrl", "serviceLevelAgreementUrl", "dataProcessingAgreementUrl", "websiteUrl", "legalName", "headquarterAddress", "category", "certifications", "securityPageUrl", "trustPageUrl", "businessOwnerId", "securityOwnerId"}
+	fieldsInOrder := [...]string{"id", "name", "description", "statusPageUrl", "termsOfServiceUrl", "privacyPolicyUrl", "serviceLevelAgreementUrl", "dataProcessingAgreementUrl", "businessAssociateAgreementUrl", "subprocessorsListUrl", "websiteUrl", "legalName", "headquarterAddress", "category", "certifications", "securityPageUrl", "trustPageUrl", "businessOwnerId", "securityOwnerId"}
 	for _, k := range fieldsInOrder {
 		v, ok := asMap[k]
 		if !ok {
@@ -33771,6 +33909,20 @@ func (ec *executionContext) unmarshalInputUpdateVendorInput(ctx context.Context,
 				return it, err
 			}
 			it.DataProcessingAgreementURL = data
+		case "businessAssociateAgreementUrl":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("businessAssociateAgreementUrl"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.BusinessAssociateAgreementURL = data
+		case "subprocessorsListUrl":
+			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("subprocessorsListUrl"))
+			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
+			if err != nil {
+				return it, err
+			}
+			it.SubprocessorsListURL = data
 		case "websiteUrl":
 			ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("websiteUrl"))
 			data, err := ec.unmarshalOString2ᚖstring(ctx, v)
@@ -40749,6 +40901,10 @@ func (ec *executionContext) _Vendor(ctx context.Context, sel ast.SelectionSet, o
 			out.Values[i] = ec._Vendor_serviceLevelAgreementUrl(ctx, field, obj)
 		case "dataProcessingAgreementUrl":
 			out.Values[i] = ec._Vendor_dataProcessingAgreementUrl(ctx, field, obj)
+		case "businessAssociateAgreementUrl":
+			out.Values[i] = ec._Vendor_businessAssociateAgreementUrl(ctx, field, obj)
+		case "subprocessorsListUrl":
+			out.Values[i] = ec._Vendor_subprocessorsListUrl(ctx, field, obj)
 		case "certifications":
 			out.Values[i] = ec._Vendor_certifications(ctx, field, obj)
 			if out.Values[i] == graphql.Null {
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -246,23 +246,25 @@ type CreateTaskPayload struct {
 }

 type CreateVendorInput struct {
-	OrganizationID             gid.GID                  `json:"organizationId"`
-	Name                       string                   `json:"name"`
-	Description                *string                  `json:"description,omitempty"`
-	HeadquarterAddress         *string                  `json:"headquarterAddress,omitempty"`
-	LegalName                  *string                  `json:"legalName,omitempty"`
-	WebsiteURL                 *string                  `json:"websiteUrl,omitempty"`
-	PrivacyPolicyURL           *string                  `json:"privacyPolicyUrl,omitempty"`
-	Category                   *coredata.VendorCategory `json:"category,omitempty"`
-	ServiceLevelAgreementURL   *string                  `json:"serviceLevelAgreementUrl,omitempty"`
-	DataProcessingAgreementURL *string                  `json:"dataProcessingAgreementUrl,omitempty"`
-	Certifications             []string                 `json:"certifications,omitempty"`
-	SecurityPageURL            *string                  `json:"securityPageUrl,omitempty"`
-	TrustPageURL               *string                  `json:"trustPageUrl,omitempty"`
-	StatusPageURL              *string                  `json:"statusPageUrl,omitempty"`
-	TermsOfServiceURL          *string                  `json:"termsOfServiceUrl,omitempty"`
-	BusinessOwnerID            *gid.GID                 `json:"businessOwnerId,omitempty"`
-	SecurityOwnerID            *gid.GID                 `json:"securityOwnerId,omitempty"`
+	OrganizationID                gid.GID                  `json:"organizationId"`
+	Name                          string                   `json:"name"`
+	Description                   *string                  `json:"description,omitempty"`
