Rename vendors to third parties

Renames the user-facing 'vendor' concept to 'third party' across the
entire codebase. The shared common_third_parties reference table is
unchanged.

Migration. Renames the vendor_category enum, the vendors and
vendor_<entity> tables (contacts, services, compliance_reports,
business_associate_agreements, data_privacy_agreements,
risk_assessments) and their vendor_id columns, the asset_vendors /
data_vendors / processing_activity_vendors junction tables,
generated_documents.vendors_document_id, the webhook_event_type
'vendor:<verb>' values, and the snapshots_type 'VENDORS' value.

Backend. Renames coredata models and SQL queries, probo services,
GraphQL / MCP API surface, console / trust / webhook resolvers and
types, the CLI (prb vendor* -> prb third-party*; pkg/cmd/vendormgmt
-> pkg/cmd/thirdpartymgmt), the document generator, vetting agent
prompts, and the common-third-parties-import command.

Frontend, packages, n8n, e2e. Renames apps/console pages, components,
hooks, routes, dialogs, and tabs; the shared @probo/vendors package
(now @probo/third-parties); the @probo/ui Vendors atoms (now
ThirdParties, VendorLogo -> ThirdPartyLogo); the n8n community node
actions/vendor folder (now actions/thirdParty); and the e2e Go test
suite (console and MCP). Filesystem and URL paths use kebab-case
(third-parties), GraphQL fields and TypeScript identifiers use
camelCase (thirdParty / thirdParties), Go types use PascalCase
(ThirdParty), and human-facing text uses 'third party' with a space.

Co-authored-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/cmd/asset/create/create.go

@@ -60,7 +60,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 		flagAmount          int
 		flagOwner           string
 		flagDataTypesStored string
-		flagVendorIDs       []string
+		flagThirdPartyIDs   []string
 	)
 
 	cmd := &cobra.Command{
@@ -146,8 +146,8 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 			if flagDataTypesStored != "" {
 				input["dataTypesStored"] = flagDataTypesStored
 			}
-			if len(flagVendorIDs) > 0 {
-				input["vendorIds"] = flagVendorIDs
+			if len(flagThirdPartyIDs) > 0 {
+				input["thirdPartyIds"] = flagThirdPartyIDs
 			}
 
 			data, err := client.Do(
@@ -181,7 +181,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().IntVar(&flagAmount, "amount", 0, "Asset amount")
 	cmd.Flags().StringVar(&flagOwner, "owner", "", "Owner profile ID")
 	cmd.Flags().StringVar(&flagDataTypesStored, "data-types-stored", "", "Data types stored")
-	cmd.Flags().StringSliceVar(&flagVendorIDs, "vendor-ids", nil, "Vendor IDs (comma-separated)")
+	cmd.Flags().StringSliceVar(&flagThirdPartyIDs, "thirdParty-ids", nil, "ThirdParty IDs (comma-separated)")
 
 	return cmd
 }

pkg/cmd/asset/update/update.go

@@ -54,7 +54,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 		flagAmount          int
 		flagOwner           string
 		flagDataTypesStored string
-		flagVendorIDs       []string
+		flagThirdPartyIDs   []string
 	)
 
 	cmd := &cobra.Command{
@@ -103,8 +103,8 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 			if cmd.Flags().Changed("data-types-stored") {
 				input["dataTypesStored"] = flagDataTypesStored
 			}
-			if cmd.Flags().Changed("vendor-ids") {
-				input["vendorIds"] = flagVendorIDs
+			if cmd.Flags().Changed("thirdParty-ids") {
+				input["thirdPartyIds"] = flagThirdPartyIDs
 			}
 
 			if len(input) == 1 {
@@ -141,7 +141,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().IntVar(&flagAmount, "amount", 0, "Asset amount")
 	cmd.Flags().StringVar(&flagOwner, "owner", "", "Owner profile ID")
 	cmd.Flags().StringVar(&flagDataTypesStored, "data-types-stored", "", "Data types stored")
-	cmd.Flags().StringSliceVar(&flagVendorIDs, "vendor-ids", nil, "Vendor IDs (comma-separated)")
+	cmd.Flags().StringSliceVar(&flagThirdPartyIDs, "thirdParty-ids", nil, "ThirdParty IDs (comma-separated)")
 
 	return cmd
 }

pkg/cmd/auditlog/list/list.go

@@ -79,8 +79,8 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 		Short:   "List audit log entries",
 		Aliases: []string{"ls"},
 		Example: `  prb audit-log list
-  prb audit-log list --action core:vendor:create
-  prb audit-log list --resource-type Vendor --limit 50`,
+  prb audit-log list --action core:thirdParty:create
+  prb audit-log list --resource-type ThirdParty --limit 50`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := cmdutil.ValidateOutputFlag(flagOutput); err != nil {
@@ -218,9 +218,9 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().IntVarP(&flagLimit, "limit", "L", 30, "Maximum number of entries to list")
 	cmd.Flags().StringVar(&flagOrderBy, "order-by", "", "Order by field (CREATED_AT)")
 	cmd.Flags().StringVar(&flagOrderDir, "order-direction", "DESC", "Sort direction (ASC, DESC)")
-	cmd.Flags().StringVar(&flagAction, "action", "", "Filter by action (e.g. core:vendor:create)")
+	cmd.Flags().StringVar(&flagAction, "action", "", "Filter by action (e.g. core:thirdParty:create)")
 	cmd.Flags().StringVar(&flagActorID, "actor-id", "", "Filter by actor ID")
-	cmd.Flags().StringVar(&flagResourceType, "resource-type", "", "Filter by resource type (e.g. Vendor)")
+	cmd.Flags().StringVar(&flagResourceType, "resource-type", "", "Filter by resource type (e.g. ThirdParty)")
 	cmd.Flags().StringVar(&flagResourceID, "resource-id", "", "Filter by resource ID")
 	flagOutput = cmdutil.AddOutputFlag(cmd)
 

pkg/cmd/datum/create/create.go

@@ -56,7 +56,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 		flagName           string
 		flagClassification string
 		flagOwner          string
-		flagVendorIDs      []string
+		flagThirdPartyIDs  []string
 	)
 
 	cmd := &cobra.Command{
@@ -138,8 +138,8 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 			if flagOwner != "" {
 				input["ownerId"] = flagOwner
 			}
-			if len(flagVendorIDs) > 0 {
-				input["vendorIds"] = flagVendorIDs
+			if len(flagThirdPartyIDs) > 0 {
+				input["thirdPartyIds"] = flagThirdPartyIDs
 			}
 
 			data, err := client.Do(
@@ -171,7 +171,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().StringVar(&flagName, "name", "", "Datum name (required)")
 	cmd.Flags().StringVar(&flagClassification, "data-classification", "", "Data classification: PUBLIC, INTERNAL, CONFIDENTIAL, SECRET (required)")
 	cmd.Flags().StringVar(&flagOwner, "owner", "", "Owner profile ID")
-	cmd.Flags().StringSliceVar(&flagVendorIDs, "vendor-ids", nil, "Vendor IDs (comma-separated)")
+	cmd.Flags().StringSliceVar(&flagThirdPartyIDs, "thirdParty-ids", nil, "ThirdParty IDs (comma-separated)")
 
 	return cmd
 }

pkg/cmd/datum/update/update.go

@@ -50,7 +50,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 		flagName           string
 		flagClassification string
 		flagOwner          string
-		flagVendorIDs      []string
+		flagThirdPartyIDs  []string
 	)
 
 	cmd := &cobra.Command{
@@ -93,8 +93,8 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 					input["ownerId"] = flagOwner
 				}
 			}
-			if cmd.Flags().Changed("vendor-ids") {
-				input["vendorIds"] = flagVendorIDs
+			if cmd.Flags().Changed("thirdParty-ids") {
+				input["thirdPartyIds"] = flagThirdPartyIDs
 			}
 
 			if len(input) == 1 {
@@ -129,7 +129,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 	cmd.Flags().StringVar(&flagName, "name", "", "Datum name")
 	cmd.Flags().StringVar(&flagClassification, "data-classification", "", "Data classification: PUBLIC, INTERNAL, CONFIDENTIAL, SECRET")
 	cmd.Flags().StringVar(&flagOwner, "owner", "", "Owner profile ID")
-	cmd.Flags().StringSliceVar(&flagVendorIDs, "vendor-ids", nil, "Vendor IDs (comma-separated)")
+	cmd.Flags().StringSliceVar(&flagThirdPartyIDs, "thirdParty-ids", nil, "ThirdParty IDs (comma-separated)")
 
 	return cmd
 }

pkg/cmd/root/root.go

@@ -46,12 +46,12 @@ import (
 	"go.probo.inc/probo/pkg/cmd/scim"
 	"go.probo.inc/probo/pkg/cmd/soa"
 	"go.probo.inc/probo/pkg/cmd/task"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt"
 	"go.probo.inc/probo/pkg/cmd/tia"
 	trackerpattern "go.probo.inc/probo/pkg/cmd/tracker-pattern"
 	trackerresource "go.probo.inc/probo/pkg/cmd/tracker-resource"
 	trustcenter "go.probo.inc/probo/pkg/cmd/trust-center"
 	"go.probo.inc/probo/pkg/cmd/user"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt"
 	"go.probo.inc/probo/pkg/cmd/version"
 	"go.probo.inc/probo/pkg/cmd/webhook"
 )
@@ -120,7 +120,7 @@ func NewCmdRoot(f *cmdutil.Factory) *cobra.Command {
 	cmd.AddCommand(tia.NewCmdTIA(f))
 	cmd.AddCommand(trustcenter.NewCmdTrustCenter(f))
 	cmd.AddCommand(user.NewCmdUser(f))
-	cmd.AddCommand(vendormgmt.NewCmdVendor(f))
+	cmd.AddCommand(thirdpartymgmt.NewCmdThirdParty(f))
 	cmd.AddCommand(version.NewCmdVersion(f))
 	cmd.AddCommand(webhook.NewCmdWebhook(f))
 

pkg/cmd/thirdpartymgmt/assess/assess.go

@@ -26,15 +26,15 @@ import (
 )
 
 const assessMutation = `
-mutation($input: AssessVendorInput!) {
-  assessVendor(input: $input) {
+mutation($input: AssessThirdPartyInput!) {
+  assessThirdParty(input: $input) {
     report
     subprocessors {
       name
       country
       purpose
     }
-    vendor {
+    third_party {
       id
       name
     }
@@ -43,18 +43,18 @@ mutation($input: AssessVendorInput!) {
 `
 
 type assessResponse struct {
-	AssessVendor struct {
+	AssessThirdParty struct {
 		Report        string `json:"report"`
 		Subprocessors []struct {
 			Name    string `json:"name"`
 			Country string `json:"country"`
 			Purpose string `json:"purpose"`
 		} `json:"subprocessors"`
-		Vendor struct {
+		ThirdParty struct {
 			ID   string `json:"id"`
 			Name string `json:"name"`
-		} `json:"vendor"`
-	} `json:"assessVendor"`
+		} `json:"third_party"`
+	} `json:"assessThirdParty"`
 }
 
 func NewCmdAssess(f *cmdutil.Factory) *cobra.Command {
@@ -63,17 +63,17 @@ func NewCmdAssess(f *cmdutil.Factory) *cobra.Command {
 	)
 
 	cmd := &cobra.Command{
-		Use:   "assess <vendor-id> --url <website-url>",
-		Short: "Run AI assessment on a vendor from its website",
-		Long:  "Analyze a vendor's website using AI agents to extract security, compliance, and business information.",
-		Example: `  # Assess a vendor by website URL
-  prb vendor assess VND_123 --url https://example.com
+		Use:   "assess <thirdParty-id> --url <website-url>",
+		Short: "Run AI assessment on a thirdParty from its website",
+		Long:  "Analyze a thirdParty's website using AI agents to extract security, compliance, and business information.",
+		Example: `  # Assess a third_party by website URL
+  prb third_party assess VND_123 --url https://example.com
 
   # Assess with a custom procedure file
-  prb vendor assess VND_123 --url https://example.com --procedure-file ./my-procedure.txt
+  prb third_party assess VND_123 --url https://example.com --procedure-file ./my-procedure.txt
 
   # Output as JSON
-  prb vendor assess VND_123 --url https://example.com -o json`,
+  prb third_party assess VND_123 --url https://example.com -o json`,
 		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := cmdutil.ValidateOutputFlag(flagOutput); err != nil {
@@ -115,7 +115,7 @@ func NewCmdAssess(f *cmdutil.Factory) *cobra.Command {
 				22*time.Minute,
 			)
 
-			_, _ = fmt.Fprintf(f.IOStreams.ErrOut, "Assessing vendor from %s (this may take a few minutes)...\n", flagURL)
+			_, _ = fmt.Fprintf(f.IOStreams.ErrOut, "Assessing thirdParty from %s (this may take a few minutes)...\n", flagURL)
 
 			data, err := client.Do(
 				assessMutation,
@@ -133,16 +133,16 @@ func NewCmdAssess(f *cmdutil.Factory) *cobra.Command {
 			}
 
 			if *flagOutput == cmdutil.OutputJSON {
-				return cmdutil.PrintJSON(f.IOStreams.Out, resp.AssessVendor)
+				return cmdutil.PrintJSON(f.IOStreams.Out, resp.AssessThirdParty)
 			}
 
-			_, _ = fmt.Fprintln(f.IOStreams.Out, resp.AssessVendor.Report)
+			_, _ = fmt.Fprintln(f.IOStreams.Out, resp.AssessThirdParty.Report)
 
 			return nil
 		},
 	}
 
-	cmd.Flags().String("url", "", "Vendor website URL to assess (required)")
+	cmd.Flags().String("url", "", "ThirdParty website URL to assess (required)")
 	_ = cmd.MarkFlagRequired("url")
 	cmd.Flags().String("procedure-file", "", "Path to a custom assessment procedure file")
 	flagOutput = cmdutil.AddOutputFlag(cmd)

pkg/cmd/thirdpartymgmt/create/create.go

@@ -25,9 +25,9 @@ import (
 )
 
 const createMutation = `
-mutation($input: CreateVendorInput!) {
-  createVendor(input: $input) {
-    vendorEdge {
+mutation($input: CreateThirdPartyInput!) {
+  createThirdParty(input: $input) {
+    thirdPartyEdge {
       node {
         id
         name
@@ -39,15 +39,15 @@ mutation($input: CreateVendorInput!) {
 `
 
 type createResponse struct {
-	CreateVendor struct {
-		VendorEdge struct {
+	CreateThirdParty struct {
+		ThirdPartyEdge struct {
 			Node struct {
 				ID       string `json:"id"`
 				Name     string `json:"name"`
 				Category string `json:"category"`
 			} `json:"node"`
-		} `json:"vendorEdge"`
-	} `json:"createVendor"`
+		} `json:"thirdPartyEdge"`
+	} `json:"createThirdParty"`
 }
 
 func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
@@ -63,12 +63,12 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "create",
-		Short: "Create a new vendor",
-		Example: `  # Create a vendor interactively
-  prb vendor create
+		Short: "Create a new thirdParty",
+		Example: `  # Create a third_party interactively
+  prb third_party create
 
-  # Create a vendor non-interactively
-  prb vendor create --name "Acme Corp" --category CLOUD_PROVIDER`,
+  # Create a third_party non-interactively
+  prb third_party create --name "Acme Corp" --category CLOUD_PROVIDER`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := f.Config()
 			if err != nil {
@@ -99,7 +99,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 			if f.IOStreams.IsInteractive() {
 				if flagName == "" {
 					err := huh.NewInput().
-						Title("Vendor name").
+						Title("ThirdParty name").
 						Value(&flagName).
 						Run()
 					if err != nil {
@@ -109,7 +109,7 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 
 				if flagCategory == "" {
 					err := huh.NewSelect[string]().
-						Title("Vendor category").
+						Title("ThirdParty category").
 						Options(
 							huh.NewOption("Analytics", "ANALYTICS"),
 							huh.NewOption("Cloud Monitoring", "CLOUD_MONITORING"),
@@ -181,10 +181,10 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 				return fmt.Errorf("cannot parse response: %w", err)
 			}
 
-			v := resp.CreateVendor.VendorEdge.Node
+			v := resp.CreateThirdParty.ThirdPartyEdge.Node
 			_, _ = fmt.Fprintf(
 				f.IOStreams.Out,
-				"Created vendor %s (%s)\n",
+				"Created thirdParty %s (%s)\n",
 				v.ID,
 				v.Name,
 			)
@@ -194,9 +194,9 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 	}
 
 	cmd.Flags().StringVar(&flagOrg, "org", "", "Organization ID")
-	cmd.Flags().StringVar(&flagName, "name", "", "Vendor name (required)")
-	cmd.Flags().StringVar(&flagCategory, "category", "", "Vendor category (required)")
-	cmd.Flags().StringVar(&flagDescription, "description", "", "Vendor description")
+	cmd.Flags().StringVar(&flagName, "name", "", "ThirdParty name (required)")
+	cmd.Flags().StringVar(&flagCategory, "category", "", "ThirdParty category (required)")
+	cmd.Flags().StringVar(&flagDescription, "description", "", "ThirdParty description")
 	cmd.Flags().StringVar(&flagLegalName, "legal-name", "", "Legal name")
 	cmd.Flags().StringVar(&flagAddress, "address", "", "Headquarter address")
 	cmd.Flags().StringVar(&flagWebsite, "website", "", "Website URL")

pkg/cmd/thirdpartymgmt/delete/delete.go

@@ -24,9 +24,9 @@ import (
 )
 
 const deleteMutation = `
-mutation($input: DeleteVendorInput!) {
-  deleteVendor(input: $input) {
-    deletedVendorId
+mutation($input: DeleteThirdPartyInput!) {
+  deleteThirdParty(input: $input) {
+    deletedThirdPartyId
   }
 }
 `
@@ -36,17 +36,17 @@ func NewCmdDelete(f *cmdutil.Factory) *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "delete <id>",
-		Short: "Delete a vendor",
+		Short: "Delete a thirdParty",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if !flagYes {
 				if !f.IOStreams.IsInteractive() {
-					return fmt.Errorf("cannot delete vendor: confirmation required, use --yes to confirm")
+					return fmt.Errorf("cannot delete thirdParty: confirmation required, use --yes to confirm")
 				}
 
 				var confirmed bool
 				err := huh.NewConfirm().
-					Title(fmt.Sprintf("Delete vendor %s?", args[0])).
+					Title(fmt.Sprintf("Delete thirdParty %s?", args[0])).
 					Value(&confirmed).
 					Run()
 				if err != nil {
@@ -79,7 +79,7 @@ func NewCmdDelete(f *cmdutil.Factory) *cobra.Command {
 				deleteMutation,
 				map[string]any{
 					"input": map[string]any{
-						"vendorId": args[0],
+						"thirdPartyId": args[0],
 					},
 				},
 			)
@@ -89,7 +89,7 @@ func NewCmdDelete(f *cmdutil.Factory) *cobra.Command {
 
 			_, _ = fmt.Fprintf(
 				f.IOStreams.Out,
-				"Deleted vendor %s\n",
+				"Deleted thirdParty %s\n",
 				args[0],
 			)
 

pkg/cmd/thirdpartymgmt/list/list.go

@@ -24,11 +24,11 @@ import (
 )
 
 const listQuery = `
-query($id: ID!, $first: Int, $after: CursorKey, $orderBy: VendorOrder) {
+query($id: ID!, $first: Int, $after: CursorKey, $orderBy: ThirdPartyOrder) {
   node(id: $id) {
     __typename
     ... on Organization {
-      vendors(first: $first, after: $after, orderBy: $orderBy) {
+      third_parties(first: $first, after: $after, orderBy: $orderBy) {
         totalCount
         edges {
           node {
@@ -47,7 +47,7 @@ query($id: ID!, $first: Int, $after: CursorKey, $orderBy: VendorOrder) {
 }
 `
 
-type vendor struct {
+type thirdParty struct {
 	ID       string `json:"id"`
 	Name     string `json:"name"`
 	Category string `json:"category"`
@@ -64,13 +64,13 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:     "list",
-		Short:   "List vendors in an organization",
+		Short:   "List thirdParties in an organization",
 		Aliases: []string{"ls"},
-		Example: `  # List vendors in the default organization
-  prb vendor list
+		Example: `  # List third_parties in the default organization
+  prb third_party list
 
-  # List vendors sorted by name
-  prb vendor ls --order-by NAME --json`,
+  # List third_parties sorted by name
+  prb third_party ls --order-by NAME --json`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := cmdutil.ValidateOutputFlag(flagOutput); err != nil {
@@ -117,16 +117,16 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 				}
 			}
 
-			vendors, totalCount, err := api.Paginate(
+			thirdParties, totalCount, err := api.Paginate(
 				client,
 				listQuery,
 				variables,
 				flagLimit,
-				func(data json.RawMessage) (*api.Connection[vendor], error) {
+				func(data json.RawMessage) (*api.Connection[thirdParty], error) {
 					var resp struct {
 						Node *struct {
-							Typename string                 `json:"__typename"`
-							Vendors  api.Connection[vendor] `json:"vendors"`
+							Typename     string                     `json:"__typename"`
+							ThirdParties api.Connection[thirdParty] `json:"third_parties"`
 						} `json:"node"`
 					}
 					if err := json.Unmarshal(data, &resp); err != nil {
@@ -138,7 +138,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 					if resp.Node.Typename != "Organization" {
 						return nil, fmt.Errorf("expected Organization node, got %s", resp.Node.Typename)
 					}
-					return &resp.Node.Vendors, nil
+					return &resp.Node.ThirdParties, nil
 				},
 			)
 			if err != nil {
@@ -146,16 +146,16 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 			}
 
 			if *flagOutput == cmdutil.OutputJSON {
-				return cmdutil.PrintJSON(f.IOStreams.Out, vendors)
+				return cmdutil.PrintJSON(f.IOStreams.Out, thirdParties)
 			}
 
-			if len(vendors) == 0 {
-				_, _ = fmt.Fprintln(f.IOStreams.Out, "No vendors found.")
+			if len(thirdParties) == 0 {
+				_, _ = fmt.Fprintln(f.IOStreams.Out, "No thirdParties found.")
 				return nil
 			}
 
-			rows := make([][]string, 0, len(vendors))
-			for _, v := range vendors {
+			rows := make([][]string, 0, len(thirdParties))
+			for _, v := range thirdParties {
 				rows = append(rows, []string{
 					v.ID,
 					v.Name,
@@ -167,11 +167,11 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 
 			_, _ = fmt.Fprintln(f.IOStreams.Out, t)
 
-			if totalCount > len(vendors) {
+			if totalCount > len(thirdParties) {
 				_, _ = fmt.Fprintf(
 					f.IOStreams.ErrOut,
-					"\nShowing %d of %d vendors\n",
-					len(vendors),
+					"\nShowing %d of %d thirdParties\n",
+					len(thirdParties),
 					totalCount,
 				)
 			}
@@ -181,7 +181,7 @@ func NewCmdList(f *cmdutil.Factory) *cobra.Command {
 	}
 
 	cmd.Flags().StringVar(&flagOrg, "org", "", "Organization ID")
-	cmd.Flags().IntVarP(&flagLimit, "limit", "L", 30, "Maximum number of vendors to list")
+	cmd.Flags().IntVarP(&flagLimit, "limit", "L", 30, "Maximum number of thirdParties to list")
 	cmd.Flags().StringVar(&flagOrderBy, "order-by", "", "Order by field (NAME, CREATED_AT, UPDATED_AT)")
 	cmd.Flags().StringVar(&flagOrderDir, "order-direction", "DESC", "Sort direction (ASC, DESC)")
 	flagOutput = cmdutil.AddOutputFlag(cmd)

pkg/cmd/thirdpartymgmt/publish/publish.go

@@ -24,8 +24,8 @@ import (
 )
 
 const publishMutation = `
-mutation($input: PublishVendorListInput!) {
-  publishVendorList(input: $input) {
+mutation($input: PublishThirdPartyListInput!) {
+  publishThirdPartyList(input: $input) {
     documentEdge {
       node {
         id
@@ -47,7 +47,7 @@ mutation($input: PublishVendorListInput!) {
 `
 
 type publishResponse struct {
-	PublishVendorList struct {
+	PublishThirdPartyList struct {
 		DocumentEdge struct {
 			Node struct {
 				ID        string `json:"id"`
@@ -64,7 +64,7 @@ type publishResponse struct {
 				Status string `json:"status"`
 			} `json:"node"`
 		} `json:"documentVersionEdge"`
-	} `json:"publishVendorList"`
+	} `json:"publishThirdPartyList"`
 }
 
 func NewCmdPublish(f *cmdutil.Factory) *cobra.Command {
@@ -76,12 +76,12 @@ func NewCmdPublish(f *cmdutil.Factory) *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "publish",
-		Short: "Publish the vendor register as a document version",
-		Example: `  # Publish the vendor register
-  prb vendor publish --org ORG_ID
+		Short: "Publish the thirdParty register as a document version",
+		Example: `  # Publish the third_party register
+  prb third_party publish --org ORG_ID
 
   # Publish with approvers
-  prb vendor publish --org ORG_ID --approver PROFILE_ID1 --approver PROFILE_ID2`,
+  prb third_party publish --org ORG_ID --approver PROFILE_ID1 --approver PROFILE_ID2`,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := f.Config()
 			if err != nil {
@@ -130,10 +130,10 @@ func NewCmdPublish(f *cmdutil.Factory) *cobra.Command {
 				return fmt.Errorf("cannot parse response: %w", err)
 			}
 
-			v := resp.PublishVendorList.DocumentVersionEdge.Node
+			v := resp.PublishThirdPartyList.DocumentVersionEdge.Node
 			_, _ = fmt.Fprintf(
 				f.IOStreams.Out,
-				"Published vendor register %s (v%d.%d)\n",
+				"Published thirdParty register %s (v%d.%d)\n",
 				v.Title,
 				v.Major,
 				v.Minor,

pkg/cmd/thirdpartymgmt/thirdpartymgmt.go

@@ -12,24 +12,24 @@
 // OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 // PERFORMANCE OF THIS SOFTWARE.
 