+	HeadquarterAddress            *string                  `json:"headquarterAddress,omitempty"`
+	LegalName                     *string                  `json:"legalName,omitempty"`
+	WebsiteURL                    *string                  `json:"websiteUrl,omitempty"`
+	PrivacyPolicyURL              *string                  `json:"privacyPolicyUrl,omitempty"`
+	Category                      *coredata.VendorCategory `json:"category,omitempty"`
+	ServiceLevelAgreementURL      *string                  `json:"serviceLevelAgreementUrl,omitempty"`
+	DataProcessingAgreementURL    *string                  `json:"dataProcessingAgreementUrl,omitempty"`
+	BusinessAssociateAgreementURL *string                  `json:"businessAssociateAgreementUrl,omitempty"`
+	SubprocessorsListURL          *string                  `json:"subprocessorsListUrl,omitempty"`
+	Certifications                []string                 `json:"certifications,omitempty"`
+	SecurityPageURL               *string                  `json:"securityPageUrl,omitempty"`
+	TrustPageURL                  *string                  `json:"trustPageUrl,omitempty"`
+	StatusPageURL                 *string                  `json:"statusPageUrl,omitempty"`
+	TermsOfServiceURL             *string                  `json:"termsOfServiceUrl,omitempty"`
+	BusinessOwnerID               *gid.GID                 `json:"businessOwnerId,omitempty"`
+	SecurityOwnerID               *gid.GID                 `json:"securityOwnerId,omitempty"`
 }

 type CreateVendorPayload struct {
@@ -909,23 +911,25 @@ type UpdateTaskPayload struct {
 }

 type UpdateVendorInput struct {
-	ID                         gid.GID                  `json:"id"`
-	Name                       *string                  `json:"name,omitempty"`
-	Description                *string                  `json:"description,omitempty"`
-	StatusPageURL              *string                  `json:"statusPageUrl,omitempty"`
-	TermsOfServiceURL          *string                  `json:"termsOfServiceUrl,omitempty"`
-	PrivacyPolicyURL           *string                  `json:"privacyPolicyUrl,omitempty"`
-	ServiceLevelAgreementURL   *string                  `json:"serviceLevelAgreementUrl,omitempty"`
-	DataProcessingAgreementURL *string                  `json:"dataProcessingAgreementUrl,omitempty"`
-	WebsiteURL                 *string                  `json:"websiteUrl,omitempty"`
-	LegalName                  *string                  `json:"legalName,omitempty"`
-	HeadquarterAddress         *string                  `json:"headquarterAddress,omitempty"`
-	Category                   *coredata.VendorCategory `json:"category,omitempty"`
-	Certifications             []string                 `json:"certifications,omitempty"`
-	SecurityPageURL            *string                  `json:"securityPageUrl,omitempty"`
-	TrustPageURL               *string                  `json:"trustPageUrl,omitempty"`
-	BusinessOwnerID            *gid.GID                 `json:"businessOwnerId,omitempty"`
-	SecurityOwnerID            *gid.GID                 `json:"securityOwnerId,omitempty"`
+	ID                            gid.GID                  `json:"id"`
+	Name                          *string                  `json:"name,omitempty"`
+	Description                   *string                  `json:"description,omitempty"`
+	StatusPageURL                 *string                  `json:"statusPageUrl,omitempty"`
+	TermsOfServiceURL             *string                  `json:"termsOfServiceUrl,omitempty"`
+	PrivacyPolicyURL              *string                  `json:"privacyPolicyUrl,omitempty"`
+	ServiceLevelAgreementURL      *string                  `json:"serviceLevelAgreementUrl,omitempty"`
+	DataProcessingAgreementURL    *string                  `json:"dataProcessingAgreementUrl,omitempty"`
+	BusinessAssociateAgreementURL *string                  `json:"businessAssociateAgreementUrl,omitempty"`
+	SubprocessorsListURL          *string                  `json:"subprocessorsListUrl,omitempty"`
+	WebsiteURL                    *string                  `json:"websiteUrl,omitempty"`
+	LegalName                     *string                  `json:"legalName,omitempty"`
+	HeadquarterAddress            *string                  `json:"headquarterAddress,omitempty"`
+	Category                      *coredata.VendorCategory `json:"category,omitempty"`
+	Certifications                []string                 `json:"certifications,omitempty"`
+	SecurityPageURL               *string                  `json:"securityPageUrl,omitempty"`
+	TrustPageURL                  *string                  `json:"trustPageUrl,omitempty"`
+	BusinessOwnerID               *gid.GID                 `json:"businessOwnerId,omitempty"`
+	SecurityOwnerID               *gid.GID                 `json:"securityOwnerId,omitempty"`
 }

 type UpdateVendorPayload struct {
@@ -985,28 +989,30 @@ type UserEdge struct {
 }

 type Vendor struct {
-	ID                         gid.GID                           `json:"id"`
-	Name                       string                            `json:"name"`
-	Category                   coredata.VendorCategory           `json:"category"`
-	Description                *string                           `json:"description,omitempty"`
-	Organization               *Organization                     `json:"organization"`
-	ComplianceReports          *VendorComplianceReportConnection `json:"complianceReports"`
-	RiskAssessments            *VendorRiskAssessmentConnection   `json:"riskAssessments"`
-	BusinessOwner              *People                           `json:"businessOwner,omitempty"`
-	SecurityOwner              *People                           `json:"securityOwner,omitempty"`
-	StatusPageURL              *string                           `json:"statusPageUrl,omitempty"`
-	TermsOfServiceURL          *string                           `json:"termsOfServiceUrl,omitempty"`
-	PrivacyPolicyURL           *string                           `json:"privacyPolicyUrl,omitempty"`
-	ServiceLevelAgreementURL   *string                           `json:"serviceLevelAgreementUrl,omitempty"`
-	DataProcessingAgreementURL *string                           `json:"dataProcessingAgreementUrl,omitempty"`
-	Certifications             []string                          `json:"certifications"`
-	SecurityPageURL            *string                           `json:"securityPageUrl,omitempty"`
-	TrustPageURL               *string                           `json:"trustPageUrl,omitempty"`
-	HeadquarterAddress         *string                           `json:"headquarterAddress,omitempty"`
-	LegalName                  *string                           `json:"legalName,omitempty"`
-	WebsiteURL                 *string                           `json:"websiteUrl,omitempty"`
-	CreatedAt                  time.Time                         `json:"createdAt"`
-	UpdatedAt                  time.Time                         `json:"updatedAt"`
+	ID                            gid.GID                           `json:"id"`
+	Name                          string                            `json:"name"`
+	Category                      coredata.VendorCategory           `json:"category"`
+	Description                   *string                           `json:"description,omitempty"`
+	Organization                  *Organization                     `json:"organization"`
+	ComplianceReports             *VendorComplianceReportConnection `json:"complianceReports"`
+	RiskAssessments               *VendorRiskAssessmentConnection   `json:"riskAssessments"`
+	BusinessOwner                 *People                           `json:"businessOwner,omitempty"`
+	SecurityOwner                 *People                           `json:"securityOwner,omitempty"`
+	StatusPageURL                 *string                           `json:"statusPageUrl,omitempty"`
+	TermsOfServiceURL             *string                           `json:"termsOfServiceUrl,omitempty"`