-package vendormgmt
+package thirdpartymgmt
 
 import (
 	"github.com/spf13/cobra"
 	"go.probo.inc/probo/pkg/cmd/cmdutil"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/assess"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/create"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/delete"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/list"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/publish"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/update"
-	"go.probo.inc/probo/pkg/cmd/vendormgmt/view"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/assess"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/create"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/delete"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/list"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/publish"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/update"
+	"go.probo.inc/probo/pkg/cmd/thirdpartymgmt/view"
 )
 
-func NewCmdVendor(f *cmdutil.Factory) *cobra.Command {
+func NewCmdThirdParty(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "vendor <command>",
-		Short: "Manage vendors",
+		Use:   "thirdParty <command>",
+		Short: "Manage thirdParties",
 	}
 
 	cmd.AddCommand(list.NewCmdList(f))

pkg/cmd/thirdpartymgmt/update/update.go

@@ -24,9 +24,9 @@ import (
 )
 
 const updateMutation = `
-mutation($input: UpdateVendorInput!) {
-  updateVendor(input: $input) {
-    vendor {
+mutation($input: UpdateThirdPartyInput!) {
+  updateThirdParty(input: $input) {
+    third_party {
       id
       name
       category
@@ -36,13 +36,13 @@ mutation($input: UpdateVendorInput!) {
 `
 
 type updateResponse struct {
-	UpdateVendor struct {
-		Vendor struct {
+	UpdateThirdParty struct {
+		ThirdParty struct {
 			ID       string `json:"id"`
 			Name     string `json:"name"`
 			Category string `json:"category"`
-		} `json:"vendor"`
-	} `json:"updateVendor"`
+		} `json:"third_party"`
+	} `json:"updateThirdParty"`
 }
 
 func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
@@ -57,7 +57,7 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "update <id>",
-		Short: "Update a vendor",
+		Short: "Update a thirdParty",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			cfg, err := f.Config()
@@ -118,10 +118,10 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 				return fmt.Errorf("cannot parse response: %w", err)
 			}
 
-			v := resp.UpdateVendor.Vendor
+			v := resp.UpdateThirdParty.ThirdParty
 			_, _ = fmt.Fprintf(
 				f.IOStreams.Out,
-				"Updated vendor %s (%s)\n",
+				"Updated thirdParty %s (%s)\n",
 				v.ID,
 				v.Name,
 			)
@@ -130,9 +130,9 @@ func NewCmdUpdate(f *cmdutil.Factory) *cobra.Command {
 		},
 	}
 
-	cmd.Flags().StringVar(&flagName, "name", "", "Vendor name")
-	cmd.Flags().StringVar(&flagDescription, "description", "", "Vendor description")
-	cmd.Flags().StringVar(&flagCategory, "category", "", "Vendor category")
+	cmd.Flags().StringVar(&flagName, "name", "", "ThirdParty name")
+	cmd.Flags().StringVar(&flagDescription, "description", "", "ThirdParty description")
+	cmd.Flags().StringVar(&flagCategory, "category", "", "ThirdParty category")
 	cmd.Flags().StringVar(&flagLegalName, "legal-name", "", "Legal name")
 	cmd.Flags().StringVar(&flagAddress, "address", "", "Headquarter address")
 	cmd.Flags().StringVar(&flagWebsite, "website", "", "Website URL")

pkg/cmd/thirdpartymgmt/view/view.go

@@ -28,7 +28,7 @@ const viewQuery = `
 query($id: ID!) {
   node(id: $id) {
     __typename
-    ... on Vendor {
+    ... on ThirdParty {
       id
       name
       description
@@ -63,7 +63,7 @@ func NewCmdView(f *cmdutil.Factory) *cobra.Command {
 
 	cmd := &cobra.Command{
 		Use:   "view <id>",
-		Short: "View a vendor",
+		Short: "View a thirdParty",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := cmdutil.ValidateOutputFlag(flagOutput); err != nil {
@@ -102,11 +102,11 @@ func NewCmdView(f *cmdutil.Factory) *cobra.Command {
 			}
 
 			if resp.Node == nil {
-				return fmt.Errorf("vendor %s not found", args[0])
+				return fmt.Errorf("thirdParty %s not found", args[0])
 			}
 
-			if resp.Node.Typename != "Vendor" {
-				return fmt.Errorf("expected Vendor node, got %s", resp.Node.Typename)
+			if resp.Node.Typename != "ThirdParty" {
+				return fmt.Errorf("expected ThirdParty node, got %s", resp.Node.Typename)
 			}
 
 			if *flagOutput == cmdutil.OutputJSON {

pkg/cmd/webhook/create/create.go

@@ -62,11 +62,11 @@ func NewCmdCreate(f *cmdutil.Factory) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "create",
 		Short: "Create a webhook subscription",
-		Example: `  # Create a webhook for vendor events
-  prb webhook create --url https://example.com/webhook --event VENDOR_CREATED --event VENDOR_UPDATED
+		Example: `  # Create a webhook for thirdParty events
+  prb webhook create --url https://example.com/webhook --event THIRD_PARTY_CREATED --event THIRD_PARTY_UPDATED
 
   # Create a webhook for all supported events
-  prb webhook create --url https://example.com/webhook --event VENDOR_CREATED --event VENDOR_UPDATED --event VENDOR_DELETED --event USER_CREATED --event USER_UPDATED --event USER_DELETED --event OBLIGATION_CREATED --event OBLIGATION_UPDATED --event OBLIGATION_DELETED`,
+  prb webhook create --url https://example.com/webhook --event THIRD_PARTY_CREATED --event THIRD_PARTY_UPDATED --event THIRD_PARTY_DELETED --event USER_CREATED --event USER_UPDATED --event USER_DELETED --event OBLIGATION_CREATED --event OBLIGATION_UPDATED --event OBLIGATION_DELETED`,
 		Args: cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			for _, e := range flagEvents {

pkg/cmd/webhook/shared/events.go

@@ -21,9 +21,9 @@ var ValidEvents = []string{
 	"MEETING_CREATED",
 	"MEETING_UPDATED",
 	"MEETING_DELETED",
-	"VENDOR_CREATED",
-	"VENDOR_UPDATED",
-	"VENDOR_DELETED",
+	"THIRD_PARTY_CREATED",
+	"THIRD_PARTY_UPDATED",
+	"THIRD_PARTY_DELETED",
 	"USER_CREATED",
 	"USER_UPDATED",
 	"USER_DELETED",

pkg/coredata/asset_third_party.go

@@ -25,41 +25,41 @@ import (
 )
 
 type (
-	AssetVendor struct {
-		AssetID   gid.GID      `db:"asset_id"`
-		VendorID  gid.GID      `db:"vendor_id"`
-		TenantID  gid.TenantID `db:"tenant_id"`
-		CreatedAt time.Time    `db:"created_at"`
+	AssetThirdParty struct {
+		AssetID      gid.GID      `db:"asset_id"`
+		ThirdPartyID gid.GID      `db:"third_party_id"`
+		TenantID     gid.TenantID `db:"tenant_id"`
+		CreatedAt    time.Time    `db:"created_at"`
 	}
 
-	AssetVendors []*AssetVendor
+	AssetThirdParties []*AssetThirdParty
 )
 
-func (av AssetVendors) Merge(
+func (av AssetThirdParties) Merge(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	assetID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
+WITH third_party_ids AS (
 	SELECT
-		unnest(@vendor_ids::text[]) AS vendor_id,
+		unnest(@third_party_ids::text[]) AS third_party_id,
 		@tenant_id AS tenant_id,
 		@asset_id AS asset_id,
 		@organization_id AS organization_id,
 		@created_at::timestamptz AS created_at
 )
-MERGE INTO asset_vendors AS tgt
-USING vendor_ids AS src
+MERGE INTO asset_third_parties AS tgt
+USING third_party_ids AS src
 ON tgt.tenant_id = src.tenant_id
 	AND tgt.asset_id = src.asset_id
-	AND tgt.vendor_id = src.vendor_id
+	AND tgt.third_party_id = src.third_party_id
 WHEN NOT MATCHED
-	THEN INSERT (tenant_id, asset_id, vendor_id, organization_id, created_at)
-		VALUES (src.tenant_id, src.asset_id, src.vendor_id, src.organization_id, src.created_at)
+	THEN INSERT (tenant_id, asset_id, third_party_id, organization_id, created_at)
+		VALUES (src.tenant_id, src.asset_id, src.third_party_id, src.organization_id, src.created_at)
 	WHEN NOT MATCHED BY SOURCE
 		AND tgt.tenant_id = @tenant_id AND tgt.asset_id = @asset_id
 		THEN DELETE
@@ -70,37 +70,37 @@ WHEN NOT MATCHED
 		"asset_id":        assetID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot merge asset vendors: %w", err)
+		return fmt.Errorf("cannot merge asset thirdParties: %w", err)
 	}
 
 	return nil
 }
 
-func (av AssetVendors) Insert(
+func (av AssetThirdParties) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 	assetID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
-	SELECT unnest(@vendor_ids::text[]) AS vendor_id
+WITH third_party_ids AS (
+	SELECT unnest(@third_party_ids::text[]) AS third_party_id
 )
-INSERT INTO asset_vendors (tenant_id, asset_id, vendor_id, organization_id, created_at)
+INSERT INTO asset_third_parties (tenant_id, asset_id, third_party_id, organization_id, created_at)
 SELECT
 	@tenant_id AS tenant_id,
 	@asset_id AS asset_id,
-	vendor_id,
+	third_party_id,
 	@organization_id AS organization_id,
 	@created_at AS created_at
-FROM vendor_ids
+FROM third_party_ids
 `
 
 	args := pgx.StrictNamedArgs{
@@ -108,12 +108,12 @@ FROM vendor_ids
 		"asset_id":        assetID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert asset vendors: %w", err)
+		return fmt.Errorf("cannot insert asset thirdParties: %w", err)
 	}
 
 	return nil

pkg/coredata/audit_log_resource_type.go

@@ -29,12 +29,12 @@ func ResourceTypeName(entityType uint16) string {
 		return "Evidence"
 	case ConnectorEntityType:
 		return "Connector"
-	case VendorRiskAssessmentEntityType:
-		return "VendorRiskAssessment"
-	case VendorEntityType:
-		return "Vendor"
-	case VendorComplianceReportEntityType:
-		return "VendorComplianceReport"
+	case ThirdPartyRiskAssessmentEntityType:
+		return "ThirdPartyRiskAssessment"
+	case ThirdPartyEntityType:
+		return "ThirdParty"
+	case ThirdPartyComplianceReportEntityType:
+		return "ThirdPartyComplianceReport"
 	case DocumentEntityType:
 		return "Document"
 	case IdentityEntityType:
@@ -59,20 +59,20 @@ func ResourceTypeName(entityType uint16) string {
 		return "TrustCenter"
 	case TrustCenterAccessEntityType:
 		return "TrustCenterAccess"
-	case VendorBusinessAssociateAgreementEntityType:
-		return "VendorBusinessAssociateAgreement"
+	case ThirdPartyBusinessAssociateAgreementEntityType:
+		return "ThirdPartyBusinessAssociateAgreement"
 	case FileEntityType:
 		return "File"
-	case VendorContactEntityType:
-		return "VendorContact"
-	case VendorDataPrivacyAgreementEntityType:
-		return "VendorDataPrivacyAgreement"
+	case ThirdPartyContactEntityType:
+		return "ThirdPartyContact"
+	case ThirdPartyDataPrivacyAgreementEntityType:
+		return "ThirdPartyDataPrivacyAgreement"
 	case FindingEntityType:
 		return "Finding"
 	case ObligationEntityType:
 		return "Obligation"
-	case VendorServiceEntityType:
-		return "VendorService"
+	case ThirdPartyServiceEntityType:
+		return "ThirdPartyService"
 	case ProcessingActivityEntityType:
 		return "ProcessingActivity"
 	case TrustCenterReferenceEntityType:

pkg/coredata/common_third_party.go

@@ -28,26 +28,26 @@ import (
 
 type (
 	CommonThirdParty struct {
-		ID                            gid.GID        `db:"id"`
-		Name                          string         `db:"name"`
-		Category                      VendorCategory `db:"category"`
-		HeadquarterAddress            *string        `db:"headquarter_address"`
-		LegalName                     *string        `db:"legal_name"`
-		WebsiteURL                    *string        `db:"website_url"`
-		PrivacyPolicyURL              *string        `db:"privacy_policy_url"`
-		ServiceLevelAgreementURL      *string        `db:"service_level_agreement_url"`
-		ServiceSoftwareAgreementURL   *string        `db:"service_software_agreement_url"`
-		DataProcessingAgreementURL    *string        `db:"data_processing_agreement_url"`
-		BusinessAssociateAgreementURL *string        `db:"business_associate_agreement_url"`
-		SubprocessorsListURL          *string        `db:"subprocessors_list_url"`
-		Certifications                []string       `db:"certifications"`
-		StatusPageURL                 *string        `db:"status_page_url"`
-		TermsOfServiceURL             *string        `db:"terms_of_service_url"`
-		SecurityPageURL               *string        `db:"security_page_url"`
-		TrustPageURL                  *string        `db:"trust_page_url"`
-		LogoFileID                    *gid.GID       `db:"logo_file_id"`
-		CreatedAt                     time.Time      `db:"created_at"`
-		UpdatedAt                     time.Time      `db:"updated_at"`
+		ID                            gid.GID            `db:"id"`
+		Name                          string             `db:"name"`
+		Category                      ThirdPartyCategory `db:"category"`
+		HeadquarterAddress            *string            `db:"headquarter_address"`
+		LegalName                     *string            `db:"legal_name"`
+		WebsiteURL                    *string            `db:"website_url"`
+		PrivacyPolicyURL              *string            `db:"privacy_policy_url"`
+		ServiceLevelAgreementURL      *string            `db:"service_level_agreement_url"`
+		ServiceSoftwareAgreementURL   *string            `db:"service_software_agreement_url"`
+		DataProcessingAgreementURL    *string            `db:"data_processing_agreement_url"`
+		BusinessAssociateAgreementURL *string            `db:"business_associate_agreement_url"`
+		SubprocessorsListURL          *string            `db:"subprocessors_list_url"`
+		Certifications                []string           `db:"certifications"`
+		StatusPageURL                 *string            `db:"status_page_url"`
+		TermsOfServiceURL             *string            `db:"terms_of_service_url"`
+		SecurityPageURL               *string            `db:"security_page_url"`
+		TrustPageURL                  *string            `db:"trust_page_url"`
+		LogoFileID                    *gid.GID           `db:"logo_file_id"`
+		CreatedAt                     time.Time          `db:"created_at"`
+		UpdatedAt                     time.Time          `db:"updated_at"`
 	}
 
 	CommonThirdParties []*CommonThirdParty

pkg/coredata/datum_third_party.go

@@ -25,40 +25,40 @@ import (
 )
 
 type (
-	DatumVendor struct {
-		DatumID   gid.GID   `db:"datum_id"`
-		VendorID  gid.GID   `db:"vendor_id"`
-		CreatedAt time.Time `db:"created_at"`
+	DatumThirdParty struct {
+		DatumID      gid.GID   `db:"datum_id"`
+		ThirdPartyID gid.GID   `db:"third_party_id"`
+		CreatedAt    time.Time `db:"created_at"`
 	}
 
-	DatumVendors []*DatumVendor
+	DatumThirdParties []*DatumThirdParty
 )
 
-func (dv DatumVendors) Merge(
+func (dv DatumThirdParties) Merge(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	datumID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
+WITH third_party_ids AS (
 	SELECT
-		unnest(@vendor_ids::text[]) AS vendor_id,
+		unnest(@third_party_ids::text[]) AS third_party_id,
 		@tenant_id AS tenant_id,
 		@datum_id AS datum_id,
 		@organization_id AS organization_id,
 		@created_at::timestamptz AS created_at
 )
-MERGE INTO data_vendors AS tgt
-USING vendor_ids AS src
+MERGE INTO data_third_parties AS tgt
+USING third_party_ids AS src
 ON tgt.tenant_id = src.tenant_id
 	AND tgt.datum_id = src.datum_id
-	AND tgt.vendor_id = src.vendor_id
+	AND tgt.third_party_id = src.third_party_id
 WHEN NOT MATCHED THEN
-	INSERT (tenant_id, datum_id, vendor_id, organization_id, created_at)
-	VALUES (src.tenant_id, src.datum_id, src.vendor_id, src.organization_id, src.created_at)
+	INSERT (tenant_id, datum_id, third_party_id, organization_id, created_at)
+	VALUES (src.tenant_id, src.datum_id, src.third_party_id, src.organization_id, src.created_at)
 WHEN NOT MATCHED BY SOURCE
 	AND tgt.tenant_id = @tenant_id AND tgt.datum_id = @datum_id
 	THEN DELETE
@@ -69,37 +69,37 @@ WHEN NOT MATCHED BY SOURCE
 		"datum_id":        datumID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot merge data vendors: %w", err)
+		return fmt.Errorf("cannot merge data thirdParties: %w", err)
 	}
 
 	return nil
 }
 
-func (dv DatumVendors) Insert(
+func (dv DatumThirdParties) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 	datumID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
-	SELECT unnest(@vendor_ids::text[]) AS vendor_id
+WITH third_party_ids AS (
+	SELECT unnest(@third_party_ids::text[]) AS third_party_id
 )
-INSERT INTO data_vendors (tenant_id, datum_id, vendor_id, organization_id, created_at)
+INSERT INTO data_third_parties (tenant_id, datum_id, third_party_id, organization_id, created_at)
 SELECT
 	@tenant_id::text AS tenant_id,
 	@datum_id::text AS datum_id,
-	vendor_id,
+	third_party_id,
 	@organization_id::text AS organization_id,
 	@created_at::timestamptz AS created_at
-FROM vendor_ids
+FROM third_party_ids
 `
 
 	args := pgx.StrictNamedArgs{
@@ -107,12 +107,12 @@ FROM vendor_ids
 		"datum_id":        datumID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert data vendors: %w", err)
+		return fmt.Errorf("cannot insert data thirdParties: %w", err)
 	}
 
 	return nil

pkg/coredata/entity_type_reg.go

@@ -23,99 +23,99 @@ var (
 )
 
 const (
-	OrganizationEntityType                     uint16 = 0
-	FrameworkEntityType                        uint16 = 1
-	MeasureEntityType                          uint16 = 2
-	TaskEntityType                             uint16 = 3
-	EvidenceEntityType                         uint16 = 4
-	ConnectorEntityType                        uint16 = 5
-	VendorRiskAssessmentEntityType             uint16 = 6
-	VendorEntityType                           uint16 = 7
-	_                                          uint16 = 8 // PeopleEntityType - removed
-	VendorComplianceReportEntityType           uint16 = 9
-	DocumentEntityType                         uint16 = 10
-	IdentityEntityType                         uint16 = 11
-	SessionEntityType                          uint16 = 12
-	EmailEntityType                            uint16 = 13
-	ControlEntityType                          uint16 = 14
-	RiskEntityType                             uint16 = 15
-	DocumentVersionEntityType                  uint16 = 16
-	DocumentVersionSignatureEntityType         uint16 = 17
-	AssetEntityType                            uint16 = 18
-	DatumEntityType                            uint16 = 19
-	AuditEntityType                            uint16 = 20
-	ReportEntityType                           uint16 = 21
-	TrustCenterEntityType                      uint16 = 22
-	TrustCenterAccessEntityType                uint16 = 23
-	VendorBusinessAssociateAgreementEntityType uint16 = 24
-	FileEntityType                             uint16 = 25
-	VendorContactEntityType                    uint16 = 26
-	VendorDataPrivacyAgreementEntityType       uint16 = 27
-	_                                          uint16 = 28 // NonconformityEntityType - removed
-	ObligationEntityType                       uint16 = 29
-	VendorServiceEntityType                    uint16 = 30
-	_                                          uint16 = 31 // SnapshotEntityType - removed
-	_                                          uint16 = 32 // ContinualImprovementEntityType - removed
-	ProcessingActivityEntityType               uint16 = 33
-	ExportJobEntityType                        uint16 = 34
-	TrustCenterReferenceEntityType             uint16 = 35
-	TrustCenterDocumentAccessEntityType        uint16 = 36
-	CustomDomainEntityType                     uint16 = 37
-	InvitationEntityType                       uint16 = 38
-	MembershipEntityType                       uint16 = 39
-	SlackMessageEntityType                     uint16 = 40
-	TrustCenterFileEntityType                  uint16 = 41
-	SAMLConfigurationEntityType                uint16 = 42
-	PersonalAPIKeyEntityType                   uint16 = 43
-	_                                          uint16 = 44 // PersonalAPIKeyMembershipEntityType - removed
-	_                                          uint16 = 45 // MeetingEntityType - removed
-	DataProtectionImpactAssessmentEntityType   uint16 = 46
-	TransferImpactAssessmentEntityType         uint16 = 47
-	RightsRequestEntityType                    uint16 = 48
-	StatementOfApplicabilityEntityType         uint16 = 49
-	ApplicabilityStatementEntityType           uint16 = 50
-	MembershipProfileEntityType                uint16 = 51
-	SCIMConfigurationEntityType                uint16 = 52
-	SCIMEventEntityType                        uint16 = 53
-	TokenEntityType                            uint16 = 54
-	SCIMBridgeEntityType                       uint16 = 55
-	WebhookSubscriptionEntityType              uint16 = 56
-	WebhookDataEntityType                      uint16 = 57
-	WebhookEventEntityType                     uint16 = 58
-	ElectronicSignatureEntityType              uint16 = 59
-	ElectronicSignatureEventEntityType         uint16 = 60
-	EmailAttachmentEntityType                  uint16 = 61
-	ComplianceFrameworkEntityType              uint16 = 62
-	ComplianceExternalURLEntityType            uint16 = 63
-	MailingListEntityType                      uint16 = 64
-	MailingListSubscriberEntityType            uint16 = 65
-	MailingListUpdateEntityType                uint16 = 66
-	FindingEntityType                          uint16 = 67
-	AuditLogEntryEntityType                    uint16 = 68
-	DocumentVersionApprovalQuorumEntityType    uint16 = 69
-	DocumentVersionApprovalDecisionEntityType  uint16 = 70
-	AccessSourceEntityType                     uint16 = 71
-	AccessReviewCampaignEntityType             uint16 = 72
-	AccessEntryEntityType                      uint16 = 73
-	AccessEntryDecisionHistoryEntityType       uint16 = 74
-	CookieBannerEntityType                     uint16 = 75
-	CookieCategoryEntityType                   uint16 = 76
-	CookieConsentRecordEntityType              uint16 = 77
-	CookieBannerVersionEntityType              uint16 = 78
-	OAuth2ClientEntityType                     uint16 = 79
-	OAuth2ConsentEntityType                    uint16 = 80
-	OAuth2AccessTokenEntityType                uint16 = 81
-	OAuth2RefreshTokenEntityType               uint16 = 82
-	OAuth2AuthorizationCodeEntityType          uint16 = 83
-	OAuth2DeviceCodeEntityType                 uint16 = 84
-	_                                          uint16 = 85 // CookieEntityType - removed
-	CookieBannerTranslationEntityType          uint16 = 86
-	AgentRunEntityType                         uint16 = 87
-	_                                          uint16 = 88 // CookiePatternEntityType - removed
-	TrackerPatternEntityType                   uint16 = 89
-	DetectedTrackerEntityType                  uint16 = 90
-	TrackerResourceEntityType                  uint16 = 91
-	CommonThirdPartyEntityType                 uint16 = 92
+	OrganizationEntityType                         uint16 = 0
+	FrameworkEntityType                            uint16 = 1
+	MeasureEntityType                              uint16 = 2
+	TaskEntityType                                 uint16 = 3
+	EvidenceEntityType                             uint16 = 4
+	ConnectorEntityType                            uint16 = 5
+	ThirdPartyRiskAssessmentEntityType             uint16 = 6
+	ThirdPartyEntityType                           uint16 = 7
+	_                                              uint16 = 8 // PeopleEntityType - removed
+	ThirdPartyComplianceReportEntityType           uint16 = 9
+	DocumentEntityType                             uint16 = 10
+	IdentityEntityType                             uint16 = 11
+	SessionEntityType                              uint16 = 12
+	EmailEntityType                                uint16 = 13
+	ControlEntityType                              uint16 = 14
+	RiskEntityType                                 uint16 = 15
+	DocumentVersionEntityType                      uint16 = 16
+	DocumentVersionSignatureEntityType             uint16 = 17
+	AssetEntityType                                uint16 = 18
+	DatumEntityType                                uint16 = 19
+	AuditEntityType                                uint16 = 20
+	ReportEntityType                               uint16 = 21
+	TrustCenterEntityType                          uint16 = 22
+	TrustCenterAccessEntityType                    uint16 = 23
+	ThirdPartyBusinessAssociateAgreementEntityType uint16 = 24
+	FileEntityType                                 uint16 = 25
+	ThirdPartyContactEntityType                    uint16 = 26
+	ThirdPartyDataPrivacyAgreementEntityType       uint16 = 27
+	_                                              uint16 = 28 // NonconformityEntityType - removed
+	ObligationEntityType                           uint16 = 29
+	ThirdPartyServiceEntityType                    uint16 = 30
+	_                                              uint16 = 31 // SnapshotEntityType - removed
+	_                                              uint16 = 32 // ContinualImprovementEntityType - removed
+	ProcessingActivityEntityType                   uint16 = 33
+	ExportJobEntityType                            uint16 = 34
+	TrustCenterReferenceEntityType                 uint16 = 35
+	TrustCenterDocumentAccessEntityType            uint16 = 36
+	CustomDomainEntityType                         uint16 = 37
+	InvitationEntityType                           uint16 = 38
+	MembershipEntityType                           uint16 = 39
+	SlackMessageEntityType                         uint16 = 40
+	TrustCenterFileEntityType                      uint16 = 41
+	SAMLConfigurationEntityType                    uint16 = 42
+	PersonalAPIKeyEntityType                       uint16 = 43
+	_                                              uint16 = 44 // PersonalAPIKeyMembershipEntityType - removed
+	_                                              uint16 = 45 // MeetingEntityType - removed
+	DataProtectionImpactAssessmentEntityType       uint16 = 46
+	TransferImpactAssessmentEntityType             uint16 = 47
+	RightsRequestEntityType                        uint16 = 48
+	StatementOfApplicabilityEntityType             uint16 = 49
+	ApplicabilityStatementEntityType               uint16 = 50
+	MembershipProfileEntityType                    uint16 = 51
+	SCIMConfigurationEntityType                    uint16 = 52
+	SCIMEventEntityType                            uint16 = 53
+	TokenEntityType                                uint16 = 54
+	SCIMBridgeEntityType                           uint16 = 55
+	WebhookSubscriptionEntityType                  uint16 = 56
+	WebhookDataEntityType                          uint16 = 57
+	WebhookEventEntityType                         uint16 = 58
+	ElectronicSignatureEntityType                  uint16 = 59
+	ElectronicSignatureEventEntityType             uint16 = 60
+	EmailAttachmentEntityType                      uint16 = 61
+	ComplianceFrameworkEntityType                  uint16 = 62
+	ComplianceExternalURLEntityType                uint16 = 63
+	MailingListEntityType                          uint16 = 64
+	MailingListSubscriberEntityType                uint16 = 65
+	MailingListUpdateEntityType                    uint16 = 66
+	FindingEntityType                              uint16 = 67
+	AuditLogEntryEntityType                        uint16 = 68
+	DocumentVersionApprovalQuorumEntityType        uint16 = 69
+	DocumentVersionApprovalDecisionEntityType      uint16 = 70
+	AccessSourceEntityType                         uint16 = 71
+	AccessReviewCampaignEntityType                 uint16 = 72
+	AccessEntryEntityType                          uint16 = 73
+	AccessEntryDecisionHistoryEntityType           uint16 = 74
+	CookieBannerEntityType                         uint16 = 75
+	CookieCategoryEntityType                       uint16 = 76
+	CookieConsentRecordEntityType                  uint16 = 77
+	CookieBannerVersionEntityType                  uint16 = 78
+	OAuth2ClientEntityType                         uint16 = 79
+	OAuth2ConsentEntityType                        uint16 = 80
+	OAuth2AccessTokenEntityType                    uint16 = 81
+	OAuth2RefreshTokenEntityType                   uint16 = 82
+	OAuth2AuthorizationCodeEntityType              uint16 = 83
+	OAuth2DeviceCodeEntityType                     uint16 = 84
+	_                                              uint16 = 85 // CookieEntityType - removed
+	CookieBannerTranslationEntityType              uint16 = 86
+	AgentRunEntityType                             uint16 = 87
+	_                                              uint16 = 88 // CookiePatternEntityType - removed
+	TrackerPatternEntityType                       uint16 = 89
+	DetectedTrackerEntityType                      uint16 = 90
+	TrackerResourceEntityType                      uint16 = 91
+	CommonThirdPartyEntityType                     uint16 = 92
 )
 
 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -132,12 +132,12 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &Evidence{ID: id}, true
 	case ConnectorEntityType:
 		return &Connector{ID: id}, true
-	case VendorRiskAssessmentEntityType:
-		return &VendorRiskAssessment{ID: id}, true
-	case VendorEntityType:
-		return &Vendor{ID: id}, true
-	case VendorComplianceReportEntityType:
-		return &VendorComplianceReport{ID: id}, true
+	case ThirdPartyRiskAssessmentEntityType:
+		return &ThirdPartyRiskAssessment{ID: id}, true
+	case ThirdPartyEntityType:
+		return &ThirdParty{ID: id}, true
+	case ThirdPartyComplianceReportEntityType:
+		return &ThirdPartyComplianceReport{ID: id}, true
 	case DocumentEntityType:
 		return &Document{ID: id}, true
 	case IdentityEntityType:
@@ -166,20 +166,20 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &TrustCenter{ID: id}, true
 	case TrustCenterAccessEntityType:
 		return &TrustCenterAccess{ID: id}, true
-	case VendorBusinessAssociateAgreementEntityType:
-		return &VendorBusinessAssociateAgreement{ID: id}, true
+	case ThirdPartyBusinessAssociateAgreementEntityType:
+		return &ThirdPartyBusinessAssociateAgreement{ID: id}, true
 	case FileEntityType:
 		return &File{ID: id}, true
-	case VendorContactEntityType:
-		return &VendorContact{ID: id}, true
-	case VendorDataPrivacyAgreementEntityType:
-		return &VendorDataPrivacyAgreement{ID: id}, true
+	case ThirdPartyContactEntityType:
+		return &ThirdPartyContact{ID: id}, true
+	case ThirdPartyDataPrivacyAgreementEntityType:
+		return &ThirdPartyDataPrivacyAgreement{ID: id}, true
 	case FindingEntityType:
 		return &Finding{ID: id}, true
 	case ObligationEntityType:
 		return &Obligation{ID: id}, true
-	case VendorServiceEntityType:
-		return &VendorService{ID: id}, true
+	case ThirdPartyServiceEntityType:
+		return &ThirdPartyService{ID: id}, true
 	case ProcessingActivityEntityType:
 		return &ProcessingActivity{ID: id}, true
 	case ExportJobEntityType:

pkg/coredata/migrations/20260513T100000Z.sql

@@ -0,0 +1,60 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+-- Rename vendor concept to third party everywhere in the schema.
+
+-- Rename the vendor_category enum.
+
+ALTER TYPE vendor_category RENAME TO third_party_category;
+
+-- Rename the main vendor tables.
+
+ALTER TABLE vendors RENAME TO third_parties;
+ALTER TABLE vendor_contacts RENAME TO third_party_contacts;
+ALTER TABLE vendor_services RENAME TO third_party_services;
+ALTER TABLE vendor_compliance_reports RENAME TO third_party_compliance_reports;
+ALTER TABLE vendor_business_associate_agreements RENAME TO third_party_business_associate_agreements;
+ALTER TABLE vendor_data_privacy_agreements RENAME TO third_party_data_privacy_agreements;
+ALTER TABLE vendor_risk_assessments RENAME TO third_party_risk_assessments;
+
+-- Rename the junction tables.
+
+ALTER TABLE asset_vendors RENAME TO asset_third_parties;
+ALTER TABLE data_vendors RENAME TO data_third_parties;
+ALTER TABLE processing_activity_vendors RENAME TO processing_activity_third_parties;
+
+-- Rename vendor_id columns on child tables.
+
+ALTER TABLE third_party_contacts RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_services RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_compliance_reports RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_business_associate_agreements RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_data_privacy_agreements RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_risk_assessments RENAME COLUMN vendor_id TO third_party_id;
+
+-- Rename vendor_id columns on junction tables.
+
+ALTER TABLE asset_third_parties RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE data_third_parties RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE processing_activity_third_parties RENAME COLUMN vendor_id TO third_party_id;
+
+-- Rename generated_documents.vendors_document_id.
+
+ALTER TABLE generated_documents RENAME COLUMN vendors_document_id TO third_parties_document_id;
+
+-- Rename webhook event type enum values.
+
+ALTER TYPE webhook_event_type RENAME VALUE 'vendor:created' TO 'third-party:created';
+ALTER TYPE webhook_event_type RENAME VALUE 'vendor:updated' TO 'third-party:updated';
+ALTER TYPE webhook_event_type RENAME VALUE 'vendor:deleted' TO 'third-party:deleted';

pkg/coredata/processing_activity_third_party.go

@@ -25,42 +25,42 @@ import (
 )
 
 type (
-	ProcessingActivityVendor struct {
+	ProcessingActivityThirdParty struct {
 		ProcessingActivityID gid.GID      `db:"processing_activity_id"`
-		VendorID             gid.GID      `db:"vendor_id"`
+		ThirdPartyID         gid.GID      `db:"third_party_id"`
 		TenantID             gid.TenantID `db:"tenant_id"`
 		SnapshotID           *gid.GID     `db:"snapshot_id"`
 		CreatedAt            time.Time    `db:"created_at"`
 	}
 
-	ProcessingActivityVendors []*ProcessingActivityVendor
+	ProcessingActivityThirdParties []*ProcessingActivityThirdParty
 )
 
-func (pav ProcessingActivityVendors) Merge(
+func (pav ProcessingActivityThirdParties) Merge(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	processingActivityID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
+WITH third_party_ids AS (
 	SELECT
-		unnest(@vendor_ids::text[]) AS vendor_id,
+		unnest(@third_party_ids::text[]) AS third_party_id,
 		@tenant_id AS tenant_id,
 		@processing_activity_id AS processing_activity_id,
 		@organization_id AS organization_id,
 		@created_at::timestamptz AS created_at
 )
-MERGE INTO processing_activity_vendors AS tgt
-USING vendor_ids AS src
+MERGE INTO processing_activity_third_parties AS tgt
+USING third_party_ids AS src
 ON tgt.tenant_id = src.tenant_id
 	AND tgt.processing_activity_id = src.processing_activity_id
-	AND tgt.vendor_id = src.vendor_id
+	AND tgt.third_party_id = src.third_party_id
 WHEN NOT MATCHED
-	THEN INSERT (tenant_id, processing_activity_id, vendor_id, organization_id, created_at)
-		VALUES (src.tenant_id, src.processing_activity_id, src.vendor_id, src.organization_id, src.created_at)
+	THEN INSERT (tenant_id, processing_activity_id, third_party_id, organization_id, created_at)
+		VALUES (src.tenant_id, src.processing_activity_id, src.third_party_id, src.organization_id, src.created_at)
 	WHEN NOT MATCHED BY SOURCE
 		AND tgt.tenant_id = @tenant_id AND tgt.processing_activity_id = @processing_activity_id
 		THEN DELETE
@@ -71,37 +71,37 @@ WHEN NOT MATCHED
 		"processing_activity_id": processingActivityID,
 		"organization_id":        organizationID,
 		"created_at":             time.Now(),
-		"vendor_ids":             vendorIDs,
+		"third_party_ids":        thirdPartyIDs,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot merge processing activity vendors: %w", err)
+		return fmt.Errorf("cannot merge processing activity thirdParties: %w", err)
 	}
 
 	return nil
 }
 
-func (pav ProcessingActivityVendors) Insert(
+func (pav ProcessingActivityThirdParties) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 	processingActivityID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
-	SELECT unnest(@vendor_ids::text[]) AS vendor_id
+WITH third_party_ids AS (
+	SELECT unnest(@third_party_ids::text[]) AS third_party_id
 )
-INSERT INTO processing_activity_vendors (tenant_id, processing_activity_id, vendor_id, organization_id, created_at)
+INSERT INTO processing_activity_third_parties (tenant_id, processing_activity_id, third_party_id, organization_id, created_at)
 SELECT
 	@tenant_id AS tenant_id,
 	@processing_activity_id AS processing_activity_id,
-	vendor_id,
+	third_party_id,
 	@organization_id AS organization_id,
 	@created_at AS created_at
-FROM vendor_ids
+FROM third_party_ids
 `
 
 	args := pgx.StrictNamedArgs{
@@ -109,12 +109,12 @@ FROM vendor_ids
 		"processing_activity_id": processingActivityID,
 		"organization_id":        organizationID,
 		"created_at":             time.Now(),
-		"vendor_ids":             vendorIDs,
+		"third_party_ids":        thirdPartyIDs,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert processing activity vendors: %w", err)
+		return fmt.Errorf("cannot insert processing activity thirdParties: %w", err)
 	}
 
 	return nil

pkg/coredata/third_party.go

@@ -27,7 +27,7 @@ import (
 	"go.probo.inc/probo/pkg/page"
 )
 
-func (v Vendor) GetGeneratedDocumentID(
+func (v ThirdParty) GetGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Querier,
 	organizationID gid.GID,
@@ -38,7 +38,7 @@ func (v Vendor) GetGeneratedDocumentID(
 		ctx,
 		`
 SELECT
-	vendors_document_id
+	third_parties_document_id
 FROM
 	generated_documents
 WHERE
@@ -50,13 +50,13 @@ WHERE
 		return nil, nil
 	}
 	if err != nil {
-		return nil, fmt.Errorf("cannot get vendor list document ID: %w", err)
+		return nil, fmt.Errorf("cannot get thirdParty list document ID: %w", err)
 	}
 
 	return documentID, nil
 }
 
-func (v Vendor) UpsertGeneratedDocumentID(
+func (v ThirdParty) UpsertGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Tx,
 	organizationID gid.GID,
@@ -71,37 +71,37 @@ func (v Vendor) UpsertGeneratedDocumentID(
 INSERT INTO generated_documents (
 	organization_id,
 	tenant_id,
-	vendors_document_id,
+	third_parties_document_id,
 	created_at,
 	updated_at
 ) VALUES (
 	@organization_id,
 	@tenant_id,
-	@vendors_document_id,
+	@third_parties_document_id,
 	@created_at,
 	@updated_at
 )
 ON CONFLICT (organization_id) DO UPDATE
 SET
-	vendors_document_id = @vendors_document_id,
+	third_parties_document_id = @third_parties_document_id,
 	updated_at = @updated_at
 `,
 		pgx.NamedArgs{
-			"organization_id":     organizationID,
-			"tenant_id":           tenantID,
-			"vendors_document_id": documentID,
-			"created_at":          now,
-			"updated_at":          now,
+			"organization_id":           organizationID,
+			"tenant_id":                 tenantID,
+			"third_parties_document_id": documentID,
+			"created_at":                now,
+			"updated_at":                now,
 		},
 	)
 	if err != nil {
-		return fmt.Errorf("cannot upsert vendor list document ID: %w", err)
+		return fmt.Errorf("cannot upsert thirdParty list document ID: %w", err)
 	}
 
 	return nil
 }
 
-func (v Vendor) ClearGeneratedDocumentID(
+func (v ThirdParty) ClearGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Tx,
 	documentIDs []gid.GID,
@@ -117,10 +117,10 @@ func (v Vendor) ClearGeneratedDocumentID(
 UPDATE
 	generated_documents
 SET
-	vendors_document_id = NULL,
+	third_parties_document_id = NULL,
 	updated_at = @now
 WHERE
-	vendors_document_id = ANY(@ids)
+	third_parties_document_id = ANY(@ids)
 `,
 		pgx.NamedArgs{
 			"ids": ids,
@@ -128,76 +128,76 @@ WHERE
 		},
 	)
 	if err != nil {
-		return fmt.Errorf("cannot clear vendor list document references: %w", err)
+		return fmt.Errorf("cannot clear thirdParty list document references: %w", err)
 	}
 
 	return nil
 }
 
 type (
-	Vendor struct {
-		ID                            gid.GID        `db:"id"`
-		TenantID                      gid.TenantID   `db:"tenant_id"`
-		OrganizationID                gid.GID        `db:"organization_id"`
-		Name                          string         `db:"name"`
-		Description                   *string        `db:"description"`
-		Category                      VendorCategory `db:"category"`
-		HeadquarterAddress            *string        `db:"headquarter_address"`
-		LegalName                     *string        `db:"legal_name"`
-		WebsiteURL                    *string        `db:"website_url"`
-		PrivacyPolicyURL              *string        `db:"privacy_policy_url"`
-		ServiceLevelAgreementURL      *string        `db:"service_level_agreement_url"`
-		DataProcessingAgreementURL    *string        `db:"data_processing_agreement_url"`
-		BusinessAssociateAgreementURL *string        `db:"business_associate_agreement_url"`
-		SubprocessorsListURL          *string        `db:"subprocessors_list_url"`
-		Certifications                []string       `db:"certifications"`
-		Countries                     CountryCodes   `db:"countries"`
-		BusinessOwnerID               *gid.GID       `db:"business_owner_profile_id"`
-		SecurityOwnerID               *gid.GID       `db:"security_owner_profile_id"`
-		StatusPageURL                 *string        `db:"status_page_url"`
-		TermsOfServiceURL             *string        `db:"terms_of_service_url"`
-		SecurityPageURL               *string        `db:"security_page_url"`
-		TrustPageURL                  *string        `db:"trust_page_url"`
-		ShowOnTrustCenter             bool           `db:"show_on_trust_center"`
-		CreatedAt                     time.Time      `db:"created_at"`
-		UpdatedAt                     time.Time      `db:"updated_at"`
+	ThirdParty struct {
+		ID                            gid.GID            `db:"id"`
+		TenantID                      gid.TenantID       `db:"tenant_id"`
+		OrganizationID                gid.GID            `db:"organization_id"`
+		Name                          string             `db:"name"`
+		Description                   *string            `db:"description"`
+		Category                      ThirdPartyCategory `db:"category"`
+		HeadquarterAddress            *string            `db:"headquarter_address"`
+		LegalName                     *string            `db:"legal_name"`
+		WebsiteURL                    *string            `db:"website_url"`
+		PrivacyPolicyURL              *string            `db:"privacy_policy_url"`
+		ServiceLevelAgreementURL      *string            `db:"service_level_agreement_url"`
+		DataProcessingAgreementURL    *string            `db:"data_processing_agreement_url"`
+		BusinessAssociateAgreementURL *string            `db:"business_associate_agreement_url"`
+		SubprocessorsListURL          *string            `db:"subprocessors_list_url"`
+		Certifications                []string           `db:"certifications"`
+		Countries                     CountryCodes       `db:"countries"`
+		BusinessOwnerID               *gid.GID           `db:"business_owner_profile_id"`
+		SecurityOwnerID               *gid.GID           `db:"security_owner_profile_id"`
+		StatusPageURL                 *string            `db:"status_page_url"`
+		TermsOfServiceURL             *string            `db:"terms_of_service_url"`
+		SecurityPageURL               *string            `db:"security_page_url"`
+		TrustPageURL                  *string            `db:"trust_page_url"`
+		ShowOnTrustCenter             bool               `db:"show_on_trust_center"`
+		CreatedAt                     time.Time          `db:"created_at"`
+		UpdatedAt                     time.Time          `db:"updated_at"`
 	}
 
-	Vendors []*Vendor
+	ThirdParties []*ThirdParty
 )
 
-func (v Vendor) CursorKey(orderBy VendorOrderField) page.CursorKey {
+func (v ThirdParty) CursorKey(orderBy ThirdPartyOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorOrderFieldCreatedAt:
+	case ThirdPartyOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
-	case VendorOrderFieldUpdatedAt:
+	case ThirdPartyOrderFieldUpdatedAt:
 		return page.NewCursorKey(v.ID, v.UpdatedAt)
-	case VendorOrderFieldName:
+	case ThirdPartyOrderFieldName:
 		return page.NewCursorKey(v.ID, v.Name)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (v *Vendor) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendors WHERE id = $1 LIMIT 1;`
+func (v *ThirdParty) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_parties WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, v.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (v *Vendor) LoadByID(
+func (v *ThirdParty) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
@@ -227,43 +227,43 @@ SELECT
     created_at,
     updated_at
 FROM
-    vendors
+    third_parties
 WHERE
     %s
-    AND id = @vendor_id
+    AND id = @third_party_id
 LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor: %w", err)
+		return fmt.Errorf("cannot query thirdParty: %w", err)
 	}
 	defer rows.Close()
 
-	vendor, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Vendor])
+	thirdParty, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdParty])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}
 
-		return fmt.Errorf("cannot collect vendor: %w", err)
+		return fmt.Errorf("cannot collect thirdParty: %w", err)
 	}
 
-	*v = vendor
+	*v = thirdParty
 
 	return nil
 }
 
-func (v *Vendors) LoadByIDs(
+func (v *ThirdParties) LoadByIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
 SELECT
@@ -293,40 +293,40 @@ SELECT
     created_at,
     updated_at
 FROM
-    vendors
+    third_parties
 WHERE
     %s
-    AND id = ANY(@vendor_ids)
+    AND id = ANY(@third_party_ids)
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_ids": vendorIDs}
+	args := pgx.StrictNamedArgs{"third_party_ids": thirdPartyIDs}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*v = vendors
+	*v = thirdParties
 
 	return nil
 }
 
-func (v Vendor) Insert(
+func (v ThirdParty) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-    vendors (
+    third_parties (
         tenant_id,
         id,
         organization_id,
@@ -355,7 +355,7 @@ INSERT INTO
     )
 VALUES (
     @tenant_id,
-    @vendor_id,
+    @third_party_id,
     @organization_id,
     @name,
     @description,
@@ -384,7 +384,7 @@ VALUES (
 
 	args := pgx.StrictNamedArgs{
 		"tenant_id":                        scope.GetTenantID(),
-		"vendor_id":                        v.ID,
+		"third_party_id":                   v.ID,
 		"organization_id":                  v.OrganizationID,
 		"name":                             v.Name,
 		"description":                      v.Description,
@@ -413,36 +413,36 @@ VALUES (
 	return err
 }
 
-func (v Vendor) Delete(
+func (v ThirdParty) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
-DELETE FROM vendors WHERE %s AND id = @vendor_id
+DELETE FROM third_parties WHERE %s AND id = @third_party_id
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_id": v.ID}
+	args := pgx.StrictNamedArgs{"third_party_id": v.ID}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
 	return err
 }
 
-func (v *Vendors) CountByOrganizationID(
+func (v *ThirdParties) CountByOrganizationID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	organizationID gid.GID,
-	filter *VendorFilter,
+	filter *ThirdPartyFilter,
 ) (int, error) {
 	q := `
 SELECT
     COUNT(id)
 FROM
-    vendors
+    third_parties
 WHERE
     %s
     AND organization_id = @organization_id
@@ -461,13 +461,13 @@ WHERE
 	var count int
 	err := row.Scan(&count)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count vendors: %w", err)
+		return 0, fmt.Errorf("cannot count thirdParties: %w", err)
 	}
 
 	return count, nil
 }
 
-func (v *Vendors) LoadAllByOrganizationID(
+func (v *ThirdParties) LoadAllByOrganizationID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -501,7 +501,7 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendors
+	third_parties
 WHERE
 	%s
 	AND organization_id = @organization_id
@@ -515,26 +515,26 @@ ORDER BY name ASC
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*v = vendors
+	*v = thirdParties
 
 	return nil
 }
 
-func (v *Vendors) LoadByOrganizationID(
+func (v *ThirdParties) LoadByOrganizationID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	organizationID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
-	filter *VendorFilter,
+	cursor *page.Cursor[ThirdPartyOrderField],
+	filter *ThirdPartyFilter,
 ) error {
 	q := `
 SELECT
@@ -564,7 +564,7 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendors
+	third_parties
 WHERE
 	%s
 	AND organization_id = @organization_id
@@ -581,26 +581,26 @@ WHERE
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*v = vendors
+	*v = thirdParties
 
 	return nil
 }
 
-func (v *Vendor) Update(
+func (v *ThirdParty) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
-UPDATE vendors
+UPDATE third_parties
 SET
 	name = @name,
 	description = @description,
@@ -624,12 +624,12 @@ SET
 	show_on_trust_center = @show_on_trust_center,
 	updated_at = @updated_at
 WHERE %s
-    AND id = @vendor_id
+    AND id = @third_party_id
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"vendor_id":                        v.ID,
+		"third_party_id":                   v.ID,
 		"updated_at":                       time.Now(),
 		"name":                             v.Name,
 		"description":                      v.Description,
@@ -659,7 +659,7 @@ WHERE %s
 	return err
 }
 
-func (v Vendor) ExpireNonExpiredRiskAssessments(
+func (v ThirdParty) ExpireNonExpiredRiskAssessments(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -667,21 +667,21 @@ func (v Vendor) ExpireNonExpiredRiskAssessments(
 	now := time.Now()
 
 	q := `
-	UPDATE vendor_risk_assessments
+	UPDATE third_party_risk_assessments
 	SET
 		expires_at = @now,
 		updated_at = @now
 	WHERE
 		%s
-		AND vendor_id = @vendor_id
+		AND third_party_id = @third_party_id
 		AND expires_at > @now
 	`
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"vendor_id": v.ID,
-		"now":       now,
+		"third_party_id": v.ID,
+		"now":            now,
 	}
 	maps.Copy(args, scope.SQLArguments())
 
@@ -693,7 +693,7 @@ func (v Vendor) ExpireNonExpiredRiskAssessments(
 	return nil
 }
 
-func (v *Vendors) CountByAssetID(
+func (v *ThirdParties) CountByAssetID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -704,9 +704,9 @@ WITH vend AS (
 	SELECT
 		v.id
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		asset_vendors av ON v.id = av.vendor_id
+		asset_third_parties av ON v.id = av.third_party_id
 	WHERE
 		av.asset_id = @asset_id
 )
@@ -726,18 +726,18 @@ WHERE %s
 	var count int
 	err := row.Scan(&count)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count vendors: %w", err)
+		return 0, fmt.Errorf("cannot count thirdParties: %w", err)
 	}
 
 	return count, nil
 }
 
-func (v *Vendors) LoadByAssetID(
+func (v *ThirdParties) LoadByAssetID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	assetID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
+	cursor *page.Cursor[ThirdPartyOrderField],
 ) error {
 	q := `
 WITH vend AS (
@@ -768,9 +768,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		asset_vendors av ON v.id = av.vendor_id
+		asset_third_parties av ON v.id = av.third_party_id
 	WHERE
 		av.asset_id = @asset_id
 )
@@ -813,20 +813,20 @@ WHERE %s
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*v = vendors
+	*v = thirdParties
 
 	return nil
 }
 
-func (v *Vendors) CountByDatumID(
+func (v *ThirdParties) CountByDatumID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -837,9 +837,9 @@ WITH vend AS (
 	SELECT
 		v.id
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		data_vendors dv ON v.id = dv.vendor_id
+		data_third_parties dv ON v.id = dv.third_party_id
 	WHERE
 		dv.datum_id = @datum_id
 )
@@ -859,13 +859,13 @@ WHERE %s
 	var count int
 	err := row.Scan(&count)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count vendors: %w", err)
+		return 0, fmt.Errorf("cannot count thirdParties: %w", err)
 	}
 
 	return count, nil
 }
 
-func (vs *Vendors) LoadAllByDatumID(
+func (vs *ThirdParties) LoadAllByDatumID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -900,9 +900,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		data_vendors dv ON v.id = dv.vendor_id
+		data_third_parties dv ON v.id = dv.third_party_id
 	WHERE
 		dv.datum_id = @datum_id
 )
@@ -944,25 +944,25 @@ ORDER BY name ASC
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*vs = vendors
+	*vs = thirdParties
 
 	return nil
 }
 
-func (vs *Vendors) LoadByDatumID(
+func (vs *ThirdParties) LoadByDatumID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	datumID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
+	cursor *page.Cursor[ThirdPartyOrderField],
 ) error {
 	q := `
 WITH vend AS (
@@ -993,9 +993,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		data_vendors dv ON v.id = dv.vendor_id
+		data_third_parties dv ON v.id = dv.third_party_id
 	WHERE
 		dv.datum_id = @datum_id
 )
@@ -1038,25 +1038,25 @@ WHERE %s
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*vs = vendors
+	*vs = thirdParties
 
 	return nil
 }
 
-func (v *Vendors) LoadByProcessingActivityID(
+func (v *ThirdParties) LoadByProcessingActivityID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	processingActivityID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
+	cursor *page.Cursor[ThirdPartyOrderField],
 ) error {
 	q := `
 WITH vend AS (
@@ -1087,9 +1087,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		processing_activity_vendors pav ON v.id = pav.vendor_id
+		processing_activity_third_parties pav ON v.id = pav.third_party_id
 	WHERE
 		pav.processing_activity_id = @processing_activity_id
 )
@@ -1132,20 +1132,20 @@ WHERE %s
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*v = vendors
+	*v = thirdParties
 
 	return nil
 }
 
-func (v *Vendors) LoadAllByProcessingActivities(
+func (v *ThirdParties) LoadAllByProcessingActivities(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -1162,12 +1162,12 @@ WITH filtered_processing_activities AS (
 		AND pa.organization_id = @organization_id
 		AND pa.snapshot_id IS NULL
 ),
-filtered_vendors AS (
+filtered_third_parties AS (
 	SELECT
 		v.id,
 		v.name
 	FROM
-		vendors v
+		third_parties v
 	WHERE
 		v.tenant_id = @tenant_id
 		AND v.snapshot_id IS NULL
@@ -1176,9 +1176,9 @@ SELECT
 	pav.processing_activity_id,
 	fv.name
 FROM
-	processing_activity_vendors pav
+	processing_activity_third_parties pav
 INNER JOIN
-	filtered_vendors fv ON fv.id = pav.vendor_id
+	filtered_third_parties fv ON fv.id = pav.third_party_id
 INNER JOIN
 	filtered_processing_activities fpa ON fpa.id = pav.processing_activity_id
 WHERE
@@ -1194,24 +1194,24 @@ ORDER BY
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return nil, fmt.Errorf("cannot query vendors: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 	defer rows.Close()
 
-	vendorMap := make(map[gid.GID][]string)
+	thirdPartyMap := make(map[gid.GID][]string)
 	for rows.Next() {
 		var processingActivityID gid.GID
-		var vendorName string
-		if err := rows.Scan(&processingActivityID, &vendorName); err != nil {
-			return nil, fmt.Errorf("cannot scan vendor: %w", err)
+		var thirdPartyName string
+		if err := rows.Scan(&processingActivityID, &thirdPartyName); err != nil {
+			return nil, fmt.Errorf("cannot scan thirdParty: %w", err)
 		}
-		vendorMap[processingActivityID] = append(vendorMap[processingActivityID], vendorName)
+		thirdPartyMap[processingActivityID] = append(thirdPartyMap[processingActivityID], thirdPartyName)
 	}
 
-	return vendorMap, nil
+	return thirdPartyMap, nil
 }
 
-func (vs *Vendors) LoadAllByAssetID(
+func (vs *ThirdParties) LoadAllByAssetID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -1246,9 +1246,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		asset_vendors av ON v.id = av.vendor_id
+		asset_third_parties av ON v.id = av.third_party_id
 	WHERE
 		av.asset_id = @asset_id
 )
@@ -1290,15 +1290,15 @@ ORDER BY name ASC
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 
-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}
 
-	*vs = vendors
+	*vs = thirdParties
 
 	return nil
 }

pkg/coredata/third_party_business_associate_agreement.go

@@ -29,10 +29,10 @@ import (
 )
 
 type (
-	VendorBusinessAssociateAgreement struct {
+	ThirdPartyBusinessAssociateAgreement struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		ValidFrom      *time.Time `db:"valid_from"`
 		ValidUntil     *time.Time `db:"valid_until"`
 		FileID         gid.GID    `db:"file_id"`
@@ -40,87 +40,87 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}
 
-	VendorBusinessAssociateAgreements []*VendorBusinessAssociateAgreement
+	ThirdPartyBusinessAssociateAgreements []*ThirdPartyBusinessAssociateAgreement
 )
 
-func (v VendorBusinessAssociateAgreement) CursorKey(orderBy VendorBusinessAssociateAgreementOrderField) page.CursorKey {
+func (v ThirdPartyBusinessAssociateAgreement) CursorKey(orderBy ThirdPartyBusinessAssociateAgreementOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorBusinessAssociateAgreementOrderFieldValidFrom:
+	case ThirdPartyBusinessAssociateAgreementOrderFieldValidFrom:
 		return page.NewCursorKey(v.ID, v.ValidFrom)
-	case VendorBusinessAssociateAgreementOrderFieldCreatedAt:
+	case ThirdPartyBusinessAssociateAgreementOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_business_associate_agreements WHERE id = $1 LIMIT 1;`
+func (vbaa *ThirdPartyBusinessAssociateAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_business_associate_agreements WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vbaa.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor business associate agreement authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty business associate agreement authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) LoadByVendorID(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{"vendor_id": vendorID}
+	args := pgx.NamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty business associate agreement: %w", err)
 	}
 
-	vendorBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorBusinessAssociateAgreement])
+	thirdPartyBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyBusinessAssociateAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty business associate agreement: %w", err)
 	}
 