+	PrivacyPolicyURL              *string                           `json:"privacyPolicyUrl,omitempty"`
+	ServiceLevelAgreementURL      *string                           `json:"serviceLevelAgreementUrl,omitempty"`
+	DataProcessingAgreementURL    *string                           `json:"dataProcessingAgreementUrl,omitempty"`
+	BusinessAssociateAgreementURL *string                           `json:"businessAssociateAgreementUrl,omitempty"`
+	SubprocessorsListURL          *string                           `json:"subprocessorsListUrl,omitempty"`
+	Certifications                []string                          `json:"certifications"`
+	SecurityPageURL               *string                           `json:"securityPageUrl,omitempty"`
+	TrustPageURL                  *string                           `json:"trustPageUrl,omitempty"`
+	HeadquarterAddress            *string                           `json:"headquarterAddress,omitempty"`
+	LegalName                     *string                           `json:"legalName,omitempty"`
+	WebsiteURL                    *string                           `json:"websiteUrl,omitempty"`
+	CreatedAt                     time.Time                         `json:"createdAt"`
+	UpdatedAt                     time.Time                         `json:"updatedAt"`
 }

 func (Vendor) IsNode()             {}
--- a/pkg/server/api/console/v1/types/vendor.go
+++ b/pkg/server/api/console/v1/types/vendor.go
@@ -45,22 +45,24 @@ func NewVendorEdge(v *coredata.Vendor, orderBy coredata.VendorOrderField) *Vendo

 func NewVendor(v *coredata.Vendor) *Vendor {
 	return &Vendor{
-		ID:                         v.ID,
-		Name:                       v.Name,
-		Description:                v.Description,
-		StatusPageURL:              v.StatusPageURL,
-		TermsOfServiceURL:          v.TermsOfServiceURL,
-		PrivacyPolicyURL:           v.PrivacyPolicyURL,
-		ServiceLevelAgreementURL:   v.ServiceLevelAgreementURL,
-		DataProcessingAgreementURL: v.DataProcessingAgreementURL,
-		Certifications:             v.Certifications,
-		SecurityPageURL:            v.SecurityPageURL,
-		TrustPageURL:               v.TrustPageURL,
-		HeadquarterAddress:         v.HeadquarterAddress,
-		LegalName:                  v.LegalName,
-		WebsiteURL:                 v.WebsiteURL,
-		Category:                   v.Category,
-		UpdatedAt:                  v.UpdatedAt,
-		CreatedAt:                  v.CreatedAt,
+		ID:                            v.ID,
+		Name:                          v.Name,
+		Description:                   v.Description,
+		StatusPageURL:                 v.StatusPageURL,
+		TermsOfServiceURL:             v.TermsOfServiceURL,
+		PrivacyPolicyURL:              v.PrivacyPolicyURL,
+		ServiceLevelAgreementURL:      v.ServiceLevelAgreementURL,
+		DataProcessingAgreementURL:    v.DataProcessingAgreementURL,
+		BusinessAssociateAgreementURL: v.BusinessAssociateAgreementURL,
+		SubprocessorsListURL:          v.SubprocessorsListURL,
+		Certifications:                v.Certifications,
+		SecurityPageURL:               v.SecurityPageURL,
+		TrustPageURL:                  v.TrustPageURL,
+		HeadquarterAddress:            v.HeadquarterAddress,
+		LegalName:                     v.LegalName,
+		WebsiteURL:                    v.WebsiteURL,
+		Category:                      v.Category,
+		UpdatedAt:                     v.UpdatedAt,
+		CreatedAt:                     v.CreatedAt,
 	}
 }
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -482,23 +482,25 @@ func (r *mutationResolver) CreateVendor(ctx context.Context, input types.CreateV
 	vendor, err := svc.Vendors.Create(
 		ctx,
 		probo.CreateVendorRequest{
-			OrganizationID:             input.OrganizationID,
-			Name:                       input.Name,
-			Description:                input.Description,
-			StatusPageURL:              input.StatusPageURL,
-			TermsOfServiceURL:          input.TermsOfServiceURL,
-			PrivacyPolicyURL:           input.PrivacyPolicyURL,
-			ServiceLevelAgreementURL:   input.ServiceLevelAgreementURL,