-	*vbaa = vendorBusinessAssociateAgreement
+	*vbaa = thirdPartyBusinessAssociateAgreement
 
 	return nil
 }
 
-func (vbaas *VendorBusinessAssociateAgreements) LoadByVendorIDs(
+func (vbaas *ThirdPartyBusinessAssociateAgreements) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vbaas = VendorBusinessAssociateAgreements{}
+	if len(thirdPartyIDs) == 0 {
+		*vbaas = ThirdPartyBusinessAssociateAgreements{}
 		return nil
 	}
 
@@ -128,38 +128,38 @@ func (vbaas *VendorBusinessAssociateAgreements) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}
 
-	args := pgx.NamedArgs{"vendor_ids": ids}
+	args := pgx.NamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor business associate agreements: %w", err)
+		return fmt.Errorf("cannot query thirdParty business associate agreements: %w", err)
 	}
 
-	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorBusinessAssociateAgreement])
+	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyBusinessAssociateAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor business associate agreements: %w", err)
+		return fmt.Errorf("cannot collect thirdParty business associate agreements: %w", err)
 	}
 
 	*vbaas = agreements
@@ -167,24 +167,24 @@ WHERE
 	return nil
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) LoadByID(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorBusinessAssociateAgreementID gid.GID,
+	thirdPartyBusinessAssociateAgreementID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
 	AND id = @id
@@ -193,32 +193,32 @@ LIMIT 1;
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{"id": vendorBusinessAssociateAgreementID}
+	args := pgx.NamedArgs{"id": thirdPartyBusinessAssociateAgreementID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty business associate agreement: %w", err)
 	}
 
-	vendorBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorBusinessAssociateAgreement])
+	thirdPartyBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyBusinessAssociateAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty business associate agreement: %w", err)
 	}
 
-	*vbaa = vendorBusinessAssociateAgreement
+	*vbaa = thirdPartyBusinessAssociateAgreement
 
 	return nil
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) Update(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 SET
 	valid_from = @valid_from,
 	valid_until = @valid_until,
@@ -243,24 +243,24 @@ WHERE
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot update thirdParty business associate agreement: %w", err)
 	}
 
 	return nil
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) Upsert(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) Upsert(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_business_associate_agreements (
+	third_party_business_associate_agreements (
 		id,
 		tenant_id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		valid_from,
 		valid_until,
 		file_id,
@@ -271,14 +271,14 @@ VALUES (
 	@id,
 	@tenant_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@valid_from,
 	@valid_until,
 	@file_id,
 	@created_at,
 	@updated_at
 )
-ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
+ON CONFLICT (organization_id, third_party_id) DO UPDATE SET
 	id = EXCLUDED.id,
 	valid_from = EXCLUDED.valid_from,
 	valid_until = EXCLUDED.valid_until,
@@ -288,7 +288,7 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	args := pgx.StrictNamedArgs{
 		"id":              vbaa.ID,
 		"tenant_id":       scope.GetTenantID(),
-		"vendor_id":       vbaa.VendorID,
+		"third_party_id":  vbaa.ThirdPartyID,
 		"organization_id": vbaa.OrganizationID,
 		"valid_from":      vbaa.ValidFrom,
 		"valid_until":     vbaa.ValidUntil,
@@ -301,16 +301,16 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	if err != nil {
 		var pgErr *pgconn.PgError
 		if errors.As(err, &pgErr) {
-			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_business_associate_agreements_source_id_snapshot_id_key" {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "third_party_business_associate_agreements_source_id_snapshot_id_key" {
 				return ErrResourceAlreadyExists
 			}
 		}
-		return fmt.Errorf("cannot upsert vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot upsert thirdParty business associate agreement: %w", err)
 	}
 	return nil
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) Delete(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
@@ -318,7 +318,7 @@ func (vbaa *VendorBusinessAssociateAgreement) Delete(
 	q := `
 DELETE
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
 	AND id = @id
@@ -334,25 +334,25 @@ WHERE
 	return err
 }
 
-func (vbaa *VendorBusinessAssociateAgreement) DeleteByVendorID(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) DeleteByThirdPartyID(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 DELETE
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)

pkg/coredata/third_party_business_associate_agreement_order_field.go

@@ -15,27 +15,27 @@
 package coredata
 
 type (
-	VendorBusinessAssociateAgreementOrderField string
+	ThirdPartyBusinessAssociateAgreementOrderField string
 )
 
 const (
-	VendorBusinessAssociateAgreementOrderFieldValidFrom VendorBusinessAssociateAgreementOrderField = "VALID_FROM"
-	VendorBusinessAssociateAgreementOrderFieldCreatedAt VendorBusinessAssociateAgreementOrderField = "CREATED_AT"
+	ThirdPartyBusinessAssociateAgreementOrderFieldValidFrom ThirdPartyBusinessAssociateAgreementOrderField = "VALID_FROM"
+	ThirdPartyBusinessAssociateAgreementOrderFieldCreatedAt ThirdPartyBusinessAssociateAgreementOrderField = "CREATED_AT"
 )
 
-func (p VendorBusinessAssociateAgreementOrderField) Column() string {
+func (p ThirdPartyBusinessAssociateAgreementOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorBusinessAssociateAgreementOrderField) String() string {
+func (p ThirdPartyBusinessAssociateAgreementOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorBusinessAssociateAgreementOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyBusinessAssociateAgreementOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorBusinessAssociateAgreementOrderField) UnmarshalText(text []byte) error {
-	*p = VendorBusinessAssociateAgreementOrderField(text)
+func (p *ThirdPartyBusinessAssociateAgreementOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyBusinessAssociateAgreementOrderField(text)
 	return nil
 }

pkg/coredata/third_party_category.go

@@ -0,0 +1,255 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+)
+
+type ThirdPartyCategory string
+
+const (
+	ThirdPartyCategoryAnalytics                ThirdPartyCategory = "ANALYTICS"
+	ThirdPartyCategoryCloudMonitoring          ThirdPartyCategory = "CLOUD_MONITORING"
+	ThirdPartyCategoryCloudProvider            ThirdPartyCategory = "CLOUD_PROVIDER"
+	ThirdPartyCategoryCollaboration            ThirdPartyCategory = "COLLABORATION"
+	ThirdPartyCategoryCustomerSupport          ThirdPartyCategory = "CUSTOMER_SUPPORT"
+	ThirdPartyCategoryDataStorageAndProcessing ThirdPartyCategory = "DATA_STORAGE_AND_PROCESSING"
+	ThirdPartyCategoryDocumentManagement       ThirdPartyCategory = "DOCUMENT_MANAGEMENT"
+	ThirdPartyCategoryEmployeeManagement       ThirdPartyCategory = "EMPLOYEE_MANAGEMENT"
+	ThirdPartyCategoryEngineering              ThirdPartyCategory = "ENGINEERING"
+	ThirdPartyCategoryFinance                  ThirdPartyCategory = "FINANCE"
+	ThirdPartyCategoryIdentityProvider         ThirdPartyCategory = "IDENTITY_PROVIDER"
+	ThirdPartyCategoryIT                       ThirdPartyCategory = "IT"
+	ThirdPartyCategoryMarketing                ThirdPartyCategory = "MARKETING"
+	ThirdPartyCategoryOfficeOperations         ThirdPartyCategory = "OFFICE_OPERATIONS"
+	ThirdPartyCategoryOther                    ThirdPartyCategory = "OTHER"
+	ThirdPartyCategoryPasswordManagement       ThirdPartyCategory = "PASSWORD_MANAGEMENT"
+	ThirdPartyCategoryProductAndDesign         ThirdPartyCategory = "PRODUCT_AND_DESIGN"
+	ThirdPartyCategoryProfessionalServices     ThirdPartyCategory = "PROFESSIONAL_SERVICES"
+	ThirdPartyCategoryRecruiting               ThirdPartyCategory = "RECRUITING"
+	ThirdPartyCategorySales                    ThirdPartyCategory = "SALES"
+	ThirdPartyCategorySecurity                 ThirdPartyCategory = "SECURITY"
+	ThirdPartyCategoryVersionControl           ThirdPartyCategory = "VERSION_CONTROL"
+)
+
+func ThirdPartyCategories() []ThirdPartyCategory {
+	return []ThirdPartyCategory{
+		ThirdPartyCategoryAnalytics,
+		ThirdPartyCategoryCloudMonitoring,
+		ThirdPartyCategoryCloudProvider,
+		ThirdPartyCategoryCollaboration,
+		ThirdPartyCategoryCustomerSupport,
+		ThirdPartyCategoryDataStorageAndProcessing,
+		ThirdPartyCategoryDocumentManagement,
+		ThirdPartyCategoryEmployeeManagement,
+		ThirdPartyCategoryEngineering,
+		ThirdPartyCategoryFinance,
+		ThirdPartyCategoryIdentityProvider,
+		ThirdPartyCategoryIT,
+		ThirdPartyCategoryMarketing,
+		ThirdPartyCategoryOfficeOperations,
+		ThirdPartyCategoryOther,
+		ThirdPartyCategoryPasswordManagement,
+		ThirdPartyCategoryProductAndDesign,
+		ThirdPartyCategoryProfessionalServices,
+		ThirdPartyCategoryRecruiting,
+		ThirdPartyCategorySales,
+		ThirdPartyCategorySecurity,
+		ThirdPartyCategoryVersionControl,
+	}
+}
+
+func (i ThirdPartyCategory) String() string {
+	return string(i)
+}
+
+func (i *ThirdPartyCategory) Scan(value any) error {
+	switch v := value.(type) {
+	case string:
+		switch v {
+		case "ANALYTICS":
+			*i = ThirdPartyCategoryAnalytics
+		case "CLOUD_MONITORING":
+			*i = ThirdPartyCategoryCloudMonitoring
+		case "CLOUD_PROVIDER":
+			*i = ThirdPartyCategoryCloudProvider
+		case "COLLABORATION":
+			*i = ThirdPartyCategoryCollaboration
+		case "CUSTOMER_SUPPORT":
+			*i = ThirdPartyCategoryCustomerSupport
+		case "DATA_STORAGE_AND_PROCESSING":
+			*i = ThirdPartyCategoryDataStorageAndProcessing
+		case "DOCUMENT_MANAGEMENT":
+			*i = ThirdPartyCategoryDocumentManagement
+		case "EMPLOYEE_MANAGEMENT":
+			*i = ThirdPartyCategoryEmployeeManagement
+		case "ENGINEERING":
+			*i = ThirdPartyCategoryEngineering
+		case "FINANCE":
+			*i = ThirdPartyCategoryFinance
+		case "IDENTITY_PROVIDER":
+			*i = ThirdPartyCategoryIdentityProvider
+		case "IT":
+			*i = ThirdPartyCategoryIT
+		case "MARKETING":
+			*i = ThirdPartyCategoryMarketing
+		case "OFFICE_OPERATIONS":
+			*i = ThirdPartyCategoryOfficeOperations
+		case "OTHER":
+			*i = ThirdPartyCategoryOther
+		case "PASSWORD_MANAGEMENT":
+			*i = ThirdPartyCategoryPasswordManagement
+		case "PRODUCT_AND_DESIGN":
+			*i = ThirdPartyCategoryProductAndDesign
+		case "PROFESSIONAL_SERVICES":
+			*i = ThirdPartyCategoryProfessionalServices
+		case "RECRUITING":
+			*i = ThirdPartyCategoryRecruiting
+		case "SALES":
+			*i = ThirdPartyCategorySales
+		case "SECURITY":
+			*i = ThirdPartyCategorySecurity
+		case "VERSION_CONTROL":
+			*i = ThirdPartyCategoryVersionControl
+		default:
+			return fmt.Errorf("invalid ThirdPartyCategory value: %q", v)
+		}
+	default:
+		return fmt.Errorf("unsupported type for ThirdPartyCategory: %T", value)
+	}
+	return nil
+}
+
+func (i ThirdPartyCategory) Value() (driver.Value, error) {
+	return i.String(), nil
+}
+
+func (i ThirdPartyCategory) MarshalJSON() ([]byte, error) {
+	return json.Marshal(i.String())
+}
+
+func (i *ThirdPartyCategory) UnmarshalJSON(data []byte) error {
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return err
+	}
+
+	switch s {
+	case "ANALYTICS":
+		*i = ThirdPartyCategoryAnalytics
+	case "CLOUD_MONITORING":
+		*i = ThirdPartyCategoryCloudMonitoring
+	case "CLOUD_PROVIDER":
+		*i = ThirdPartyCategoryCloudProvider
+	case "COLLABORATION":
+		*i = ThirdPartyCategoryCollaboration
+	case "CUSTOMER_SUPPORT":
+		*i = ThirdPartyCategoryCustomerSupport
+	case "DATA_STORAGE_AND_PROCESSING":
+		*i = ThirdPartyCategoryDataStorageAndProcessing
+	case "DOCUMENT_MANAGEMENT":
+		*i = ThirdPartyCategoryDocumentManagement
+	case "EMPLOYEE_MANAGEMENT":
+		*i = ThirdPartyCategoryEmployeeManagement
+	case "ENGINEERING":
+		*i = ThirdPartyCategoryEngineering
+	case "FINANCE":
+		*i = ThirdPartyCategoryFinance
+	case "IDENTITY_PROVIDER":
+		*i = ThirdPartyCategoryIdentityProvider
+	case "IT":
+		*i = ThirdPartyCategoryIT
+	case "MARKETING":
+		*i = ThirdPartyCategoryMarketing
+	case "OFFICE_OPERATIONS":
+		*i = ThirdPartyCategoryOfficeOperations
+	case "OTHER":
+		*i = ThirdPartyCategoryOther
+	case "PASSWORD_MANAGEMENT":
+		*i = ThirdPartyCategoryPasswordManagement
+	case "PRODUCT_AND_DESIGN":
+		*i = ThirdPartyCategoryProductAndDesign
+	case "PROFESSIONAL_SERVICES":
+		*i = ThirdPartyCategoryProfessionalServices
+	case "RECRUITING":
+		*i = ThirdPartyCategoryRecruiting
+	case "SALES":
+		*i = ThirdPartyCategorySales
+	case "SECURITY":
+		*i = ThirdPartyCategorySecurity
+	case "VERSION_CONTROL":
+		*i = ThirdPartyCategoryVersionControl
+	default:
+		return fmt.Errorf("invalid ThirdPartyCategory value: %q", s)
+	}
+	return nil
+}
+
+func (i *ThirdPartyCategory) UnmarshalText(text []byte) error {
+	s := string(text)
+
+	switch s {
+	case "ANALYTICS":
+		*i = ThirdPartyCategoryAnalytics
+	case "CLOUD_MONITORING":
+		*i = ThirdPartyCategoryCloudMonitoring
+	case "CLOUD_PROVIDER":
+		*i = ThirdPartyCategoryCloudProvider
+	case "COLLABORATION":
+		*i = ThirdPartyCategoryCollaboration
+	case "CUSTOMER_SUPPORT":
+		*i = ThirdPartyCategoryCustomerSupport
+	case "DATA_STORAGE_AND_PROCESSING":
+		*i = ThirdPartyCategoryDataStorageAndProcessing
+	case "DOCUMENT_MANAGEMENT":
+		*i = ThirdPartyCategoryDocumentManagement
+	case "EMPLOYEE_MANAGEMENT":
+		*i = ThirdPartyCategoryEmployeeManagement
+	case "ENGINEERING":
+		*i = ThirdPartyCategoryEngineering
+	case "FINANCE":
+		*i = ThirdPartyCategoryFinance
+	case "IDENTITY_PROVIDER":
+		*i = ThirdPartyCategoryIdentityProvider
+	case "IT":
+		*i = ThirdPartyCategoryIT
+	case "MARKETING":
+		*i = ThirdPartyCategoryMarketing
+	case "OFFICE_OPERATIONS":
+		*i = ThirdPartyCategoryOfficeOperations
+	case "OTHER":
+		*i = ThirdPartyCategoryOther
+	case "PASSWORD_MANAGEMENT":
+		*i = ThirdPartyCategoryPasswordManagement
+	case "PRODUCT_AND_DESIGN":
+		*i = ThirdPartyCategoryProductAndDesign
+	case "PROFESSIONAL_SERVICES":
+		*i = ThirdPartyCategoryProfessionalServices
+	case "RECRUITING":
+		*i = ThirdPartyCategoryRecruiting
+	case "SALES":
+		*i = ThirdPartyCategorySales
+	case "SECURITY":
+		*i = ThirdPartyCategorySecurity
+	case "VERSION_CONTROL":
+		*i = ThirdPartyCategoryVersionControl
+	default:
+		return fmt.Errorf("invalid ThirdPartyCategory value: %q", s)
+	}
+	return nil
+}

pkg/coredata/third_party_compliance_report.go

@@ -28,10 +28,10 @@ import (
 )
 
 type (
-	VendorComplianceReport struct {
+	ThirdPartyComplianceReport struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		ReportDate     time.Time  `db:"report_date"`
 		ValidUntil     *time.Time `db:"valid_until"`
 		ReportName     string     `db:"report_name"`
@@ -40,46 +40,46 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}
 
-	VendorComplianceReports []*VendorComplianceReport
+	ThirdPartyComplianceReports []*ThirdPartyComplianceReport
 )
 
-func (c VendorComplianceReport) CursorKey(orderBy VendorComplianceReportOrderField) page.CursorKey {
+func (c ThirdPartyComplianceReport) CursorKey(orderBy ThirdPartyComplianceReportOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorComplianceReportOrderFieldReportDate:
+	case ThirdPartyComplianceReportOrderFieldReportDate:
 		return page.NewCursorKey(c.ID, c.ReportDate)
-	case VendorComplianceReportOrderFieldCreatedAt:
+	case ThirdPartyComplianceReportOrderFieldCreatedAt:
 		return page.NewCursorKey(c.ID, c.CreatedAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (v *VendorComplianceReport) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_compliance_reports WHERE id = $1 LIMIT 1;`
+func (v *ThirdPartyComplianceReport) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_compliance_reports WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, v.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor compliance report authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty compliance report authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (vcs *VendorComplianceReports) LoadForVendorID(
+func (vcs *ThirdPartyComplianceReports) LoadForThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorComplianceReportOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyComplianceReportOrderField],
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	report_date,
 	valid_until,
 	report_name,
@@ -87,43 +87,43 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 	AND %s
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
-	args := pgx.NamedArgs{"vendor_id": vendorID}
+	args := pgx.NamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot query thirdParty compliance reports: %w", err)
 	}
 
-	vendorComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorComplianceReport])
+	thirdPartyComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyComplianceReport])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot collect thirdParty compliance reports: %w", err)
 	}
 
-	*vcs = vendorComplianceReports
+	*vcs = thirdPartyComplianceReports
 
 	return nil
 }
 
-func (vcs *VendorComplianceReports) LoadByVendorIDs(
+func (vcs *ThirdPartyComplianceReports) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vcs = VendorComplianceReports{}
+	if len(thirdPartyIDs) == 0 {
+		*vcs = ThirdPartyComplianceReports{}
 		return nil
 	}
 
@@ -131,7 +131,7 @@ func (vcs *VendorComplianceReports) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	report_date,
 	valid_until,
 	report_name,
@@ -139,51 +139,51 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 ORDER BY
-	vendor_id, report_date DESC
+	third_party_id, report_date DESC
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}
 
-	args := pgx.NamedArgs{"vendor_ids": ids}
+	args := pgx.NamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot query thirdParty compliance reports: %w", err)
 	}
 
-	vendorComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorComplianceReport])
+	thirdPartyComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyComplianceReport])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot collect thirdParty compliance reports: %w", err)
 	}
 
-	*vcs = vendorComplianceReports
+	*vcs = thirdPartyComplianceReports
 
 	return nil
 }
 
-func (vcr *VendorComplianceReport) LoadByID(
+func (vcr *ThirdPartyComplianceReport) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorComplianceReportID gid.GID,
+	thirdPartyComplianceReportID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	report_date,
 	valid_until,
 	report_name,
@@ -191,7 +191,7 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
 	AND id = @id
@@ -200,36 +200,36 @@ LIMIT 1;
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{"id": vendorComplianceReportID}
+	args := pgx.NamedArgs{"id": thirdPartyComplianceReportID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor compliance report: %w", err)
+		return fmt.Errorf("cannot query thirdParty compliance report: %w", err)
 	}
 
-	vendorComplianceReport, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorComplianceReport])
+	thirdPartyComplianceReport, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyComplianceReport])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor compliance report: %w", err)
+		return fmt.Errorf("cannot collect thirdParty compliance report: %w", err)
 	}
 
-	*vcr = vendorComplianceReport
+	*vcr = thirdPartyComplianceReport
 
 	return nil
 }
 
-func (vcr *VendorComplianceReport) Insert(
+func (vcr *ThirdPartyComplianceReport) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_compliance_reports (
+	third_party_compliance_reports (
 		id,
 		organization_id,
 		tenant_id,
-		vendor_id,
+		third_party_id,
 		report_date,
 		valid_until,
 		report_name,
@@ -241,7 +241,7 @@ VALUES (
 	@id,
 	@organization_id,
 	@tenant_id,
-	@vendor_id,
+	@third_party_id,
 	@report_date,
 	@valid_until,
 	@report_name,
@@ -254,7 +254,7 @@ VALUES (
 		"id":              vcr.ID,
 		"organization_id": vcr.OrganizationID,
 		"tenant_id":       scope.GetTenantID(),
-		"vendor_id":       vcr.VendorID,
+		"third_party_id":  vcr.ThirdPartyID,
 		"report_date":     vcr.ReportDate,
 		"valid_until":     vcr.ValidUntil,
 		"report_name":     vcr.ReportName,
@@ -267,7 +267,7 @@ VALUES (
 	return err
 }
 
-func (vcr *VendorComplianceReport) Delete(
+func (vcr *ThirdPartyComplianceReport) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
@@ -275,7 +275,7 @@ func (vcr *VendorComplianceReport) Delete(
 	q := `
 DELETE
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
 	AND id = @id
@@ -292,13 +292,13 @@ RETURNING report_file_id
 	err := conn.QueryRow(ctx, q, args).Scan(&vcrFileId)
 
 	if err != nil {
-		return fmt.Errorf("cannot delete vendor compliance report: %w", err)
+		return fmt.Errorf("cannot delete thirdParty compliance report: %w", err)
 	}
 
 	if vcrFileId != nil {
 		file := &File{ID: *vcrFileId}
 		if err = file.SoftDelete(ctx, conn, scope); err != nil {
-			return fmt.Errorf("cannot soft delete vendor compliance file: %w", err)
+			return fmt.Errorf("cannot soft delete thirdParty compliance file: %w", err)
 		}
 	}
 	return nil

pkg/coredata/third_party_compliance_report_order_field.go

@@ -15,27 +15,27 @@
 package coredata
 
 type (
-	VendorDataPrivacyAgreementOrderField string
+	ThirdPartyComplianceReportOrderField string
 )
 
 const (
-	VendorDataPrivacyAgreementOrderFieldValidFrom VendorDataPrivacyAgreementOrderField = "VALID_FROM"
-	VendorDataPrivacyAgreementOrderFieldCreatedAt VendorDataPrivacyAgreementOrderField = "CREATED_AT"
+	ThirdPartyComplianceReportOrderFieldReportDate ThirdPartyComplianceReportOrderField = "REPORT_DATE"
+	ThirdPartyComplianceReportOrderFieldCreatedAt  ThirdPartyComplianceReportOrderField = "CREATED_AT"
 )
 
-func (p VendorDataPrivacyAgreementOrderField) Column() string {
+func (p ThirdPartyComplianceReportOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorDataPrivacyAgreementOrderField) String() string {
+func (p ThirdPartyComplianceReportOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorDataPrivacyAgreementOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyComplianceReportOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorDataPrivacyAgreementOrderField) UnmarshalText(text []byte) error {
-	*p = VendorDataPrivacyAgreementOrderField(text)
+func (p *ThirdPartyComplianceReportOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyComplianceReportOrderField(text)
 	return nil
 }

pkg/coredata/third_party_contact.go

@@ -29,10 +29,10 @@ import (
 )
 
 type (
-	VendorContact struct {
+	ThirdPartyContact struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		FullName       *string    `db:"full_name"`
 		Email          *mail.Addr `db:"email"`
 		Phone          *string    `db:"phone"`
@@ -41,47 +41,47 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}
 
-	VendorContacts []*VendorContact
+	ThirdPartyContacts []*ThirdPartyContact
 )
 
-func (vc VendorContact) CursorKey(orderBy VendorContactOrderField) page.CursorKey {
+func (vc ThirdPartyContact) CursorKey(orderBy ThirdPartyContactOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorContactOrderFieldCreatedAt:
+	case ThirdPartyContactOrderFieldCreatedAt:
 		return page.CursorKey{ID: vc.ID, Value: vc.CreatedAt}
-	case VendorContactOrderFieldFullName:
+	case ThirdPartyContactOrderFieldFullName:
 		return page.CursorKey{ID: vc.ID, Value: vc.FullName}
-	case VendorContactOrderFieldEmail:
+	case ThirdPartyContactOrderFieldEmail:
 		return page.CursorKey{ID: vc.ID, Value: vc.Email}
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (vc *VendorContact) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_contacts WHERE id = $1 LIMIT 1;`
+func (vc *ThirdPartyContact) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_contacts WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vc.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor contact authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty contact authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (vc *VendorContact) LoadByID(
+func (vc *ThirdPartyContact) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorContactID gid.GID,
+	thirdPartyContactID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	full_name,
 	email,
 	phone,
@@ -89,50 +89,50 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND id = @vendor_contact_id
+	AND id = @third_party_contact_id
 LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_contact_id": vendorContactID}
+	args := pgx.StrictNamedArgs{"third_party_contact_id": thirdPartyContactID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor contact: %w", err)
+		return fmt.Errorf("cannot query thirdParty contact: %w", err)
 	}
 	defer rows.Close()
 
-	vendorContact, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorContact])
+	thirdPartyContact, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyContact])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}
 
-		return fmt.Errorf("cannot collect vendor contact: %w", err)
+		return fmt.Errorf("cannot collect thirdParty contact: %w", err)
 	}
 
-	*vc = vendorContact
+	*vc = thirdPartyContact
 
 	return nil
 }
 
-func (vc *VendorContacts) LoadByVendorID(
+func (vc *ThirdPartyContacts) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorContactOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyContactOrderField],
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	full_name,
 	email,
 	phone,
@@ -140,45 +140,45 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 	AND %s
 `
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"vendor_id": vendorID,
+		"third_party_id": thirdPartyID,
 	}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor contacts: %w", err)
+		return fmt.Errorf("cannot query thirdParty contacts: %w", err)
 	}
 	defer rows.Close()
 
-	vendorContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorContact])
+	thirdPartyContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyContact])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor contacts: %w", err)
+		return fmt.Errorf("cannot collect thirdParty contacts: %w", err)
 	}
 
-	*vc = vendorContacts
+	*vc = thirdPartyContacts
 
 	return nil
 }
 
-func (vc *VendorContacts) LoadByVendorIDs(
+func (vc *ThirdPartyContacts) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vc = VendorContacts{}
+	if len(thirdPartyIDs) == 0 {
+		*vc = ThirdPartyContacts{}
 		return nil
 	}
 
@@ -186,7 +186,7 @@ func (vc *VendorContacts) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	full_name,
 	email,
 	phone,
@@ -194,52 +194,52 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 ORDER BY
-	vendor_id, full_name ASC
+	third_party_id, full_name ASC
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}
 
-	args := pgx.StrictNamedArgs{"vendor_ids": ids}
+	args := pgx.StrictNamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor contacts: %w", err)
+		return fmt.Errorf("cannot query thirdParty contacts: %w", err)
 	}
 	defer rows.Close()
 
-	vendorContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorContact])
+	thirdPartyContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyContact])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor contacts: %w", err)
+		return fmt.Errorf("cannot collect thirdParty contacts: %w", err)
 	}
 
-	*vc = vendorContacts
+	*vc = thirdPartyContacts
 
 	return nil
 }
 
-func (vc VendorContact) Insert(
+func (vc ThirdPartyContact) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_contacts (
+	third_party_contacts (
 		tenant_id,
 		id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		full_name,
 		email,
 		phone,
@@ -249,9 +249,9 @@ INSERT INTO
 	)
 VALUES (
 	@tenant_id,
-	@vendor_contact_id,
+	@third_party_contact_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@full_name,
 	@email,
 	@phone,
@@ -262,34 +262,34 @@ VALUES (
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":         scope.GetTenantID(),
-		"vendor_contact_id": vc.ID,
-		"organization_id":   vc.OrganizationID,
-		"vendor_id":         vc.VendorID,
-		"full_name":         vc.FullName,
-		"email":             vc.Email,
-		"phone":             vc.Phone,
-		"role":              vc.Role,
-		"created_at":        vc.CreatedAt,
-		"updated_at":        vc.UpdatedAt,
+		"tenant_id":              scope.GetTenantID(),
+		"third_party_contact_id": vc.ID,
+		"organization_id":        vc.OrganizationID,
+		"third_party_id":         vc.ThirdPartyID,
+		"full_name":              vc.FullName,
+		"email":                  vc.Email,
+		"phone":                  vc.Phone,
+		"role":                   vc.Role,
+		"created_at":             vc.CreatedAt,
+		"updated_at":             vc.UpdatedAt,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert vendor contact: %w", err)
+		return fmt.Errorf("cannot insert thirdParty contact: %w", err)
 	}
 
 	return nil
 }
 
-func (vc VendorContact) Update(
+func (vc ThirdPartyContact) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_contacts
+	third_party_contacts
 SET
 	full_name = @full_name,
 	email = @email,
@@ -298,52 +298,52 @@ SET
 	updated_at = @updated_at
 WHERE
 	%s
-	AND id = @vendor_contact_id
+	AND id = @third_party_contact_id
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"vendor_contact_id": vc.ID,
-		"full_name":         vc.FullName,
-		"email":             vc.Email,
-		"phone":             vc.Phone,
-		"role":              vc.Role,
-		"updated_at":        vc.UpdatedAt,
+		"third_party_contact_id": vc.ID,
+		"full_name":              vc.FullName,
+		"email":                  vc.Email,
+		"phone":                  vc.Phone,
+		"role":                   vc.Role,
+		"updated_at":             vc.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor contact: %w", err)
+		return fmt.Errorf("cannot update thirdParty contact: %w", err)
 	}
 
 	return nil
 }
 
-func (vc VendorContact) Delete(
+func (vc ThirdPartyContact) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 DELETE FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND id = @vendor_contact_id
+	AND id = @third_party_contact_id
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_contact_id": vc.ID}
+	args := pgx.StrictNamedArgs{"third_party_contact_id": vc.ID}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot delete vendor contact: %w", err)
+		return fmt.Errorf("cannot delete thirdParty contact: %w", err)
 	}
 
 	return nil

pkg/coredata/third_party_contact_order_field.go

@@ -15,27 +15,28 @@
 package coredata
 
 type (
-	VendorComplianceReportOrderField string
+	ThirdPartyContactOrderField string
 )
 
 const (
-	VendorComplianceReportOrderFieldReportDate VendorComplianceReportOrderField = "REPORT_DATE"
-	VendorComplianceReportOrderFieldCreatedAt  VendorComplianceReportOrderField = "CREATED_AT"
+	ThirdPartyContactOrderFieldCreatedAt ThirdPartyContactOrderField = "CREATED_AT"
+	ThirdPartyContactOrderFieldFullName  ThirdPartyContactOrderField = "FULL_NAME"
+	ThirdPartyContactOrderFieldEmail     ThirdPartyContactOrderField = "EMAIL"
 )
 
-func (p VendorComplianceReportOrderField) Column() string {
+func (p ThirdPartyContactOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorComplianceReportOrderField) String() string {
+func (p ThirdPartyContactOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorComplianceReportOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyContactOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorComplianceReportOrderField) UnmarshalText(text []byte) error {
-	*p = VendorComplianceReportOrderField(text)
+func (p *ThirdPartyContactOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyContactOrderField(text)
 	return nil
 }

pkg/coredata/third_party_data_privacy_agreement.go

@@ -29,10 +29,10 @@ import (
 )
 
 type (
-	VendorDataPrivacyAgreement struct {
+	ThirdPartyDataPrivacyAgreement struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		ValidFrom      *time.Time `db:"valid_from"`
 		ValidUntil     *time.Time `db:"valid_until"`
 		FileID         gid.GID    `db:"file_id"`
@@ -40,87 +40,87 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}
 
-	VendorDataPrivacyAgreements []*VendorDataPrivacyAgreement
+	ThirdPartyDataPrivacyAgreements []*ThirdPartyDataPrivacyAgreement
 )
 
-func (v VendorDataPrivacyAgreement) CursorKey(orderBy VendorDataPrivacyAgreementOrderField) page.CursorKey {
+func (v ThirdPartyDataPrivacyAgreement) CursorKey(orderBy ThirdPartyDataPrivacyAgreementOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorDataPrivacyAgreementOrderFieldValidFrom:
+	case ThirdPartyDataPrivacyAgreementOrderFieldValidFrom:
 		return page.NewCursorKey(v.ID, v.ValidFrom)
-	case VendorDataPrivacyAgreementOrderFieldCreatedAt:
+	case ThirdPartyDataPrivacyAgreementOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (vdpa *VendorDataPrivacyAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_data_privacy_agreements WHERE id = $1 LIMIT 1;`
+func (vdpa *ThirdPartyDataPrivacyAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_data_privacy_agreements WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vdpa.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor data privacy agreement authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty data privacy agreement authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (vdpa *VendorDataPrivacyAgreement) LoadByVendorID(
+func (vdpa *ThirdPartyDataPrivacyAgreement) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{"vendor_id": vendorID}
+	args := pgx.NamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty data privacy agreement: %w", err)
 	}
 
-	vendorDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorDataPrivacyAgreement])
+	thirdPartyDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyDataPrivacyAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty data privacy agreement: %w", err)
 	}
 
-	*vdpa = vendorDataPrivacyAgreement
+	*vdpa = thirdPartyDataPrivacyAgreement
 
 	return nil
 }
 
-func (vdpas *VendorDataPrivacyAgreements) LoadByVendorIDs(
+func (vdpas *ThirdPartyDataPrivacyAgreements) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vdpas = VendorDataPrivacyAgreements{}
+	if len(thirdPartyIDs) == 0 {
+		*vdpas = ThirdPartyDataPrivacyAgreements{}
 		return nil
 	}
 
@@ -128,38 +128,38 @@ func (vdpas *VendorDataPrivacyAgreements) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}
 
-	args := pgx.NamedArgs{"vendor_ids": ids}
+	args := pgx.NamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor data privacy agreements: %w", err)
+		return fmt.Errorf("cannot query thirdParty data privacy agreements: %w", err)
 	}
 
-	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorDataPrivacyAgreement])
+	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyDataPrivacyAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor data privacy agreements: %w", err)
+		return fmt.Errorf("cannot collect thirdParty data privacy agreements: %w", err)
 	}
 
 	*vdpas = agreements
@@ -167,24 +167,24 @@ WHERE
 	return nil
 }
 
-func (vdpa *VendorDataPrivacyAgreement) LoadByID(
+func (vdpa *ThirdPartyDataPrivacyAgreement) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorDataPrivacyAgreementID gid.GID,
+	thirdPartyDataPrivacyAgreementID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
 	AND id = @id
@@ -193,32 +193,32 @@ LIMIT 1;
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{"id": vendorDataPrivacyAgreementID}
+	args := pgx.NamedArgs{"id": thirdPartyDataPrivacyAgreementID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty data privacy agreement: %w", err)
 	}
 
-	vendorDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorDataPrivacyAgreement])
+	thirdPartyDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyDataPrivacyAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty data privacy agreement: %w", err)
 	}
 
-	*vdpa = vendorDataPrivacyAgreement
+	*vdpa = thirdPartyDataPrivacyAgreement
 
 	return nil
 }
 
-func (vdpa *VendorDataPrivacyAgreement) Update(
+func (vdpa *ThirdPartyDataPrivacyAgreement) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 SET
 	valid_from = @valid_from,
 	valid_until = @valid_until,
@@ -243,24 +243,24 @@ WHERE
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot update thirdParty data privacy agreement: %w", err)
 	}
 
 	return nil
 }
 
-func (vdpa *VendorDataPrivacyAgreement) Upsert(
+func (vdpa *ThirdPartyDataPrivacyAgreement) Upsert(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_data_privacy_agreements (
+	third_party_data_privacy_agreements (
 		id,
 		tenant_id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		valid_from,
 		valid_until,
 		file_id,
@@ -271,14 +271,14 @@ VALUES (
 	@id,
 	@tenant_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@valid_from,
 	@valid_until,
 	@file_id,
 	@created_at,
 	@updated_at
 )
-ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
+ON CONFLICT (organization_id, third_party_id) DO UPDATE SET
 	id = EXCLUDED.id,
 	valid_from = EXCLUDED.valid_from,
 	valid_until = EXCLUDED.valid_until,
@@ -288,7 +288,7 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	args := pgx.StrictNamedArgs{
 		"id":              vdpa.ID,
 		"tenant_id":       scope.GetTenantID(),
-		"vendor_id":       vdpa.VendorID,
+		"third_party_id":  vdpa.ThirdPartyID,
 		"organization_id": vdpa.OrganizationID,
 		"valid_from":      vdpa.ValidFrom,
 		"valid_until":     vdpa.ValidUntil,
@@ -301,16 +301,16 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	if err != nil {
 		var pgErr *pgconn.PgError
 		if errors.As(err, &pgErr) {
-			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_data_privacy_agreements_source_id_snapshot_id_key" {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "third_party_data_privacy_agreements_source_id_snapshot_id_key" {
 				return ErrResourceAlreadyExists
 			}
 		}
-		return fmt.Errorf("cannot upsert vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot upsert thirdParty data privacy agreement: %w", err)
 	}
 	return nil
 }
 
-func (vdpa *VendorDataPrivacyAgreement) Delete(
+func (vdpa *ThirdPartyDataPrivacyAgreement) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
@@ -318,7 +318,7 @@ func (vdpa *VendorDataPrivacyAgreement) Delete(
 	q := `
 DELETE
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
 	AND id = @id
@@ -334,24 +334,24 @@ WHERE
 	return err
 }
 
-func (vdpa *VendorDataPrivacyAgreement) DeleteByVendorID(
+func (vdpa *ThirdPartyDataPrivacyAgreement) DeleteByThirdPartyID(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 DELETE
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)

pkg/coredata/third_party_data_privacy_agreement_order_field.go

@@ -15,28 +15,27 @@
 package coredata
 
 type (
-	VendorContactOrderField string
+	ThirdPartyDataPrivacyAgreementOrderField string
 )
 
 const (
-	VendorContactOrderFieldCreatedAt VendorContactOrderField = "CREATED_AT"
-	VendorContactOrderFieldFullName  VendorContactOrderField = "FULL_NAME"
-	VendorContactOrderFieldEmail     VendorContactOrderField = "EMAIL"
+	ThirdPartyDataPrivacyAgreementOrderFieldValidFrom ThirdPartyDataPrivacyAgreementOrderField = "VALID_FROM"
+	ThirdPartyDataPrivacyAgreementOrderFieldCreatedAt ThirdPartyDataPrivacyAgreementOrderField = "CREATED_AT"
 )
 
-func (p VendorContactOrderField) Column() string {
+func (p ThirdPartyDataPrivacyAgreementOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorContactOrderField) String() string {
+func (p ThirdPartyDataPrivacyAgreementOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorContactOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyDataPrivacyAgreementOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorContactOrderField) UnmarshalText(text []byte) error {
-	*p = VendorContactOrderField(text)
+func (p *ThirdPartyDataPrivacyAgreementOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyDataPrivacyAgreementOrderField(text)
 	return nil
 }

pkg/coredata/third_party_filter.go

@@ -19,18 +19,18 @@ import (
 )
 
 type (
-	VendorFilter struct {
+	ThirdPartyFilter struct {
 		showOnTrustCenter *bool
 	}
 )
 
-func NewVendorFilter(showOnTrustCenter *bool) *VendorFilter {
-	return &VendorFilter{
+func NewThirdPartyFilter(showOnTrustCenter *bool) *ThirdPartyFilter {
+	return &ThirdPartyFilter{
 		showOnTrustCenter: showOnTrustCenter,
 	}
 }
 
-func (f *VendorFilter) SQLArguments() pgx.StrictNamedArgs {
+func (f *ThirdPartyFilter) SQLArguments() pgx.StrictNamedArgs {
 	args := pgx.StrictNamedArgs{}
 
 	if f.showOnTrustCenter != nil {
@@ -42,7 +42,7 @@ func (f *VendorFilter) SQLArguments() pgx.StrictNamedArgs {
 	return args
 }
 
-func (f *VendorFilter) SQLFragment() string {
+func (f *ThirdPartyFilter) SQLFragment() string {
 	return `
 (
 	CASE

pkg/coredata/third_party_order_field.go

@@ -15,28 +15,28 @@
 package coredata
 
 type (
-	VendorOrderField string
+	ThirdPartyOrderField string
 )
 
 const (
-	VendorOrderFieldCreatedAt VendorOrderField = "CREATED_AT"
-	VendorOrderFieldUpdatedAt VendorOrderField = "UPDATED_AT"
-	VendorOrderFieldName      VendorOrderField = "NAME"
+	ThirdPartyOrderFieldCreatedAt ThirdPartyOrderField = "CREATED_AT"
+	ThirdPartyOrderFieldUpdatedAt ThirdPartyOrderField = "UPDATED_AT"
+	ThirdPartyOrderFieldName      ThirdPartyOrderField = "NAME"
 )
 
-func (p VendorOrderField) Column() string {
+func (p ThirdPartyOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorOrderField) String() string {
+func (p ThirdPartyOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorOrderField) UnmarshalText(text []byte) error {
-	*p = VendorOrderField(text)
+func (p *ThirdPartyOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyOrderField(text)
 	return nil
 }

pkg/coredata/third_party_risk_assessment.go

@@ -28,11 +28,11 @@ import (
 )
 
 type (
-	// RiskAssessment represents a point-in-time risk assessment for a vendor
-	VendorRiskAssessment struct {
+	// RiskAssessment represents a point-in-time risk assessment for a thirdParty
+	ThirdPartyRiskAssessment struct {
 		ID              gid.GID         `db:"id"`
 		OrganizationID  gid.GID         `db:"organization_id"`
-		VendorID        gid.GID         `db:"vendor_id"`
+		ThirdPartyID    gid.GID         `db:"third_party_id"`
 		ExpiresAt       time.Time       `db:"expires_at"`
 		DataSensitivity DataSensitivity `db:"data_sensitivity"`
 		BusinessImpact  BusinessImpact  `db:"business_impact"`
@@ -41,47 +41,47 @@ type (
 		UpdatedAt       time.Time       `db:"updated_at"`
 	}
 
-	VendorRiskAssessments []*VendorRiskAssessment
+	ThirdPartyRiskAssessments []*ThirdPartyRiskAssessment
 )
 
-func (v VendorRiskAssessment) CursorKey(orderBy VendorRiskAssessmentOrderField) page.CursorKey {
+func (v ThirdPartyRiskAssessment) CursorKey(orderBy ThirdPartyRiskAssessmentOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorRiskAssessmentOrderFieldCreatedAt:
+	case ThirdPartyRiskAssessmentOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
-	case VendorRiskAssessmentOrderFieldExpiresAt:
+	case ThirdPartyRiskAssessmentOrderFieldExpiresAt:
 		return page.NewCursorKey(v.ID, v.ExpiresAt)
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (v *VendorRiskAssessment) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_risk_assessments WHERE id = $1 LIMIT 1;`
+func (v *ThirdPartyRiskAssessment) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_risk_assessments WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, v.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor risk assessment authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty risk assessment authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
 // Insert adds a new risk assessment to the database
-func (r VendorRiskAssessment) Insert(
+func (r ThirdPartyRiskAssessment) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-    vendor_risk_assessments (
+    third_party_risk_assessments (
         tenant_id,
         id,
         organization_id,
-        vendor_id,
+        third_party_id,
         expires_at,
         data_sensitivity,
         business_impact,
@@ -93,7 +93,7 @@ VALUES (
     @tenant_id,
     @id,
     @organization_id,
-    @vendor_id,
+    @third_party_id,
     @expires_at,
     @data_sensitivity,
     @business_impact,
@@ -107,7 +107,7 @@ VALUES (
 		"tenant_id":        scope.GetTenantID(),
 		"id":               r.ID,
 		"organization_id":  r.OrganizationID,
-		"vendor_id":        r.VendorID,
+		"third_party_id":   r.ThirdPartyID,
 		"expires_at":       r.ExpiresAt,
 		"data_sensitivity": r.DataSensitivity,
 		"business_impact":  r.BusinessImpact,
@@ -120,7 +120,7 @@ VALUES (
 }
 
 // LoadByID loads a risk assessment by its ID
-func (r *VendorRiskAssessment) LoadByID(
+func (r *ThirdPartyRiskAssessment) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -130,7 +130,7 @@ func (r *VendorRiskAssessment) LoadByID(
 SELECT
     id,
     organization_id,
-    vendor_id,
+    third_party_id,
     expires_at,
     data_sensitivity,
     business_impact,
@@ -138,7 +138,7 @@ SELECT
     created_at,
     updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
     %s
     AND id = @id
@@ -156,7 +156,7 @@ LIMIT 1;
 	}
 	defer rows.Close()
 
-	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
+	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessment: %w", err)
 	}
@@ -166,18 +166,18 @@ LIMIT 1;
 	return nil
 }
 
-// LoadLatestByVendorID loads the most recent risk assessment for a vendor
-func (r *VendorRiskAssessment) LoadLatestByVendorID(
+// LoadLatestByThirdPartyID loads the most recent risk assessment for a thirdParty
+func (r *ThirdPartyRiskAssessment) LoadLatestByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
     id,
     organization_id,
-    vendor_id,
+    third_party_id,
     expires_at,
     data_sensitivity,
     business_impact,
@@ -185,10 +185,10 @@ SELECT
     created_at,
     updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
     %s
-    AND vendor_id = @vendor_id
+    AND third_party_id = @third_party_id
     AND snapshot_id IS NULL
 ORDER BY
     created_at DESC
@@ -197,7 +197,7 @@ LIMIT 1;
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
@@ -206,7 +206,7 @@ LIMIT 1;
 	}
 	defer rows.Close()
 
-	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
+	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessment: %w", err)
 	}
@@ -216,19 +216,19 @@ LIMIT 1;
 	return nil
 }
 
-// LoadByVendorID loads all risk assessments for a vendor, ordered by assessment date
-func (r *VendorRiskAssessments) LoadByVendorID(
+// LoadByThirdPartyID loads all risk assessments for a thirdParty, ordered by assessment date
+func (r *ThirdPartyRiskAssessments) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorRiskAssessmentOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyRiskAssessmentOrderField],
 ) error {
 	q := `
 SELECT
     id,
     organization_id,
-    vendor_id,
+    third_party_id,
     expires_at,
     data_sensitivity,
     business_impact,
@@ -236,17 +236,17 @@ SELECT
     created_at,
     updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
     %s
-    AND vendor_id = @vendor_id
+    AND third_party_id = @third_party_id
     AND snapshot_id IS NULL
 	AND %s
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
@@ -255,7 +255,7 @@ WHERE
 		return fmt.Errorf("cannot query risk assessments: %w", err)
 	}
 
-	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorRiskAssessment])
+	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessments: %w", err)
 	}
@@ -265,14 +265,14 @@ WHERE
 	return nil
 }
 
-func (r *VendorRiskAssessments) LoadByVendorIDs(
+func (r *ThirdPartyRiskAssessments) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*r = VendorRiskAssessments{}
+	if len(thirdPartyIDs) == 0 {
+		*r = ThirdPartyRiskAssessments{}
 		return nil
 	}
 
@@ -280,7 +280,7 @@ func (r *VendorRiskAssessments) LoadByVendorIDs(
 SELECT
     id,
     organization_id,
-    vendor_id,
+    third_party_id,
     expires_at,
     data_sensitivity,
     business_impact,
@@ -288,23 +288,23 @@ SELECT
     created_at,
     updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
     %s
-    AND vendor_id = ANY(@vendor_ids)
+    AND third_party_id = ANY(@third_party_ids)
     AND snapshot_id IS NULL
 ORDER BY
-    vendor_id, created_at DESC
+    third_party_id, created_at DESC
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}
 
-	args := pgx.StrictNamedArgs{"vendor_ids": ids}
+	args := pgx.StrictNamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
@@ -312,7 +312,7 @@ ORDER BY
 		return fmt.Errorf("cannot query risk assessments: %w", err)
 	}
 
-	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorRiskAssessment])
+	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessments: %w", err)
 	}

pkg/coredata/third_party_risk_assessment_order_field.go

@@ -15,27 +15,27 @@
 package coredata
 
 type (
-	VendorRiskAssessmentOrderField string
+	ThirdPartyRiskAssessmentOrderField string
 )
 
 const (
-	VendorRiskAssessmentOrderFieldCreatedAt VendorRiskAssessmentOrderField = "CREATED_AT"
-	VendorRiskAssessmentOrderFieldExpiresAt VendorRiskAssessmentOrderField = "EXPIRES_AT"
+	ThirdPartyRiskAssessmentOrderFieldCreatedAt ThirdPartyRiskAssessmentOrderField = "CREATED_AT"
+	ThirdPartyRiskAssessmentOrderFieldExpiresAt ThirdPartyRiskAssessmentOrderField = "EXPIRES_AT"
 )
 
-func (p VendorRiskAssessmentOrderField) Column() string {
+func (p ThirdPartyRiskAssessmentOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorRiskAssessmentOrderField) String() string {
+func (p ThirdPartyRiskAssessmentOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorRiskAssessmentOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyRiskAssessmentOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorRiskAssessmentOrderField) UnmarshalText(text []byte) error {
-	*p = VendorRiskAssessmentOrderField(text)
+func (p *ThirdPartyRiskAssessmentOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyRiskAssessmentOrderField(text)
 	return nil
 }

pkg/coredata/third_party_service.go

@@ -28,148 +28,148 @@ import (
 )
 
 type (
-	VendorService struct {
+	ThirdPartyService struct {
 		ID             gid.GID   `db:"id"`
 		OrganizationID gid.GID   `db:"organization_id"`
-		VendorID       gid.GID   `db:"vendor_id"`
+		ThirdPartyID   gid.GID   `db:"third_party_id"`
 		Name           string    `db:"name"`
 		Description    *string   `db:"description"`
 		CreatedAt      time.Time `db:"created_at"`
 		UpdatedAt      time.Time `db:"updated_at"`
 	}
 
-	VendorServices []*VendorService
+	ThirdPartyServices []*ThirdPartyService
 )
 
-func (vs VendorService) CursorKey(orderBy VendorServiceOrderField) page.CursorKey {
+func (vs ThirdPartyService) CursorKey(orderBy ThirdPartyServiceOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorServiceOrderFieldCreatedAt:
+	case ThirdPartyServiceOrderFieldCreatedAt:
 		return page.CursorKey{ID: vs.ID, Value: vs.CreatedAt}
-	case VendorServiceOrderFieldName:
+	case ThirdPartyServiceOrderFieldName:
 		return page.CursorKey{ID: vs.ID, Value: vs.Name}
 	}
 
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (vs *VendorService) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_services WHERE id = $1 LIMIT 1;`
+func (vs *ThirdPartyService) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_services WHERE id = $1 LIMIT 1;`
 
 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vs.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor service authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty service authorization attributes: %w", err)
 	}
 
 	return map[string]string{"organization_id": organizationID.String()}, nil
 }
 
-func (vs *VendorService) LoadByID(
+func (vs *ThirdPartyService) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorServiceID gid.GID,
+	thirdPartyServiceID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	name,
 	description,
 	created_at,
 	updated_at
 FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND id = @vendor_service_id
+	AND id = @third_party_service_id
 LIMIT 1;
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_service_id": vendorServiceID}
+	args := pgx.StrictNamedArgs{"third_party_service_id": thirdPartyServiceID}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor service: %w", err)
+		return fmt.Errorf("cannot query thirdParty service: %w", err)
 	}
 	defer rows.Close()
 
-	vendorService, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorService])
+	thirdPartyService, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyService])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}
 
-		return fmt.Errorf("cannot collect vendor service: %w", err)
+		return fmt.Errorf("cannot collect thirdParty service: %w", err)
 	}
 
-	*vs = vendorService
+	*vs = thirdPartyService
 
 	return nil
 }
 
-func (vs *VendorServices) LoadByVendorID(
+func (vs *ThirdPartyServices) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorServiceOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyServiceOrderField],
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	name,
 	description,
 	created_at,
 	updated_at
 FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 	AND %s
 `
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"vendor_id": vendorID,
+		"third_party_id": thirdPartyID,
 	}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor services: %w", err)
+		return fmt.Errorf("cannot query thirdParty services: %w", err)
 	}
 	defer rows.Close()
 
-	vendorServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorService])
+	thirdPartyServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyService])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor services: %w", err)
+		return fmt.Errorf("cannot collect thirdParty services: %w", err)
 	}
 
-	*vs = vendorServices
+	*vs = thirdPartyServices
 
 	return nil
 }
 
-func (vs *VendorServices) LoadByVendorIDs(
+func (vs *ThirdPartyServices) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vs = VendorServices{}
+	if len(thirdPartyIDs) == 0 {
+		*vs = ThirdPartyServices{}
 		return nil
 	}
 
@@ -177,58 +177,58 @@ func (vs *VendorServices) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	name,
 	description,
 	created_at,
 	updated_at
 FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 ORDER BY
-	vendor_id, name ASC
+	third_party_id, name ASC
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}
 
-	args := pgx.StrictNamedArgs{"vendor_ids": ids}
+	args := pgx.StrictNamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor services: %w", err)
+		return fmt.Errorf("cannot query thirdParty services: %w", err)
 	}
 	defer rows.Close()
 
-	vendorServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorService])
+	thirdPartyServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyService])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor services: %w", err)
+		return fmt.Errorf("cannot collect thirdParty services: %w", err)
 	}
 
-	*vs = vendorServices
+	*vs = thirdPartyServices
 
 	return nil
 }
 
-func (vs VendorService) Insert(
+func (vs ThirdPartyService) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_services (
+	third_party_services (
 		tenant_id,
 		id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		name,
 		description,
 		created_at,
@@ -236,9 +236,9 @@ INSERT INTO
 	)
 VALUES (
 	@tenant_id,
-	@vendor_service_id,
+	@third_party_service_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@name,
 	@description,
 	@created_at,
@@ -247,82 +247,82 @@ VALUES (
 `
 
 	args := pgx.StrictNamedArgs{
-		"tenant_id":         scope.GetTenantID(),
-		"vendor_service_id": vs.ID,
-		"organization_id":   vs.OrganizationID,
-		"vendor_id":         vs.VendorID,
-		"name":              vs.Name,
-		"description":       vs.Description,
-		"created_at":        vs.CreatedAt,
-		"updated_at":        vs.UpdatedAt,
+		"tenant_id":              scope.GetTenantID(),
+		"third_party_service_id": vs.ID,
+		"organization_id":        vs.OrganizationID,
+		"third_party_id":         vs.ThirdPartyID,
+		"name":                   vs.Name,
+		"description":            vs.Description,
+		"created_at":             vs.CreatedAt,
+		"updated_at":             vs.UpdatedAt,
 	}
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert vendor service: %w", err)
+		return fmt.Errorf("cannot insert thirdParty service: %w", err)
 	}
 
 	return nil
 }
 
-func (vs VendorService) Update(
+func (vs ThirdPartyService) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_services
+	third_party_services
 SET
 	name = @name,
 	description = @description,
 	updated_at = @updated_at
 WHERE
 	%s
-	AND id = @vendor_service_id
+	AND id = @third_party_service_id
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.StrictNamedArgs{
-		"vendor_service_id": vs.ID,
-		"name":              vs.Name,
-		"description":       vs.Description,
-		"updated_at":        vs.UpdatedAt,
+		"third_party_service_id": vs.ID,
+		"name":                   vs.Name,
+		"description":            vs.Description,
+		"updated_at":             vs.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor service: %w", err)
+		return fmt.Errorf("cannot update thirdParty service: %w", err)
 	}
 
 	return nil
 }
 
-func (vs VendorService) Delete(
+func (vs ThirdPartyService) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 DELETE FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND id = @vendor_service_id
+	AND id = @third_party_service_id
 	AND snapshot_id IS NULL
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.StrictNamedArgs{"vendor_service_id": vs.ID}
+	args := pgx.StrictNamedArgs{"third_party_service_id": vs.ID}
 	maps.Copy(args, scope.SQLArguments())
 