-			LegalName:                  input.LegalName,
-			HeadquarterAddress:         input.HeadquarterAddress,
-			WebsiteURL:                 input.WebsiteURL,
-			Category:                   input.Category,
-			DataProcessingAgreementURL: input.DataProcessingAgreementURL,
-			Certifications:             input.Certifications,
-			SecurityPageURL:            input.SecurityPageURL,
-			TrustPageURL:               input.TrustPageURL,
-			BusinessOwnerID:            input.BusinessOwnerID,
-			SecurityOwnerID:            input.SecurityOwnerID,
+			OrganizationID:                input.OrganizationID,
+			Name:                          input.Name,
+			Description:                   input.Description,
+			StatusPageURL:                 input.StatusPageURL,
+			TermsOfServiceURL:             input.TermsOfServiceURL,
+			PrivacyPolicyURL:              input.PrivacyPolicyURL,
+			ServiceLevelAgreementURL:      input.ServiceLevelAgreementURL,
+			LegalName:                     input.LegalName,
+			HeadquarterAddress:            input.HeadquarterAddress,
+			WebsiteURL:                    input.WebsiteURL,
+			Category:                      input.Category,
+			DataProcessingAgreementURL:    input.DataProcessingAgreementURL,
+			BusinessAssociateAgreementURL: input.BusinessAssociateAgreementURL,
+			SubprocessorsListURL:          input.SubprocessorsListURL,
+			Certifications:                input.Certifications,
+			SecurityPageURL:               input.SecurityPageURL,
+			TrustPageURL:                  input.TrustPageURL,
+			BusinessOwnerID:               input.BusinessOwnerID,
+			SecurityOwnerID:               input.SecurityOwnerID,
 		},
 	)
 	if err != nil {
@@ -514,23 +516,25 @@ func (r *mutationResolver) UpdateVendor(ctx context.Context, input types.UpdateV
 	svc := GetTenantService(ctx, r.proboSvc, input.ID.TenantID())

 	vendor, err := svc.Vendors.Update(ctx, probo.UpdateVendorRequest{
-		ID:                         input.ID,
-		Name:                       input.Name,
-		Description:                input.Description,
-		StatusPageURL:              input.StatusPageURL,
-		TermsOfServiceURL:          input.TermsOfServiceURL,
-		PrivacyPolicyURL:           input.PrivacyPolicyURL,
-		ServiceLevelAgreementURL:   input.ServiceLevelAgreementURL,
-		DataProcessingAgreementURL: input.DataProcessingAgreementURL,
-		SecurityPageURL:            input.SecurityPageURL,
-		TrustPageURL:               input.TrustPageURL,
-		HeadquarterAddress:         input.HeadquarterAddress,
-		LegalName:                  input.LegalName,
-		WebsiteURL:                 input.WebsiteURL,
-		Category:                   input.Category,
-		Certifications:             input.Certifications,
-		BusinessOwnerID:            input.BusinessOwnerID,
-		SecurityOwnerID:            input.SecurityOwnerID,
+		ID:                            input.ID,
+		Name:                          input.Name,
+		Description:                   input.Description,
+		StatusPageURL:                 input.StatusPageURL,
+		TermsOfServiceURL:             input.TermsOfServiceURL,
+		PrivacyPolicyURL:              input.PrivacyPolicyURL,
+		ServiceLevelAgreementURL:      input.ServiceLevelAgreementURL,
+		DataProcessingAgreementURL:    input.DataProcessingAgreementURL,
+		BusinessAssociateAgreementURL: input.BusinessAssociateAgreementURL,
+		SubprocessorsListURL:          input.SubprocessorsListURL,
+		SecurityPageURL:               input.SecurityPageURL,
+		TrustPageURL:                  input.TrustPageURL,
+		HeadquarterAddress:            input.HeadquarterAddress,
+		LegalName:                     input.LegalName,
+		WebsiteURL:                    input.WebsiteURL,
+		Category:                      input.Category,
+		Certifications:                input.Certifications,
+		BusinessOwnerID:               input.BusinessOwnerID,
+		SecurityOwnerID:               input.SecurityOwnerID,
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot update vendor: %w", err)