 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot delete vendor service: %w", err)
+		return fmt.Errorf("cannot delete thirdParty service: %w", err)
 	}
 
 	return nil

pkg/coredata/third_party_service_order_field.go

@@ -19,33 +19,33 @@ import (
 )
 
 type (
-	VendorServiceOrderField string
+	ThirdPartyServiceOrderField string
 )
 
 const (
-	VendorServiceOrderFieldCreatedAt VendorServiceOrderField = "CREATED_AT"
-	VendorServiceOrderFieldName      VendorServiceOrderField = "NAME"
+	ThirdPartyServiceOrderFieldCreatedAt ThirdPartyServiceOrderField = "CREATED_AT"
+	ThirdPartyServiceOrderFieldName      ThirdPartyServiceOrderField = "NAME"
 )
 
-func (p VendorServiceOrderField) Column() string {
+func (p ThirdPartyServiceOrderField) Column() string {
 	return string(p)
 }
 
-func (p VendorServiceOrderField) String() string {
+func (p ThirdPartyServiceOrderField) String() string {
 	return string(p)
 }
 
-func (p VendorServiceOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyServiceOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }
 
-func (p *VendorServiceOrderField) UnmarshalText(text []byte) error {
+func (p *ThirdPartyServiceOrderField) UnmarshalText(text []byte) error {
 	val := string(text)
 	switch val {
-	case string(VendorServiceOrderFieldCreatedAt),
-		string(VendorServiceOrderFieldName):
-		*p = VendorServiceOrderField(val)
+	case string(ThirdPartyServiceOrderFieldCreatedAt),
+		string(ThirdPartyServiceOrderFieldName):
+		*p = ThirdPartyServiceOrderField(val)
 		return nil
 	}
-	return fmt.Errorf("invalid VendorServiceOrderField value: %q", val)
+	return fmt.Errorf("invalid ThirdPartyServiceOrderField value: %q", val)
 }

pkg/coredata/vendor_category.go

@@ -1,255 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package coredata
-
-import (
-	"database/sql/driver"
-	"encoding/json"
-	"fmt"
-)
-
-type VendorCategory string
-
-const (
-	VendorCategoryAnalytics                VendorCategory = "ANALYTICS"
-	VendorCategoryCloudMonitoring          VendorCategory = "CLOUD_MONITORING"
-	VendorCategoryCloudProvider            VendorCategory = "CLOUD_PROVIDER"
-	VendorCategoryCollaboration            VendorCategory = "COLLABORATION"
-	VendorCategoryCustomerSupport          VendorCategory = "CUSTOMER_SUPPORT"
-	VendorCategoryDataStorageAndProcessing VendorCategory = "DATA_STORAGE_AND_PROCESSING"
-	VendorCategoryDocumentManagement       VendorCategory = "DOCUMENT_MANAGEMENT"
-	VendorCategoryEmployeeManagement       VendorCategory = "EMPLOYEE_MANAGEMENT"
-	VendorCategoryEngineering              VendorCategory = "ENGINEERING"
-	VendorCategoryFinance                  VendorCategory = "FINANCE"
-	VendorCategoryIdentityProvider         VendorCategory = "IDENTITY_PROVIDER"
-	VendorCategoryIT                       VendorCategory = "IT"
-	VendorCategoryMarketing                VendorCategory = "MARKETING"
-	VendorCategoryOfficeOperations         VendorCategory = "OFFICE_OPERATIONS"
-	VendorCategoryOther                    VendorCategory = "OTHER"
-	VendorCategoryPasswordManagement       VendorCategory = "PASSWORD_MANAGEMENT"
-	VendorCategoryProductAndDesign         VendorCategory = "PRODUCT_AND_DESIGN"
-	VendorCategoryProfessionalServices     VendorCategory = "PROFESSIONAL_SERVICES"
-	VendorCategoryRecruiting               VendorCategory = "RECRUITING"
-	VendorCategorySales                    VendorCategory = "SALES"
-	VendorCategorySecurity                 VendorCategory = "SECURITY"
-	VendorCategoryVersionControl           VendorCategory = "VERSION_CONTROL"
-)
-
-func VendorCategories() []VendorCategory {
-	return []VendorCategory{
-		VendorCategoryAnalytics,
-		VendorCategoryCloudMonitoring,
-		VendorCategoryCloudProvider,
-		VendorCategoryCollaboration,
-		VendorCategoryCustomerSupport,
-		VendorCategoryDataStorageAndProcessing,
-		VendorCategoryDocumentManagement,
-		VendorCategoryEmployeeManagement,
-		VendorCategoryEngineering,
-		VendorCategoryFinance,
-		VendorCategoryIdentityProvider,
-		VendorCategoryIT,
-		VendorCategoryMarketing,
-		VendorCategoryOfficeOperations,
-		VendorCategoryOther,
-		VendorCategoryPasswordManagement,
-		VendorCategoryProductAndDesign,
-		VendorCategoryProfessionalServices,
-		VendorCategoryRecruiting,
-		VendorCategorySales,
-		VendorCategorySecurity,
-		VendorCategoryVersionControl,
-	}
-}
-
-func (i VendorCategory) String() string {
-	return string(i)
-}
-
-func (i *VendorCategory) Scan(value any) error {
-	switch v := value.(type) {
-	case string:
-		switch v {
-		case "ANALYTICS":
-			*i = VendorCategoryAnalytics
-		case "CLOUD_MONITORING":
-			*i = VendorCategoryCloudMonitoring
-		case "CLOUD_PROVIDER":
-			*i = VendorCategoryCloudProvider
-		case "COLLABORATION":
-			*i = VendorCategoryCollaboration
-		case "CUSTOMER_SUPPORT":
-			*i = VendorCategoryCustomerSupport
-		case "DATA_STORAGE_AND_PROCESSING":
-			*i = VendorCategoryDataStorageAndProcessing
-		case "DOCUMENT_MANAGEMENT":
-			*i = VendorCategoryDocumentManagement
-		case "EMPLOYEE_MANAGEMENT":
-			*i = VendorCategoryEmployeeManagement
-		case "ENGINEERING":
-			*i = VendorCategoryEngineering
-		case "FINANCE":
-			*i = VendorCategoryFinance
-		case "IDENTITY_PROVIDER":
-			*i = VendorCategoryIdentityProvider
-		case "IT":
-			*i = VendorCategoryIT
-		case "MARKETING":
-			*i = VendorCategoryMarketing
-		case "OFFICE_OPERATIONS":
-			*i = VendorCategoryOfficeOperations
-		case "OTHER":
-			*i = VendorCategoryOther
-		case "PASSWORD_MANAGEMENT":
-			*i = VendorCategoryPasswordManagement
-		case "PRODUCT_AND_DESIGN":
-			*i = VendorCategoryProductAndDesign
-		case "PROFESSIONAL_SERVICES":
-			*i = VendorCategoryProfessionalServices
-		case "RECRUITING":
-			*i = VendorCategoryRecruiting
-		case "SALES":
-			*i = VendorCategorySales
-		case "SECURITY":
-			*i = VendorCategorySecurity
-		case "VERSION_CONTROL":
-			*i = VendorCategoryVersionControl
-		default:
-			return fmt.Errorf("invalid VendorCategory value: %q", v)
-		}
-	default:
-		return fmt.Errorf("unsupported type for VendorCategory: %T", value)
-	}
-	return nil
-}
-
-func (i VendorCategory) Value() (driver.Value, error) {
-	return i.String(), nil
-}
-
-func (i VendorCategory) MarshalJSON() ([]byte, error) {
-	return json.Marshal(i.String())
-}
-
-func (i *VendorCategory) UnmarshalJSON(data []byte) error {
-	var s string
-	if err := json.Unmarshal(data, &s); err != nil {
-		return err
-	}
-
-	switch s {
-	case "ANALYTICS":
-		*i = VendorCategoryAnalytics
-	case "CLOUD_MONITORING":
-		*i = VendorCategoryCloudMonitoring
-	case "CLOUD_PROVIDER":
-		*i = VendorCategoryCloudProvider
-	case "COLLABORATION":
-		*i = VendorCategoryCollaboration
-	case "CUSTOMER_SUPPORT":
-		*i = VendorCategoryCustomerSupport
-	case "DATA_STORAGE_AND_PROCESSING":
-		*i = VendorCategoryDataStorageAndProcessing
-	case "DOCUMENT_MANAGEMENT":
-		*i = VendorCategoryDocumentManagement
-	case "EMPLOYEE_MANAGEMENT":
-		*i = VendorCategoryEmployeeManagement
-	case "ENGINEERING":
-		*i = VendorCategoryEngineering
-	case "FINANCE":
-		*i = VendorCategoryFinance
-	case "IDENTITY_PROVIDER":
-		*i = VendorCategoryIdentityProvider
-	case "IT":
-		*i = VendorCategoryIT
-	case "MARKETING":
-		*i = VendorCategoryMarketing
-	case "OFFICE_OPERATIONS":
-		*i = VendorCategoryOfficeOperations
-	case "OTHER":
-		*i = VendorCategoryOther
-	case "PASSWORD_MANAGEMENT":
-		*i = VendorCategoryPasswordManagement
-	case "PRODUCT_AND_DESIGN":
-		*i = VendorCategoryProductAndDesign
-	case "PROFESSIONAL_SERVICES":
-		*i = VendorCategoryProfessionalServices
-	case "RECRUITING":
-		*i = VendorCategoryRecruiting
-	case "SALES":
-		*i = VendorCategorySales
-	case "SECURITY":
-		*i = VendorCategorySecurity
-	case "VERSION_CONTROL":
-		*i = VendorCategoryVersionControl
-	default:
-		return fmt.Errorf("invalid VendorCategory value: %q", s)
-	}
-	return nil
-}
-
-func (i *VendorCategory) UnmarshalText(text []byte) error {
-	s := string(text)
-
-	switch s {
-	case "ANALYTICS":
-		*i = VendorCategoryAnalytics
-	case "CLOUD_MONITORING":
-		*i = VendorCategoryCloudMonitoring
-	case "CLOUD_PROVIDER":
-		*i = VendorCategoryCloudProvider
-	case "COLLABORATION":
-		*i = VendorCategoryCollaboration
-	case "CUSTOMER_SUPPORT":
-		*i = VendorCategoryCustomerSupport
-	case "DATA_STORAGE_AND_PROCESSING":
-		*i = VendorCategoryDataStorageAndProcessing
-	case "DOCUMENT_MANAGEMENT":
-		*i = VendorCategoryDocumentManagement
-	case "EMPLOYEE_MANAGEMENT":
-		*i = VendorCategoryEmployeeManagement
-	case "ENGINEERING":
-		*i = VendorCategoryEngineering
-	case "FINANCE":
-		*i = VendorCategoryFinance
-	case "IDENTITY_PROVIDER":
-		*i = VendorCategoryIdentityProvider
-	case "IT":
-		*i = VendorCategoryIT
-	case "MARKETING":
-		*i = VendorCategoryMarketing
-	case "OFFICE_OPERATIONS":
-		*i = VendorCategoryOfficeOperations
-	case "OTHER":
-		*i = VendorCategoryOther
-	case "PASSWORD_MANAGEMENT":
-		*i = VendorCategoryPasswordManagement
-	case "PRODUCT_AND_DESIGN":
-		*i = VendorCategoryProductAndDesign
-	case "PROFESSIONAL_SERVICES":
-		*i = VendorCategoryProfessionalServices
-	case "RECRUITING":
-		*i = VendorCategoryRecruiting
-	case "SALES":
-		*i = VendorCategorySales
-	case "SECURITY":
-		*i = VendorCategorySecurity
-	case "VERSION_CONTROL":
-		*i = VendorCategoryVersionControl
-	default:
-		return fmt.Errorf("invalid VendorCategory value: %q", s)
-	}
-	return nil
-}

pkg/coredata/webhook_event_type.go

@@ -23,9 +23,9 @@ import (
 type WebhookEventType string
 
 const (
-	WebhookEventTypeVendorCreated     WebhookEventType = "vendor:created"
-	WebhookEventTypeVendorUpdated     WebhookEventType = "vendor:updated"
-	WebhookEventTypeVendorDeleted     WebhookEventType = "vendor:deleted"
+	WebhookEventTypeThirdPartyCreated WebhookEventType = "third-party:created"
+	WebhookEventTypeThirdPartyUpdated WebhookEventType = "third-party:updated"
+	WebhookEventTypeThirdPartyDeleted WebhookEventType = "third-party:deleted"
 	WebhookEventTypeUserCreated       WebhookEventType = "user:created"
 	WebhookEventTypeUserUpdated       WebhookEventType = "user:updated"
 	WebhookEventTypeUserDeleted       WebhookEventType = "user:deleted"
@@ -40,7 +40,7 @@ func (w WebhookEventType) String() string {
 
 func (w WebhookEventType) IsValid() bool {
 	switch w {
-	case WebhookEventTypeVendorCreated, WebhookEventTypeVendorUpdated, WebhookEventTypeVendorDeleted,
+	case WebhookEventTypeThirdPartyCreated, WebhookEventTypeThirdPartyUpdated, WebhookEventTypeThirdPartyDeleted,
 		WebhookEventTypeUserCreated, WebhookEventTypeUserUpdated, WebhookEventTypeUserDeleted,
 		WebhookEventTypeObligationCreated, WebhookEventTypeObligationUpdated, WebhookEventTypeObligationDeleted:
 		return true

pkg/docgen/generator.go

@@ -239,7 +239,7 @@ type (
 		Name           string
 		Classification string
 		Owner          string
-		Vendors        string
+		ThirdParties   string
 	}
 
 	AssetListData struct {
@@ -256,7 +256,7 @@ type (
 		Amount          int
 		DataTypesStored string
 		Owner           string
-		Vendors         string
+		ThirdParties    string
 	}
 
 	RiskListData struct {
@@ -359,7 +359,7 @@ type (
 		LastReviewDate                       string
 		NextReviewDate                       string
 		DataProtectionOfficer                string
-		Vendors                              string
+		ThirdParties                         string
 	}
 
 	DataProtectionImpactAssessmentListData struct {
@@ -396,15 +396,15 @@ type (
 		SupplementaryMeasures  string
 	}
 
-	VendorListData struct {
-		Title            string
-		OrganizationName string
-		CreatedAt        time.Time
-		TotalVendors     int
-		Rows             []VendorListRow
+	ThirdPartyListData struct {
+		Title             string
+		OrganizationName  string
+		CreatedAt         time.Time
+		TotalThirdParties int
+		Rows              []ThirdPartyListRow
 	}
 
-	VendorListRow struct {
+	ThirdPartyListRow struct {
 		Name                          string
 		LegalName                     string
 		Description                   string
@@ -424,27 +424,27 @@ type (
 		Countries                     string
 		BusinessOwner                 string
 		SecurityOwner                 string
-		Services                      []VendorListService
-		Contacts                      []VendorListContact
-		RiskAssessments               []VendorListRiskAssessment
-		ComplianceReports             []VendorListComplianceReport
-		BusinessAssociateAgreement    *VendorListAgreement
-		DataPrivacyAgreement          *VendorListAgreement
+		Services                      []ThirdPartyListService
+		Contacts                      []ThirdPartyListContact
+		RiskAssessments               []ThirdPartyListRiskAssessment
+		ComplianceReports             []ThirdPartyListComplianceReport
+		BusinessAssociateAgreement    *ThirdPartyListAgreement
+		DataPrivacyAgreement          *ThirdPartyListAgreement
 	}
 
-	VendorListService struct {
+	ThirdPartyListService struct {
 		Name        string
 		Description string
 	}
 
-	VendorListContact struct {
+	ThirdPartyListContact struct {
 		FullName string
 		Email    string
 		Phone    string
 		Role     string
 	}
 
-	VendorListRiskAssessment struct {
+	ThirdPartyListRiskAssessment struct {
 		AssessedAt      string
 		ExpiresAt       string
 		DataSensitivity string
@@ -452,13 +452,13 @@ type (
 		Notes           string
 	}
 
-	VendorListComplianceReport struct {
+	ThirdPartyListComplianceReport struct {
 		ReportName string
 		ReportDate string
 		ValidUntil string
 	}
 
-	VendorListAgreement struct {
+	ThirdPartyListAgreement struct {
 		ValidFrom  string
 		ValidUntil string
 	}

pkg/iam/authorizer.go

@@ -272,7 +272,7 @@ func (a *Authorizer) buildPoliciesForRole(role string) []*policy.Policy {
 }
 
 // resourceTypeFromAction extracts the resource type name from an action
-// string. For example, "core:vendor:create" returns "Vendor" and
+// string. For example, "core:thirdParty:create" returns "ThirdParty" and
 // "core:webhook-subscription:delete" returns "WebhookSubscription".
 func resourceTypeFromAction(action string) string {
 	parts := strings.Split(action, ":")

pkg/iam/organization_service.go

@@ -123,7 +123,7 @@ type (
 )
 
 var (
-	proboVendor = struct {
+	proboThirdParty = struct {
 		Name                 string
 		Description          string
 		LegalName            string
@@ -134,7 +134,7 @@ var (
 		SubprocessorsListURL string
 	}{
 		Name:                 "Probo",
-		Description:          "Probo is an open-source compliance platform that helps startups achieve SOC 2 and ISO 27001 certifications quickly and affordably, with expert guidance and no vendor lock-in.",
+		Description:          "Probo is an open-source compliance platform that helps startups achieve SOC 2 and ISO 27001 certifications quickly and affordably, with expert guidance and no thirdParty lock-in.",
 		LegalName:            "Probo Inc.",
 		HeadquarterAddress:   "490 Post St, Suite 640,San Francisco, CA 94102, United States",
 		WebsiteURL:           "https://www.getprobo.com/",
@@ -659,26 +659,26 @@ func (s *OrganizationService) CreateOrganization(
 				return fmt.Errorf("cannot insert trust center: %w", err)
 			}
 
-			proboData := &coredata.Vendor{
-				ID:                   gid.New(scope.GetTenantID(), coredata.VendorEntityType),
+			proboData := &coredata.ThirdParty{
+				ID:                   gid.New(scope.GetTenantID(), coredata.ThirdPartyEntityType),
 				TenantID:             organization.TenantID,
 				OrganizationID:       organization.ID,
-				Name:                 proboVendor.Name,
-				Description:          &proboVendor.Description,
-				Category:             coredata.VendorCategorySecurity,
-				HeadquarterAddress:   &proboVendor.HeadquarterAddress,
-				LegalName:            &proboVendor.LegalName,
-				WebsiteURL:           &proboVendor.WebsiteURL,
-				PrivacyPolicyURL:     &proboVendor.PrivacyPolicyURL,
-				TermsOfServiceURL:    &proboVendor.TermsOfServiceURL,
-				SubprocessorsListURL: &proboVendor.SubprocessorsListURL,
+				Name:                 proboThirdParty.Name,
+				Description:          &proboThirdParty.Description,
+				Category:             coredata.ThirdPartyCategorySecurity,
+				HeadquarterAddress:   &proboThirdParty.HeadquarterAddress,
+				LegalName:            &proboThirdParty.LegalName,
+				WebsiteURL:           &proboThirdParty.WebsiteURL,
+				PrivacyPolicyURL:     &proboThirdParty.PrivacyPolicyURL,
+				TermsOfServiceURL:    &proboThirdParty.TermsOfServiceURL,
+				SubprocessorsListURL: &proboThirdParty.SubprocessorsListURL,
 				ShowOnTrustCenter:    false,
 				CreatedAt:            now,
 				UpdatedAt:            now,
 			}
 
 			if err := proboData.Insert(ctx, tx, scope); err != nil {
-				return fmt.Errorf("cannot insert vendor: %w", err)
+				return fmt.Errorf("cannot insert thirdParty: %w", err)
 			}
 
 			return nil

pkg/probo/actions.go

@@ -83,50 +83,50 @@ const (
 	ActionTrustCenterFileDelete     = "core:trust-center-file:delete"
 	ActionTrustCenterFileCreate     = "core:trust-center-file:create"
 
-	// Vendor actions
-	ActionVendorList    = "core:vendor:list"
-	ActionVendorGet     = "core:vendor:get"
-	ActionVendorCreate  = "core:vendor:create"
-	ActionVendorUpdate  = "core:vendor:update"
-	ActionVendorDelete  = "core:vendor:delete"
-	ActionVendorAssess  = "core:vendor:assess"
-	ActionVendorPublish = "core:vendor:publish"
+	// ThirdParty actions
+	ActionThirdPartyList    = "core:thirdParty:list"
+	ActionThirdPartyGet     = "core:thirdParty:get"
+	ActionThirdPartyCreate  = "core:thirdParty:create"
+	ActionThirdPartyUpdate  = "core:thirdParty:update"
+	ActionThirdPartyDelete  = "core:thirdParty:delete"
+	ActionThirdPartyAssess  = "core:thirdParty:assess"
+	ActionThirdPartyPublish = "core:thirdParty:publish"
 
-	// VendorContact actions
-	ActionVendorContactGet    = "core:vendor-contact:get"
-	ActionVendorContactList   = "core:vendor-contact:list"
-	ActionVendorContactCreate = "core:vendor-contact:create"
-	ActionVendorContactUpdate = "core:vendor-contact:update"
-	ActionVendorContactDelete = "core:vendor-contact:delete"
+	// ThirdPartyContact actions
+	ActionThirdPartyContactGet    = "core:thirdParty-contact:get"
+	ActionThirdPartyContactList   = "core:thirdParty-contact:list"
+	ActionThirdPartyContactCreate = "core:thirdParty-contact:create"
+	ActionThirdPartyContactUpdate = "core:thirdParty-contact:update"
+	ActionThirdPartyContactDelete = "core:thirdParty-contact:delete"
 
-	// VendorService actions
-	ActionVendorServiceGet    = "core:vendor-service:get"
-	ActionVendorServiceList   = "core:vendor-service:list"
-	ActionVendorServiceCreate = "core:vendor-service:create"
-	ActionVendorServiceUpdate = "core:vendor-service:update"
-	ActionVendorServiceDelete = "core:vendor-service:delete"
+	// ThirdPartyService actions
+	ActionThirdPartyServiceGet    = "core:thirdParty-service:get"
+	ActionThirdPartyServiceList   = "core:thirdParty-service:list"
+	ActionThirdPartyServiceCreate = "core:thirdParty-service:create"
+	ActionThirdPartyServiceUpdate = "core:thirdParty-service:update"
+	ActionThirdPartyServiceDelete = "core:thirdParty-service:delete"
 
-	// VendorComplianceReport actions
-	ActionVendorComplianceReportGet    = "core:vendor-compliance-report:get"
-	ActionVendorComplianceReportList   = "core:vendor-compliance-report:list"
-	ActionVendorComplianceReportUpload = "core:vendor-compliance-report:upload"
-	ActionVendorComplianceReportDelete = "core:vendor-compliance-report:delete"
+	// ThirdPartyComplianceReport actions
+	ActionThirdPartyComplianceReportGet    = "core:thirdParty-compliance-report:get"
+	ActionThirdPartyComplianceReportList   = "core:thirdParty-compliance-report:list"
+	ActionThirdPartyComplianceReportUpload = "core:thirdParty-compliance-report:upload"
+	ActionThirdPartyComplianceReportDelete = "core:thirdParty-compliance-report:delete"
 
-	// VendorBusinessAssociateAgreement actions
-	ActionVendorBusinessAssociateAgreementGet    = "core:vendor-business-associate-agreement:get"
-	ActionVendorBusinessAssociateAgreementUpload = "core:vendor-business-associate-agreement:upload"
-	ActionVendorBusinessAssociateAgreementUpdate = "core:vendor-business-associate-agreement:update"
-	ActionVendorBusinessAssociateAgreementDelete = "core:vendor-business-associate-agreement:delete"
+	// ThirdPartyBusinessAssociateAgreement actions
+	ActionThirdPartyBusinessAssociateAgreementGet    = "core:thirdParty-business-associate-agreement:get"
+	ActionThirdPartyBusinessAssociateAgreementUpload = "core:thirdParty-business-associate-agreement:upload"
+	ActionThirdPartyBusinessAssociateAgreementUpdate = "core:thirdParty-business-associate-agreement:update"
+	ActionThirdPartyBusinessAssociateAgreementDelete = "core:thirdParty-business-associate-agreement:delete"
 
-	// VendorDataPrivacyAgreement actions
-	ActionVendorDataPrivacyAgreementGet    = "core:vendor-data-privacy-agreement:get"
-	ActionVendorDataPrivacyAgreementUpload = "core:vendor-data-privacy-agreement:upload"
-	ActionVendorDataPrivacyAgreementUpdate = "core:vendor-data-privacy-agreement:update"
-	ActionVendorDataPrivacyAgreementDelete = "core:vendor-data-privacy-agreement:delete"
+	// ThirdPartyDataPrivacyAgreement actions
+	ActionThirdPartyDataPrivacyAgreementGet    = "core:thirdParty-data-privacy-agreement:get"
+	ActionThirdPartyDataPrivacyAgreementUpload = "core:thirdParty-data-privacy-agreement:upload"
+	ActionThirdPartyDataPrivacyAgreementUpdate = "core:thirdParty-data-privacy-agreement:update"
+	ActionThirdPartyDataPrivacyAgreementDelete = "core:thirdParty-data-privacy-agreement:delete"
 
-	// VendorRiskAssessment actions
-	ActionVendorRiskAssessmentCreate = "core:vendor-risk-assessment:create"
-	ActionVendorRiskAssessmentList   = "core:vendor-risk-assessment:list"
+	// ThirdPartyRiskAssessment actions
+	ActionThirdPartyRiskAssessmentCreate = "core:thirdParty-risk-assessment:create"
+	ActionThirdPartyRiskAssessmentList   = "core:thirdParty-risk-assessment:list"
 
 	// Framework actions
 	ActionFrameworkGet    = "core:framework:get"

pkg/probo/asset_service.go

@@ -37,7 +37,7 @@ type CreateAssetRequest struct {
 	OwnerID         gid.GID
 	AssetType       coredata.AssetType
 	DataTypesStored string
-	VendorIDs       []gid.GID
+	ThirdPartyIDs   []gid.GID
 }
 
 type UpdateAssetRequest struct {
@@ -47,7 +47,7 @@ type UpdateAssetRequest struct {
 	OwnerID         *gid.GID
 	AssetType       *coredata.AssetType
 	DataTypesStored *string
-	VendorIDs       []gid.GID
+	ThirdPartyIDs   []gid.GID
 }
 
 func (car *CreateAssetRequest) Validate() error {
@@ -59,8 +59,8 @@ func (car *CreateAssetRequest) Validate() error {
 	v.Check(car.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.MembershipProfileEntityType))
 	v.Check(car.AssetType, "asset_type", validator.Required(), validator.OneOfSlice(coredata.AssetTypes()))
 	v.Check(car.DataTypesStored, "data_types_stored", validator.Required(), validator.SafeText(ContentMaxLength))
-	v.CheckEach(car.VendorIDs, "vendor_ids", func(index int, item any) {
-		v.Check(item, fmt.Sprintf("vendor_ids[%d]", index), validator.Required(), validator.GID(coredata.VendorEntityType))
+	v.CheckEach(car.ThirdPartyIDs, "third_party_ids", func(index int, item any) {
+		v.Check(item, fmt.Sprintf("third_party_ids[%d]", index), validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
 	})
 
 	return v.Error()
@@ -75,8 +75,8 @@ func (uar *UpdateAssetRequest) Validate() error {
 	v.Check(uar.OwnerID, "owner_id", validator.GID(coredata.MembershipProfileEntityType))
 	v.Check(uar.AssetType, "asset_type", validator.OneOfSlice(coredata.AssetTypes()))
 	v.Check(uar.DataTypesStored, "data_types_stored", validator.SafeText(ContentMaxLength))
-	v.CheckEach(uar.VendorIDs, "vendor_ids", func(index int, item any) {
-		v.Check(item, fmt.Sprintf("vendor_ids[%d]", index), validator.GID(coredata.VendorEntityType))
+	v.CheckEach(uar.ThirdPartyIDs, "third_party_ids", func(index int, item any) {
+		v.Check(item, fmt.Sprintf("third_party_ids[%d]", index), validator.GID(coredata.ThirdPartyEntityType))
 	})
 
 	return v.Error()
@@ -185,7 +185,7 @@ func (s AssetService) Update(
 
 	now := time.Now()
 	asset := &coredata.Asset{ID: req.ID}
-	assetVendors := &coredata.AssetVendors{}
+	assetThirdParties := &coredata.AssetThirdParties{}
 
 	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, conn pg.Tx) error {
 		if err := asset.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
@@ -217,9 +217,9 @@ func (s AssetService) Update(
 			return fmt.Errorf("cannot update asset: %w", err)
 		}
 
-		if req.VendorIDs != nil {
-			if err := assetVendors.Merge(ctx, conn, s.svc.scope, asset.ID, asset.OrganizationID, req.VendorIDs); err != nil {
-				return fmt.Errorf("cannot update asset vendors: %w", err)
+		if req.ThirdPartyIDs != nil {
+			if err := assetThirdParties.Merge(ctx, conn, s.svc.scope, asset.ID, asset.OrganizationID, req.ThirdPartyIDs); err != nil {
+				return fmt.Errorf("cannot update asset thirdParties: %w", err)
 			}
 		}
 
@@ -243,7 +243,7 @@ func (s AssetService) Create(
 
 	now := time.Now()
 	assetID := gid.New(s.svc.scope.GetTenantID(), coredata.AssetEntityType)
-	assetVendors := &coredata.AssetVendors{}
+	assetThirdParties := &coredata.AssetThirdParties{}
 
 	asset := &coredata.Asset{
 		ID:              assetID,
@@ -267,9 +267,9 @@ func (s AssetService) Create(
 			return fmt.Errorf("cannot insert asset: %w", err)
 		}
 
-		if len(req.VendorIDs) > 0 {
-			if err := assetVendors.Insert(ctx, conn, s.svc.scope, asset.ID, asset.OrganizationID, req.VendorIDs); err != nil {
-				return fmt.Errorf("cannot create asset vendors: %w", err)
+		if len(req.ThirdPartyIDs) > 0 {
+			if err := assetThirdParties.Insert(ctx, conn, s.svc.scope, asset.ID, asset.OrganizationID, req.ThirdPartyIDs); err != nil {
+				return fmt.Errorf("cannot create asset thirdParties: %w", err)
 			}
 		}
 

pkg/probo/datum_service.go

@@ -36,7 +36,7 @@ type (
 		Name               string
 		DataClassification coredata.DataClassification
 		OwnerID            gid.GID
-		VendorIDs          []gid.GID
+		ThirdPartyIDs      []gid.GID
 	}
 
 	UpdateDatumRequest struct {
@@ -44,7 +44,7 @@ type (
 		Name               *string
 		DataClassification *coredata.DataClassification
 		OwnerID            *gid.GID
-		VendorIDs          []gid.GID
+		ThirdPartyIDs      []gid.GID
 	}
 )
 
@@ -55,8 +55,8 @@ func (cdr *CreateDatumRequest) Validate() error {
 	v.Check(cdr.Name, "name", validator.SafeTextNoNewLine(NameMaxLength))
 	v.Check(cdr.DataClassification, "data_classification", validator.Required(), validator.OneOfSlice(coredata.DataClassifications()))
 	v.Check(cdr.OwnerID, "owner_id", validator.Required(), validator.GID(coredata.MembershipProfileEntityType))
-	v.CheckEach(cdr.VendorIDs, "vendor_ids", func(index int, item any) {
-		v.Check(item, fmt.Sprintf("vendor_ids[%d]", index), validator.Required(), validator.GID(coredata.VendorEntityType))
+	v.CheckEach(cdr.ThirdPartyIDs, "third_party_ids", func(index int, item any) {
+		v.Check(item, fmt.Sprintf("third_party_ids[%d]", index), validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
 	})
 
 	return v.Error()
@@ -69,8 +69,8 @@ func (udr *UpdateDatumRequest) Validate() error {
 	v.Check(udr.Name, "name", validator.SafeTextNoNewLine(NameMaxLength))
 	v.Check(udr.DataClassification, "data_classification", validator.OneOfSlice(coredata.DataClassifications()))
 	v.Check(udr.OwnerID, "owner_id", validator.GID(coredata.MembershipProfileEntityType))
-	v.CheckEach(udr.VendorIDs, "vendor_ids", func(index int, item any) {
-		v.Check(item, fmt.Sprintf("vendor_ids[%d]", index), validator.Required(), validator.GID(coredata.VendorEntityType))
+	v.CheckEach(udr.ThirdPartyIDs, "third_party_ids", func(index int, item any) {
+		v.Check(item, fmt.Sprintf("third_party_ids[%d]", index), validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
 	})
 
 	return v.Error()
@@ -179,7 +179,7 @@ func (s DatumService) Update(
 
 	now := time.Now()
 	datum := &coredata.Datum{}
-	datumVendors := &coredata.DatumVendors{}
+	datumThirdParties := &coredata.DatumThirdParties{}
 
 	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, conn pg.Tx) error {
 		if err := datum.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
@@ -205,9 +205,9 @@ func (s DatumService) Update(
 			return fmt.Errorf("cannot update data: %w", err)
 		}
 
-		if req.VendorIDs != nil {
-			if err := datumVendors.Merge(ctx, conn, s.svc.scope, datum.ID, datum.OrganizationID, req.VendorIDs); err != nil {
-				return fmt.Errorf("cannot update data vendors: %w", err)
+		if req.ThirdPartyIDs != nil {
+			if err := datumThirdParties.Merge(ctx, conn, s.svc.scope, datum.ID, datum.OrganizationID, req.ThirdPartyIDs); err != nil {
+				return fmt.Errorf("cannot update data thirdParties: %w", err)
 			}
 		}
 
@@ -231,7 +231,7 @@ func (s DatumService) Create(
 
 	now := time.Now()
 	datumID := gid.New(s.svc.scope.GetTenantID(), coredata.DatumEntityType)
-	datumVendors := &coredata.DatumVendors{}
+	datumThirdParties := &coredata.DatumThirdParties{}
 
 	datum := &coredata.Datum{
 		ID:                 datumID,
@@ -255,9 +255,9 @@ func (s DatumService) Create(
 				return fmt.Errorf("cannot insert datum: %w", err)
 			}
 
-			if len(req.VendorIDs) > 0 {
-				if err := datumVendors.Insert(ctx, conn, s.svc.scope, datum.ID, datum.OrganizationID, req.VendorIDs); err != nil {
-					return fmt.Errorf("cannot create data vendors: %w", err)
+			if len(req.ThirdPartyIDs) > 0 {
+				if err := datumThirdParties.Insert(ctx, conn, s.svc.scope, datum.ID, datum.OrganizationID, req.ThirdPartyIDs); err != nil {
+					return fmt.Errorf("cannot create data thirdParties: %w", err)
 				}
 			}
 
@@ -286,17 +286,17 @@ func (s DatumService) Delete(
 	)
 }
 
-func (s DatumService) ListVendors(
+func (s DatumService) ListThirdParties(
 	ctx context.Context,
 	datumID gid.GID,
-	cursor *page.Cursor[coredata.VendorOrderField],
-) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
-	var vendors coredata.Vendors
+	cursor *page.Cursor[coredata.ThirdPartyOrderField],
+) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
+	var thirdParties coredata.ThirdParties
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendors.LoadByDatumID(ctx, conn, s.svc.scope, datumID, cursor)
+			return thirdParties.LoadByDatumID(ctx, conn, s.svc.scope, datumID, cursor)
 		},
 	)
 
@@ -304,5 +304,5 @@ func (s DatumService) ListVendors(
 		return nil, err
 	}
 
-	return page.NewPage(vendors, cursor), nil
+	return page.NewPage(thirdParties, cursor), nil
 }

pkg/probo/generated_document_service.go

@@ -449,26 +449,26 @@ func (s *GeneratedDocumentService) buildDataListDocumentData(
 			ownerName = p.FullName
 		}
 
-		var vendors coredata.Vendors
-		if err := vendors.LoadAllByDatumID(ctx, conn, s.svc.scope, d.ID); err != nil {
-			return docgen.DataListData{}, fmt.Errorf("cannot load vendors for datum %s: %w", d.ID, err)
+		var thirdParties coredata.ThirdParties
+		if err := thirdParties.LoadAllByDatumID(ctx, conn, s.svc.scope, d.ID); err != nil {
+			return docgen.DataListData{}, fmt.Errorf("cannot load thirdParties for datum %s: %w", d.ID, err)
 		}
 
-		vendorNames := make([]string, 0, len(vendors))
-		for _, v := range vendors {
-			vendorNames = append(vendorNames, v.Name)
+		thirdPartyNames := make([]string, 0, len(thirdParties))
+		for _, v := range thirdParties {
+			thirdPartyNames = append(thirdPartyNames, v.Name)
 		}
 
-		vendorStr := "-"
-		if len(vendorNames) > 0 {
-			vendorStr = strings.Join(vendorNames, ", ")
+		thirdPartyStr := "-"
+		if len(thirdPartyNames) > 0 {
+			thirdPartyStr = strings.Join(thirdPartyNames, ", ")
 		}
 
 		rows = append(rows, docgen.DataListRow{
 			Name:           d.Name,
 			Classification: formatClassification(d.DataClassification),
 			Owner:          ownerName,
-			Vendors:        vendorStr,
+			ThirdParties:   thirdPartyStr,
 		})
 	}
 
@@ -685,19 +685,19 @@ func (s *GeneratedDocumentService) buildAssetListDocumentData(
 			ownerName = p.FullName
 		}
 
-		var vendors coredata.Vendors
-		if err := vendors.LoadAllByAssetID(ctx, conn, s.svc.scope, a.ID); err != nil {
-			return docgen.AssetListData{}, fmt.Errorf("cannot load vendors for asset %s: %w", a.ID, err)
+		var thirdParties coredata.ThirdParties
+		if err := thirdParties.LoadAllByAssetID(ctx, conn, s.svc.scope, a.ID); err != nil {
+			return docgen.AssetListData{}, fmt.Errorf("cannot load thirdParties for asset %s: %w", a.ID, err)
 		}
 
-		vendorNames := make([]string, 0, len(vendors))
-		for _, v := range vendors {
-			vendorNames = append(vendorNames, v.Name)
+		thirdPartyNames := make([]string, 0, len(thirdParties))
+		for _, v := range thirdParties {
+			thirdPartyNames = append(thirdPartyNames, v.Name)
 		}
 
-		vendorStr := "-"
-		if len(vendorNames) > 0 {
-			vendorStr = strings.Join(vendorNames, ", ")
+		thirdPartyStr := "-"
+		if len(thirdPartyNames) > 0 {
+			thirdPartyStr = strings.Join(thirdPartyNames, ", ")
 		}
 
 		rows = append(rows, docgen.AssetListRow{
@@ -706,7 +706,7 @@ func (s *GeneratedDocumentService) buildAssetListDocumentData(
 			Amount:          a.Amount,
 			DataTypesStored: stringOrNotSpecified(a.DataTypesStored),
 			Owner:           ownerName,
-			Vendors:         vendorStr,
+			ThirdParties:    thirdPartyStr,
 		})
 	}
 
@@ -1488,10 +1488,10 @@ func (s *GeneratedDocumentService) buildProcessingActivityListDocumentData(
 		}, nil
 	}
 
-	var vendors coredata.Vendors
-	vendorMap, err := vendors.LoadAllByProcessingActivities(ctx, conn, s.svc.scope, organization.ID)
+	var thirdParties coredata.ThirdParties
+	thirdPartyMap, err := thirdParties.LoadAllByProcessingActivities(ctx, conn, s.svc.scope, organization.ID)
 	if err != nil {
-		return docgen.ProcessingActivityListData{}, fmt.Errorf("cannot load vendors: %w", err)
+		return docgen.ProcessingActivityListData{}, fmt.Errorf("cannot load thirdParties: %w", err)
 	}
 
 	dpoIDs := make([]gid.GID, 0, len(processingActivities))
@@ -1526,9 +1526,9 @@ func (s *GeneratedDocumentService) buildProcessingActivityListDocumentData(
 			}
 		}
 
-		vendorStr := "None"
-		if vendorNames, ok := vendorMap[pa.ID]; ok && len(vendorNames) > 0 {
-			vendorStr = strings.Join(vendorNames, ", ")
+		thirdPartyStr := "None"
+		if thirdPartyNames, ok := thirdPartyMap[pa.ID]; ok && len(thirdPartyNames) > 0 {
+			thirdPartyStr = strings.Join(thirdPartyNames, ", ")
 		}
 
 		rows = append(rows, docgen.ProcessingActivityListRow{
@@ -1551,7 +1551,7 @@ func (s *GeneratedDocumentService) buildProcessingActivityListDocumentData(
 			LastReviewDate:                       formatDateOrNotSpecified(pa.LastReviewDate),
 			NextReviewDate:                       formatDateOrNotSpecified(pa.NextReviewDate),
 			DataProtectionOfficer:                dpoName,
-			Vendors:                              vendorStr,
+			ThirdParties:                         thirdPartyStr,
 		})
 	}
 
@@ -2132,17 +2132,17 @@ func BuildTransferImpactAssessmentListDocument(data docgen.TransferImpactAssessm
 	return buf.String(), nil
 }
 
-func (s *GeneratedDocumentService) PublishVendorList(
+func (s *GeneratedDocumentService) PublishThirdPartyList(
 	ctx context.Context,
 	organizationID gid.GID,
 	approverIDs []gid.GID,
 	minor bool,
 ) (*coredata.Document, *coredata.DocumentVersion, error) {
 	// Phase 1: collect data and render the prosemirror document outside any
-	// write transaction. Both the bulk reads of vendors + sub-entities and the
+	// write transaction. Both the bulk reads of thirdParties + sub-entities and the
 	// JSON template rendering are slow enough that holding write locks across
 	// them would needlessly block other writers.
-	var documentData docgen.VendorListData
+	var documentData docgen.ThirdPartyListData
 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
 		organization := &coredata.Organization{}
 		if err := organization.LoadByID(ctx, conn, s.svc.scope, organizationID); err != nil {
@@ -2150,7 +2150,7 @@ func (s *GeneratedDocumentService) PublishVendorList(
 		}
 
 		var err error
-		documentData, err = s.buildVendorListDocumentData(ctx, conn, organization)
+		documentData, err = s.buildThirdPartyListDocumentData(ctx, conn, organization)
 		if err != nil {
 			return fmt.Errorf("cannot build document data: %w", err)
 		}
@@ -2160,7 +2160,7 @@ func (s *GeneratedDocumentService) PublishVendorList(
 		return nil, nil, err
 	}
 
-	prosemirrorJSON, err := BuildVendorListDocument(documentData)
+	prosemirrorJSON, err := BuildThirdPartyListDocument(documentData)
 	if err != nil {
 		return nil, nil, fmt.Errorf("cannot build prosemirror document: %w", err)
 	}
@@ -2176,24 +2176,24 @@ func (s *GeneratedDocumentService) PublishVendorList(
 		func(ctx context.Context, tx pg.Tx) error {
 			now := time.Now()
 
-			vendor := coredata.Vendor{}
-			vendorDocumentID, err := vendor.GetGeneratedDocumentID(ctx, tx, organizationID)
+			thirdParty := coredata.ThirdParty{}
+			thirdPartyDocumentID, err := thirdParty.GetGeneratedDocumentID(ctx, tx, organizationID)
 			if err != nil {
 				return fmt.Errorf("cannot query generated documents: %w", err)
 			}
 
 			var existingDoc *coredata.Document
-			if vendorDocumentID != nil {
+			if thirdPartyDocumentID != nil {
 				doc := &coredata.Document{}
-				err = doc.LoadByID(ctx, tx, s.svc.scope, *vendorDocumentID)
+				err = doc.LoadByID(ctx, tx, s.svc.scope, *thirdPartyDocumentID)
 				if err != nil && !errors.Is(err, coredata.ErrResourceNotFound) {
-					return fmt.Errorf("cannot load vendor list document: %w", err)
+					return fmt.Errorf("cannot load thirdParty list document: %w", err)
 				}
 
 				if err == nil && doc.ArchivedAt == nil {
 					existingDoc = doc
 				} else {
-					if err := vendor.ClearGeneratedDocumentID(ctx, tx, []gid.GID{*vendorDocumentID}); err != nil {
+					if err := thirdParty.ClearGeneratedDocumentID(ctx, tx, []gid.GID{*thirdPartyDocumentID}); err != nil {
 						return fmt.Errorf("cannot clear document reference: %w", err)
 					}
 				}
@@ -2216,7 +2216,7 @@ func (s *GeneratedDocumentService) PublishVendorList(
 					return fmt.Errorf("cannot insert document: %w", err)
 				}
 
-				if err := vendor.UpsertGeneratedDocumentID(ctx, tx, organizationID, s.svc.scope.GetTenantID(), documentID); err != nil {
+				if err := thirdParty.UpsertGeneratedDocumentID(ctx, tx, organizationID, s.svc.scope.GetTenantID(), documentID); err != nil {
 					return fmt.Errorf("cannot upsert generated documents: %w", err)
 				}
 			} else {
@@ -2228,7 +2228,7 @@ func (s *GeneratedDocumentService) PublishVendorList(
 				ID:             documentVersionID,
 				OrganizationID: organizationID,
 				DocumentID:     document.ID,
-				Title:          "Vendors",
+				Title:          "ThirdParties",
 				Content:        prosemirrorJSON,
 				Classification: coredata.DocumentClassificationConfidential,
 				DocumentType:   coredata.DocumentTypeRegister,
@@ -2248,47 +2248,47 @@ func (s *GeneratedDocumentService) PublishVendorList(
 	return document, documentVersion, nil
 }
 
-func (s *GeneratedDocumentService) GetVendorsDocumentID(
+func (s *GeneratedDocumentService) GetThirdPartiesDocumentID(
 	ctx context.Context,
 	organizationID gid.GID,
 ) (*gid.GID, error) {
 	var documentID *gid.GID
 
 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		vendor := coredata.Vendor{}
+		thirdParty := coredata.ThirdParty{}
 		var err error
-		documentID, err = vendor.GetGeneratedDocumentID(ctx, conn, organizationID)
+		documentID, err = thirdParty.GetGeneratedDocumentID(ctx, conn, organizationID)
 		return err
 	})
 	if err != nil {
-		return nil, fmt.Errorf("cannot get vendor list document ID: %w", err)
+		return nil, fmt.Errorf("cannot get thirdParty list document ID: %w", err)
 	}
 
 	return documentID, nil
 }
 
-func (s *GeneratedDocumentService) buildVendorListDocumentData(
+func (s *GeneratedDocumentService) buildThirdPartyListDocumentData(
 	ctx context.Context,
 	conn pg.Querier,
 	organization *coredata.Organization,
-) (docgen.VendorListData, error) {
-	var vendors coredata.Vendors
-	if err := vendors.LoadAllByOrganizationID(ctx, conn, s.svc.scope, organization.ID); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendors: %w", err)
+) (docgen.ThirdPartyListData, error) {
+	var thirdParties coredata.ThirdParties
+	if err := thirdParties.LoadAllByOrganizationID(ctx, conn, s.svc.scope, organization.ID); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParties: %w", err)
 	}
 
-	if len(vendors) == 0 {
-		return docgen.VendorListData{
-			Title:            "Vendors",
-			OrganizationName: organization.Name,
-			CreatedAt:        time.Now(),
-			TotalVendors:     0,
+	if len(thirdParties) == 0 {
+		return docgen.ThirdPartyListData{
+			Title:             "ThirdParties",
+			OrganizationName:  organization.Name,
+			CreatedAt:         time.Now(),
+			TotalThirdParties: 0,
 		}, nil
 	}
 
 	ownerIDSet := make(map[gid.GID]struct{})
 	ownerIDs := make([]gid.GID, 0)
-	for _, v := range vendors {
+	for _, v := range thirdParties {
 		if v.BusinessOwnerID != nil {
 			if _, ok := ownerIDSet[*v.BusinessOwnerID]; !ok {
 				ownerIDs = append(ownerIDs, *v.BusinessOwnerID)
@@ -2307,79 +2307,79 @@ func (s *GeneratedDocumentService) buildVendorListDocumentData(
 	if len(ownerIDs) > 0 {
 		var profiles coredata.MembershipProfiles
 		if err := profiles.LoadByIDs(ctx, conn, s.svc.scope, ownerIDs); err != nil {
-			return docgen.VendorListData{}, fmt.Errorf("cannot load owner profiles: %w", err)
+			return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load owner profiles: %w", err)
 		}
 		for _, p := range profiles {
 			profileMap[p.ID] = p
 		}
 	}
 
-	vendorIDs := make([]gid.GID, len(vendors))
-	for i, v := range vendors {
-		vendorIDs[i] = v.ID
+	thirdPartyIDs := make([]gid.GID, len(thirdParties))
+	for i, v := range thirdParties {
+		thirdPartyIDs[i] = v.ID
 	}
 
-	var allServices coredata.VendorServices
-	if err := allServices.LoadByVendorIDs(ctx, conn, s.svc.scope, vendorIDs); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendor services: %w", err)
+	var allServices coredata.ThirdPartyServices
+	if err := allServices.LoadByThirdPartyIDs(ctx, conn, s.svc.scope, thirdPartyIDs); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParty services: %w", err)
 	}
-	servicesByVendor := make(map[gid.GID]coredata.VendorServices, len(vendors))
+	servicesByThirdParty := make(map[gid.GID]coredata.ThirdPartyServices, len(thirdParties))
 	for _, vs := range allServices {
-		servicesByVendor[vs.VendorID] = append(servicesByVendor[vs.VendorID], vs)
+		servicesByThirdParty[vs.ThirdPartyID] = append(servicesByThirdParty[vs.ThirdPartyID], vs)
 	}
 
-	var allContacts coredata.VendorContacts
-	if err := allContacts.LoadByVendorIDs(ctx, conn, s.svc.scope, vendorIDs); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendor contacts: %w", err)
+	var allContacts coredata.ThirdPartyContacts
+	if err := allContacts.LoadByThirdPartyIDs(ctx, conn, s.svc.scope, thirdPartyIDs); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParty contacts: %w", err)
 	}
-	contactsByVendor := make(map[gid.GID]coredata.VendorContacts, len(vendors))
+	contactsByThirdParty := make(map[gid.GID]coredata.ThirdPartyContacts, len(thirdParties))
 	for _, c := range allContacts {
-		contactsByVendor[c.VendorID] = append(contactsByVendor[c.VendorID], c)
+		contactsByThirdParty[c.ThirdPartyID] = append(contactsByThirdParty[c.ThirdPartyID], c)
 	}
 
-	var allAssessments coredata.VendorRiskAssessments
-	if err := allAssessments.LoadByVendorIDs(ctx, conn, s.svc.scope, vendorIDs); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendor risk assessments: %w", err)
+	var allAssessments coredata.ThirdPartyRiskAssessments
+	if err := allAssessments.LoadByThirdPartyIDs(ctx, conn, s.svc.scope, thirdPartyIDs); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParty risk assessments: %w", err)
 	}
-	assessmentsByVendor := make(map[gid.GID]coredata.VendorRiskAssessments, len(vendors))
+	assessmentsByThirdParty := make(map[gid.GID]coredata.ThirdPartyRiskAssessments, len(thirdParties))
 	for _, ra := range allAssessments {
-		assessmentsByVendor[ra.VendorID] = append(assessmentsByVendor[ra.VendorID], ra)
+		assessmentsByThirdParty[ra.ThirdPartyID] = append(assessmentsByThirdParty[ra.ThirdPartyID], ra)
 	}
 
-	var allReports coredata.VendorComplianceReports
-	if err := allReports.LoadByVendorIDs(ctx, conn, s.svc.scope, vendorIDs); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendor compliance reports: %w", err)
+	var allReports coredata.ThirdPartyComplianceReports
+	if err := allReports.LoadByThirdPartyIDs(ctx, conn, s.svc.scope, thirdPartyIDs); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParty compliance reports: %w", err)
 	}
-	reportsByVendor := make(map[gid.GID]coredata.VendorComplianceReports, len(vendors))
+	reportsByThirdParty := make(map[gid.GID]coredata.ThirdPartyComplianceReports, len(thirdParties))
 	for _, r := range allReports {
-		reportsByVendor[r.VendorID] = append(reportsByVendor[r.VendorID], r)
+		reportsByThirdParty[r.ThirdPartyID] = append(reportsByThirdParty[r.ThirdPartyID], r)
 	}
 
-	var allBAAs coredata.VendorBusinessAssociateAgreements
-	if err := allBAAs.LoadByVendorIDs(ctx, conn, s.svc.scope, vendorIDs); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendor business associate agreements: %w", err)
+	var allBAAs coredata.ThirdPartyBusinessAssociateAgreements
+	if err := allBAAs.LoadByThirdPartyIDs(ctx, conn, s.svc.scope, thirdPartyIDs); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParty business associate agreements: %w", err)
 	}
-	baaByVendor := make(map[gid.GID]*coredata.VendorBusinessAssociateAgreement, len(allBAAs))
+	baaByThirdParty := make(map[gid.GID]*coredata.ThirdPartyBusinessAssociateAgreement, len(allBAAs))
 	for _, b := range allBAAs {
-		baaByVendor[b.VendorID] = b
+		baaByThirdParty[b.ThirdPartyID] = b
 	}
 
-	var allDPAs coredata.VendorDataPrivacyAgreements
-	if err := allDPAs.LoadByVendorIDs(ctx, conn, s.svc.scope, vendorIDs); err != nil {
-		return docgen.VendorListData{}, fmt.Errorf("cannot load vendor data privacy agreements: %w", err)
+	var allDPAs coredata.ThirdPartyDataPrivacyAgreements
+	if err := allDPAs.LoadByThirdPartyIDs(ctx, conn, s.svc.scope, thirdPartyIDs); err != nil {
+		return docgen.ThirdPartyListData{}, fmt.Errorf("cannot load thirdParty data privacy agreements: %w", err)
 	}
-	dpaByVendor := make(map[gid.GID]*coredata.VendorDataPrivacyAgreement, len(allDPAs))
+	dpaByThirdParty := make(map[gid.GID]*coredata.ThirdPartyDataPrivacyAgreement, len(allDPAs))
 	for _, d := range allDPAs {
-		dpaByVendor[d.VendorID] = d
+		dpaByThirdParty[d.ThirdPartyID] = d
 	}
 
-	rows := make([]docgen.VendorListRow, 0, len(vendors))
-	for _, v := range vendors {
-		row := docgen.VendorListRow{
+	rows := make([]docgen.ThirdPartyListRow, 0, len(thirdParties))
+	for _, v := range thirdParties {
+		row := docgen.ThirdPartyListRow{
 			Name:                          v.Name,
 			LegalName:                     derefStringOrNotSpecified(v.LegalName),
 			Description:                   derefStringOrNotSpecified(v.Description),
-			Category:                      formatVendorCategory(v.Category),
+			Category:                      formatThirdPartyCategory(v.Category),
 			HeadquarterAddress:            derefStringOrNotSpecified(v.HeadquarterAddress),
 			WebsiteURL:                    derefStringOrNotSpecified(v.WebsiteURL),
 			PrivacyPolicyURL:              derefStringOrNotSpecified(v.PrivacyPolicyURL),
@@ -2397,19 +2397,19 @@ func (s *GeneratedDocumentService) buildVendorListDocumentData(
 			SecurityOwner:                 lookupProfileName(profileMap, v.SecurityOwnerID),
 		}
 
-		for _, vs := range servicesByVendor[v.ID] {
-			row.Services = append(row.Services, docgen.VendorListService{
+		for _, vs := range servicesByThirdParty[v.ID] {
+			row.Services = append(row.Services, docgen.ThirdPartyListService{
 				Name:        vs.Name,
 				Description: derefStringOrNotSpecified(vs.Description),
 			})
 		}
 
-		for _, c := range contactsByVendor[v.ID] {
+		for _, c := range contactsByThirdParty[v.ID] {
 			email := ""
 			if c.Email != nil {
 				email = c.Email.String()
 			}
-			row.Contacts = append(row.Contacts, docgen.VendorListContact{
+			row.Contacts = append(row.Contacts, docgen.ThirdPartyListContact{
 				FullName: derefStringOrNotSpecified(c.FullName),
 				Email:    stringOrNotSpecified(email),
 				Phone:    derefStringOrNotSpecified(c.Phone),
@@ -2417,8 +2417,8 @@ func (s *GeneratedDocumentService) buildVendorListDocumentData(
 			})
 		}
 
-		for _, ra := range assessmentsByVendor[v.ID] {
-			row.RiskAssessments = append(row.RiskAssessments, docgen.VendorListRiskAssessment{
+		for _, ra := range assessmentsByThirdParty[v.ID] {
+			row.RiskAssessments = append(row.RiskAssessments, docgen.ThirdPartyListRiskAssessment{
 				AssessedAt:      ra.CreatedAt.Format("2006-01-02"),
 				ExpiresAt:       ra.ExpiresAt.Format("2006-01-02"),
 				DataSensitivity: formatDataSensitivity(ra.DataSensitivity),
@@ -2427,23 +2427,23 @@ func (s *GeneratedDocumentService) buildVendorListDocumentData(
 			})
 		}
 
-		for _, r := range reportsByVendor[v.ID] {
-			row.ComplianceReports = append(row.ComplianceReports, docgen.VendorListComplianceReport{
+		for _, r := range reportsByThirdParty[v.ID] {
+			row.ComplianceReports = append(row.ComplianceReports, docgen.ThirdPartyListComplianceReport{
 				ReportName: r.ReportName,
 				ReportDate: r.ReportDate.Format("2006-01-02"),
 				ValidUntil: formatTimeOrNotSpecified(r.ValidUntil),
 			})
 		}
 
-		if baa := baaByVendor[v.ID]; baa != nil {
-			row.BusinessAssociateAgreement = &docgen.VendorListAgreement{
+		if baa := baaByThirdParty[v.ID]; baa != nil {
+			row.BusinessAssociateAgreement = &docgen.ThirdPartyListAgreement{
 				ValidFrom:  formatTimeOrNotSpecified(baa.ValidFrom),
 				ValidUntil: formatTimeOrNotSpecified(baa.ValidUntil),
 			}
 		}
 
-		if dpa := dpaByVendor[v.ID]; dpa != nil {
-			row.DataPrivacyAgreement = &docgen.VendorListAgreement{
+		if dpa := dpaByThirdParty[v.ID]; dpa != nil {
+			row.DataPrivacyAgreement = &docgen.ThirdPartyListAgreement{
 				ValidFrom:  formatTimeOrNotSpecified(dpa.ValidFrom),
 				ValidUntil: formatTimeOrNotSpecified(dpa.ValidUntil),
 			}
@@ -2452,12 +2452,12 @@ func (s *GeneratedDocumentService) buildVendorListDocumentData(
 		rows = append(rows, row)
 	}
 
-	return docgen.VendorListData{
-		Title:            "Vendors",
-		OrganizationName: organization.Name,
-		CreatedAt:        time.Now(),
-		TotalVendors:     len(vendors),
-		Rows:             rows,
+	return docgen.ThirdPartyListData{
+		Title:             "ThirdParties",
+		OrganizationName:  organization.Name,
+		CreatedAt:         time.Now(),
+		TotalThirdParties: len(thirdParties),
+		Rows:              rows,
 	}, nil
 }
 
@@ -2535,59 +2535,59 @@ func formatBusinessImpact(b coredata.BusinessImpact) string {
 	}
 }
 
-func formatVendorCategory(c coredata.VendorCategory) string {
+func formatThirdPartyCategory(c coredata.ThirdPartyCategory) string {
 	switch c {
-	case coredata.VendorCategoryAnalytics:
+	case coredata.ThirdPartyCategoryAnalytics:
 		return "Analytics"
-	case coredata.VendorCategoryCloudMonitoring:
+	case coredata.ThirdPartyCategoryCloudMonitoring:
 		return "Cloud Monitoring"
-	case coredata.VendorCategoryCloudProvider:
+	case coredata.ThirdPartyCategoryCloudProvider:
 		return "Cloud Provider"
-	case coredata.VendorCategoryCollaboration:
+	case coredata.ThirdPartyCategoryCollaboration:
 		return "Collaboration"
-	case coredata.VendorCategoryCustomerSupport:
+	case coredata.ThirdPartyCategoryCustomerSupport:
 		return "Customer Support"
-	case coredata.VendorCategoryDataStorageAndProcessing:
+	case coredata.ThirdPartyCategoryDataStorageAndProcessing:
 		return "Data Storage and Processing"
-	case coredata.VendorCategoryDocumentManagement:
+	case coredata.ThirdPartyCategoryDocumentManagement:
 		return "Document Management"
-	case coredata.VendorCategoryEmployeeManagement:
+	case coredata.ThirdPartyCategoryEmployeeManagement:
 		return "Employee Management"
-	case coredata.VendorCategoryEngineering:
+	case coredata.ThirdPartyCategoryEngineering:
 		return "Engineering"
-	case coredata.VendorCategoryFinance:
+	case coredata.ThirdPartyCategoryFinance:
 		return "Finance"
-	case coredata.VendorCategoryIdentityProvider:
+	case coredata.ThirdPartyCategoryIdentityProvider:
 		return "Identity Provider"
-	case coredata.VendorCategoryIT:
+	case coredata.ThirdPartyCategoryIT:
 		return "IT"
-	case coredata.VendorCategoryMarketing:
+	case coredata.ThirdPartyCategoryMarketing:
 		return "Marketing"
-	case coredata.VendorCategoryOfficeOperations:
+	case coredata.ThirdPartyCategoryOfficeOperations:
 		return "Office Operations"
-	case coredata.VendorCategoryOther:
+	case coredata.ThirdPartyCategoryOther:
 		return "Other"
-	case coredata.VendorCategoryPasswordManagement:
+	case coredata.ThirdPartyCategoryPasswordManagement:
 		return "Password Management"
-	case coredata.VendorCategoryProductAndDesign:
+	case coredata.ThirdPartyCategoryProductAndDesign:
 		return "Product and Design"
-	case coredata.VendorCategoryProfessionalServices:
+	case coredata.ThirdPartyCategoryProfessionalServices:
 		return "Professional Services"
-	case coredata.VendorCategoryRecruiting:
+	case coredata.ThirdPartyCategoryRecruiting:
 		return "Recruiting"
-	case coredata.VendorCategorySales:
+	case coredata.ThirdPartyCategorySales:
 		return "Sales"
-	case coredata.VendorCategorySecurity:
+	case coredata.ThirdPartyCategorySecurity:
 		return "Security"
-	case coredata.VendorCategoryVersionControl:
+	case coredata.ThirdPartyCategoryVersionControl:
 		return "Version Control"
 	default:
 		return stringOrNotSpecified(string(c))
 	}
 }
 
-var vendorListTemplate = template.Must(
-	template.New("vendor_list.json.tmpl").
+var thirdPartyListTemplate = template.Must(
+	template.New("third_party_list.json.tmpl").
 		Funcs(template.FuncMap{
 			"json": func(v any) (string, error) {
 				b, err := json.Marshal(v)
@@ -2599,13 +2599,13 @@ var vendorListTemplate = template.Must(
 			"printf": fmt.Sprintf,
 			"add":    func(a, b int) int { return a + b },
 		}).
-		ParseFS(Templates, "templates/vendor_list.json.tmpl"),
+		ParseFS(Templates, "templates/third_party_list.json.tmpl"),
 )
 
-func BuildVendorListDocument(data docgen.VendorListData) (string, error) {
+func BuildThirdPartyListDocument(data docgen.ThirdPartyListData) (string, error) {
 	var buf bytes.Buffer
-	if err := vendorListTemplate.Execute(&buf, data); err != nil {
-		return "", fmt.Errorf("cannot execute vendor list template: %w", err)
+	if err := thirdPartyListTemplate.Execute(&buf, data); err != nil {
+		return "", fmt.Errorf("cannot execute thirdParty list template: %w", err)
 	}
 	return buf.String(), nil
 }

pkg/probo/policies.go

@@ -48,13 +48,13 @@ var ViewerPolicy = policy.NewPolicy(
 	).WithSID("org-read-access").When(organizationCondition),
 
 	policy.Allow(
-		ActionVendorGet, ActionVendorList,
-		ActionVendorContactGet, ActionVendorContactList,
-		ActionVendorServiceGet, ActionVendorServiceList,
-		ActionVendorComplianceReportGet, ActionVendorComplianceReportList,
-		ActionVendorBusinessAssociateAgreementGet,
-		ActionVendorDataPrivacyAgreementGet,
-		ActionVendorRiskAssessmentList,
+		ActionThirdPartyGet, ActionThirdPartyList,
+		ActionThirdPartyContactGet, ActionThirdPartyContactList,
+		ActionThirdPartyServiceGet, ActionThirdPartyServiceList,
+		ActionThirdPartyComplianceReportGet, ActionThirdPartyComplianceReportList,
+		ActionThirdPartyBusinessAssociateAgreementGet,
+		ActionThirdPartyDataPrivacyAgreementGet,
+		ActionThirdPartyRiskAssessmentList,
 		ActionFrameworkGet, ActionFrameworkList,
 		ActionControlGet, ActionControlList,
 		ActionMeasureGet, ActionMeasureList,
@@ -126,13 +126,13 @@ var AuditorPolicy = policy.NewPolicy(
 	).WithSID("org-read-access").When(organizationCondition),
 
 	policy.Allow(
-		ActionVendorGet, ActionVendorList,
-		ActionVendorContactGet, ActionVendorContactList,
-		ActionVendorServiceGet, ActionVendorServiceList,
-		ActionVendorComplianceReportGet, ActionVendorComplianceReportList,
-		ActionVendorBusinessAssociateAgreementGet,
-		ActionVendorDataPrivacyAgreementGet,
-		ActionVendorRiskAssessmentList,
+		ActionThirdPartyGet, ActionThirdPartyList,
+		ActionThirdPartyContactGet, ActionThirdPartyContactList,
+		ActionThirdPartyServiceGet, ActionThirdPartyServiceList,
+		ActionThirdPartyComplianceReportGet, ActionThirdPartyComplianceReportList,
+		ActionThirdPartyBusinessAssociateAgreementGet,
+		ActionThirdPartyDataPrivacyAgreementGet,
+		ActionThirdPartyRiskAssessmentList,
 		ActionFrameworkGet, ActionFrameworkList,
 		ActionControlGet, ActionControlList,
 		ActionMeasureGet, ActionMeasureList,

pkg/probo/processing_activity_service.go

@@ -52,7 +52,7 @@ type (
 		NextReviewDate                       *time.Time
 		Role                                 coredata.ProcessingActivityRole
 		DataProtectionOfficerID              *gid.GID
-		VendorIDs                            []gid.GID
+		ThirdPartyIDs                        []gid.GID
 	}
 
 	UpdateProcessingActivityRequest struct {
@@ -76,7 +76,7 @@ type (
 		NextReviewDate                       **time.Time
 		Role                                 *coredata.ProcessingActivityRole
 		DataProtectionOfficerID              **gid.GID
-		VendorIDs                            *[]gid.GID
+		ThirdPartyIDs                        *[]gid.GID
 	}
 )
 
@@ -101,8 +101,8 @@ func (cpar *CreateProcessingActivityRequest) Validate() error {
 	v.Check(cpar.TransferImpactAssessmentNeeded, "transfer_impact_assessment_needed", validator.Required(), validator.OneOfSlice(coredata.ProcessingActivityTransferImpactAssessments()))
 	v.Check(cpar.Role, "role", validator.Required(), validator.OneOfSlice(coredata.ProcessingActivityRoles()))
 	v.Check(cpar.DataProtectionOfficerID, "data_protection_officer_id", validator.GID(coredata.MembershipProfileEntityType))
-	v.CheckEach(cpar.VendorIDs, "vendor_ids", func(index int, item any) {
-		v.Check(item, fmt.Sprintf("vendor_ids[%d]", index), validator.Required(), validator.GID(coredata.VendorEntityType))
+	v.CheckEach(cpar.ThirdPartyIDs, "third_party_ids", func(index int, item any) {
+		v.Check(item, fmt.Sprintf("third_party_ids[%d]", index), validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
 	})
 
 	return v.Error()
@@ -128,8 +128,8 @@ func (upar *UpdateProcessingActivityRequest) Validate() error {
 	v.Check(upar.TransferImpactAssessmentNeeded, "transfer_impact_assessment_needed", validator.OneOfSlice(coredata.ProcessingActivityTransferImpactAssessments()))
 	v.Check(upar.Role, "role", validator.OneOfSlice(coredata.ProcessingActivityRoles()))
 	v.Check(upar.DataProtectionOfficerID, "data_protection_officer_id", validator.GID(coredata.MembershipProfileEntityType))
-	v.CheckEach(upar.VendorIDs, "vendor_ids", func(index int, item any) {
-		v.Check(item, fmt.Sprintf("vendor_ids[%d]", index), validator.GID(coredata.VendorEntityType))
+	v.CheckEach(upar.ThirdPartyIDs, "third_party_ids", func(index int, item any) {
+		v.Check(item, fmt.Sprintf("third_party_ids[%d]", index), validator.GID(coredata.ThirdPartyEntityType))
 	})
 
 	return v.Error()
@@ -160,7 +160,7 @@ func (s *ProcessingActivityService) Create(
 	req *CreateProcessingActivityRequest,
 ) (*coredata.ProcessingActivity, error) {
 	now := time.Now()
-	processingActivityVendors := &coredata.ProcessingActivityVendors{}
+	processingActivityThirdParties := &coredata.ProcessingActivityThirdParties{}
 
 	processingActivity := &coredata.ProcessingActivity{
 		ID:                                   gid.New(s.svc.scope.GetTenantID(), coredata.ProcessingActivityEntityType),
@@ -200,9 +200,9 @@ func (s *ProcessingActivityService) Create(
 				return fmt.Errorf("cannot insert processing activity: %w", err)
 			}
 
-			if len(req.VendorIDs) > 0 {
-				if err := processingActivityVendors.Insert(ctx, conn, s.svc.scope, processingActivity.ID, req.OrganizationID, req.VendorIDs); err != nil {
-					return fmt.Errorf("cannot create processing activity vendors: %w", err)
+			if len(req.ThirdPartyIDs) > 0 {
+				if err := processingActivityThirdParties.Insert(ctx, conn, s.svc.scope, processingActivity.ID, req.OrganizationID, req.ThirdPartyIDs); err != nil {
+					return fmt.Errorf("cannot create processing activity thirdParties: %w", err)
 				}
 			}
 
@@ -222,7 +222,7 @@ func (s *ProcessingActivityService) Update(
 	req *UpdateProcessingActivityRequest,
 ) (*coredata.ProcessingActivity, error) {
 	processingActivity := &coredata.ProcessingActivity{}
-	processingActivityVendors := &coredata.ProcessingActivityVendors{}
+	processingActivityThirdParties := &coredata.ProcessingActivityThirdParties{}
 
 	err := s.svc.pg.WithTx(
 		ctx,
@@ -295,9 +295,9 @@ func (s *ProcessingActivityService) Update(
 				return fmt.Errorf("cannot update processing activity: %w", err)
 			}
 
-			if req.VendorIDs != nil {
-				if err := processingActivityVendors.Merge(ctx, conn, s.svc.scope, processingActivity.ID, processingActivity.OrganizationID, *req.VendorIDs); err != nil {
-					return fmt.Errorf("cannot update processing activity vendors: %w", err)
+			if req.ThirdPartyIDs != nil {
+				if err := processingActivityThirdParties.Merge(ctx, conn, s.svc.scope, processingActivity.ID, processingActivity.OrganizationID, *req.ThirdPartyIDs); err != nil {
+					return fmt.Errorf("cannot update processing activity thirdParties: %w", err)
 				}
 			}
 

pkg/probo/service.go

@@ -68,62 +68,62 @@ type (
 		esign                   *esign.Service
 		connectorRegistry       *connector.ConnectorRegistry
 		invitationTokenValidity time.Duration
-		vendorAssessor          VendorAssessor
+		thirdPartyAssessor      ThirdPartyAssessor
 	}
 
 	TenantService struct {
-		pg                                *pg.Client
-		s3                                *s3.Client
-		bucket                            string
-		encryptionKey                     cipher.EncryptionKey
-		scope                             coredata.Scoper
-		baseURL                           string
-		tokenSecret                       string
-		llmClient                         *llm.Client
-		llmModel                          string
-		llmTemperature                    float64
-		llmMaxTokens                      int
-		vendorAssessor                    VendorAssessor
-		fileManager                       *filemanager.Service
-		esign                             *esign.Service
-		Frameworks                        *FrameworkService
-		Measures                          *MeasureService
-		Tasks                             *TaskService
-		Evidences                         *EvidenceService
-		Organizations                     *OrganizationService
-		Vendors                           *VendorService
-		Documents                         *DocumentService
-		DocumentApprovals                 *DocumentApprovalService
-		Controls                          *ControlService
-		Risks                             *RiskService
-		VendorComplianceReports           *VendorComplianceReportService
-		VendorBusinessAssociateAgreements *VendorBusinessAssociateAgreementService
-		VendorContacts                    *VendorContactService
-		VendorDataPrivacyAgreements       *VendorDataPrivacyAgreementService
-		VendorServices                    *VendorServiceService
-		Connectors                        *ConnectorService
-		Assets                            *AssetService
-		Data                              *DatumService
-		Audits                            *AuditService
-		WebhookSubscriptions              *WebhookSubscriptionService
-		Reports                           *ReportService
-		TrustCenters                      *TrustCenterService
-		TrustCenterAccesses               *TrustCenterAccessService
-		TrustCenterReferences             *TrustCenterReferenceService
-		TrustCenterFiles                  *TrustCenterFileService
-		ComplianceFrameworks              *ComplianceFrameworkService
-		ComplianceExternalURLs            *ComplianceExternalURLService
-		Findings                          *FindingService
-		Obligations                       *ObligationService
-		RightsRequests                    *RightsRequestService
-		ProcessingActivities              *ProcessingActivityService
-		DataProtectionImpactAssessments   *DataProtectionImpactAssessmentService
-		TransferImpactAssessments         *TransferImpactAssessmentService
-		StatementsOfApplicability         *StatementOfApplicabilityService
-		GeneratedDocuments                *GeneratedDocumentService
-		Files                             *FileService
-		CustomDomains                     *CustomDomainService
-		SlackMessages                     *slack.SlackMessageService
+		pg                                    *pg.Client
+		s3                                    *s3.Client
+		bucket                                string
+		encryptionKey                         cipher.EncryptionKey
+		scope                                 coredata.Scoper
+		baseURL                               string
+		tokenSecret                           string
+		llmClient                             *llm.Client
+		llmModel                              string
+		llmTemperature                        float64
+		llmMaxTokens                          int
+		thirdPartyAssessor                    ThirdPartyAssessor
+		fileManager                           *filemanager.Service
+		esign                                 *esign.Service
+		Frameworks                            *FrameworkService
+		Measures                              *MeasureService
+		Tasks                                 *TaskService
+		Evidences                             *EvidenceService
+		Organizations                         *OrganizationService
+		ThirdParties                          *ThirdPartyService
+		Documents                             *DocumentService
+		DocumentApprovals                     *DocumentApprovalService
+		Controls                              *ControlService
+		Risks                                 *RiskService
+		ThirdPartyComplianceReports           *ThirdPartyComplianceReportService
+		ThirdPartyBusinessAssociateAgreements *ThirdPartyBusinessAssociateAgreementService
+		ThirdPartyContacts                    *ThirdPartyContactService
+		ThirdPartyDataPrivacyAgreements       *ThirdPartyDataPrivacyAgreementService
+		ThirdPartyServices                    *ThirdPartyServiceService
+		Connectors                            *ConnectorService
+		Assets                                *AssetService
+		Data                                  *DatumService
+		Audits                                *AuditService
+		WebhookSubscriptions                  *WebhookSubscriptionService
+		Reports                               *ReportService
+		TrustCenters                          *TrustCenterService
+		TrustCenterAccesses                   *TrustCenterAccessService
+		TrustCenterReferences                 *TrustCenterReferenceService
+		TrustCenterFiles                      *TrustCenterFileService
+		ComplianceFrameworks                  *ComplianceFrameworkService
+		ComplianceExternalURLs                *ComplianceExternalURLService
+		Findings                              *FindingService
+		Obligations                           *ObligationService
+		RightsRequests                        *RightsRequestService
+		ProcessingActivities                  *ProcessingActivityService
+		DataProtectionImpactAssessments       *DataProtectionImpactAssessmentService
+		TransferImpactAssessments             *TransferImpactAssessmentService
+		StatementsOfApplicability             *StatementOfApplicabilityService
+		GeneratedDocuments                    *GeneratedDocumentService
+		Files                                 *FileService
+		CustomDomains                         *CustomDomainService
+		SlackMessages                         *slack.SlackMessageService
 	}
 )
 
@@ -148,7 +148,7 @@ func NewService(
 	esignService *esign.Service,
 	connectorRegistry *connector.ConnectorRegistry,
 	invitationTokenValidity time.Duration,
-	vendorAssessor VendorAssessor,
+	thirdPartyAssessor ThirdPartyAssessor,
 ) (*Service, error) {
 	if bucket == "" {
 		return nil, fmt.Errorf("bucket is required")
@@ -175,7 +175,7 @@ func NewService(
 		esign:                   esignService,
 		connectorRegistry:       connectorRegistry,
 		invitationTokenValidity: invitationTokenValidity,
-		vendorAssessor:          vendorAssessor,
+		thirdPartyAssessor:      thirdPartyAssessor,
 	}
 
 	return svc, nil
@@ -183,20 +183,20 @@ func NewService(
 
 func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService := &TenantService{
-		pg:             s.pg,
-		s3:             s.s3,
-		bucket:         s.bucket,
-		encryptionKey:  s.encryptionKey,
-		baseURL:        s.baseURL,
-		scope:          coredata.NewScope(tenantID),
-		tokenSecret:    s.tokenSecret,
-		llmClient:      s.llmClient,
-		llmModel:       s.llmModel,
-		llmTemperature: s.llmTemperature,
-		llmMaxTokens:   s.llmMaxTokens,
-		vendorAssessor: s.vendorAssessor,
-		fileManager:    s.fileManager,
-		esign:          s.esign,
+		pg:                 s.pg,
+		s3:                 s.s3,
+		bucket:             s.bucket,
+		encryptionKey:      s.encryptionKey,
+		baseURL:            s.baseURL,
+		scope:              coredata.NewScope(tenantID),
+		tokenSecret:        s.tokenSecret,
+		llmClient:          s.llmClient,
+		llmModel:           s.llmModel,
+		llmTemperature:     s.llmTemperature,
+		llmMaxTokens:       s.llmMaxTokens,
+		thirdPartyAssessor: s.thirdPartyAssessor,
+		fileManager:        s.fileManager,
+		esign:              s.esign,
 	}
 
 	tenantService.Frameworks = &FrameworkService{
@@ -219,7 +219,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 			),
 		),
 	}
-	tenantService.Vendors = &VendorService{svc: tenantService}
+	tenantService.ThirdParties = &ThirdPartyService{svc: tenantService}
 	tenantService.Documents = &DocumentService{
 		svc:                     tenantService,
 		html2pdfConverter:       s.html2pdfConverter,
@@ -240,16 +240,16 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	}
 	tenantService.Controls = &ControlService{svc: tenantService}
 	tenantService.Risks = &RiskService{svc: tenantService}
-	tenantService.VendorComplianceReports = &VendorComplianceReportService{
+	tenantService.ThirdPartyComplianceReports = &ThirdPartyComplianceReportService{
 		svc: tenantService,
 		fileValidator: filevalidation.NewValidator(
 			filevalidation.WithCategories(filevalidation.CategoryDocument),
 		),
 	}
-	tenantService.VendorBusinessAssociateAgreements = &VendorBusinessAssociateAgreementService{svc: tenantService}
-	tenantService.VendorContacts = &VendorContactService{svc: tenantService}
-	tenantService.VendorDataPrivacyAgreements = &VendorDataPrivacyAgreementService{svc: tenantService}
-	tenantService.VendorServices = &VendorServiceService{svc: tenantService}
+	tenantService.ThirdPartyBusinessAssociateAgreements = &ThirdPartyBusinessAssociateAgreementService{svc: tenantService}
+	tenantService.ThirdPartyContacts = &ThirdPartyContactService{svc: tenantService}
+	tenantService.ThirdPartyDataPrivacyAgreements = &ThirdPartyDataPrivacyAgreementService{svc: tenantService}
+	tenantService.ThirdPartyServices = &ThirdPartyServiceService{svc: tenantService}
 	tenantService.Connectors = &ConnectorService{svc: tenantService}
 	tenantService.Assets = &AssetService{svc: tenantService}
 	tenantService.Data = &DatumService{svc: tenantService}

pkg/probo/templates/asset_list.json.tmpl

@@ -8,7 +8,7 @@
     },
     {
       "type": "paragraph",
-      "content": [{ "type": "text", "text": "This document provides a comprehensive inventory of assets managed by the organization. It serves as a record of all assets, their types, quantities, data stored, ownership, and associated vendors." }]
+      "content": [{ "type": "text", "text": "This document provides a comprehensive inventory of assets managed by the organization. It serves as a record of all assets, their types, quantities, data stored, ownership, and associated third parties." }]
     },
     { "type": "horizontalRule" },
     {
@@ -27,7 +27,7 @@
             { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [80] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Amount", "marks": [{ "type": "bold" }] }] }] },
             { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [120] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Data Types Stored", "marks": [{ "type": "bold" }] }] }] },
             { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [150] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Owner", "marks": [{ "type": "bold" }] }] }] },
-            { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [200] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Vendors", "marks": [{ "type": "bold" }] }] }] }
+            { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [200] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Third parties", "marks": [{ "type": "bold" }] }] }] }
           ]
         }{{range .Rows}},
         {
@@ -38,7 +38,7 @@
             { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [80] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json (printf "%d" .Amount)}} }] }] },
             { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [120] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .DataTypesStored}} }] }] },
             { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [150] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Owner}} }] }] },
-            { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [200] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Vendors}} }] }] }
+            { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [200] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .ThirdParties}} }] }] }
           ]
         }{{end}}
       ]
@@ -73,11 +73,11 @@
     {
       "type": "heading",
       "attrs": { "level": 3 },
-      "content": [{ "type": "text", "text": "Vendors" }]
+      "content": [{ "type": "text", "text": "Third parties" }]
     },
     {
       "type": "paragraph",
-      "content": [{ "type": "text", "text": "Third-party vendors that provide or support the asset." }]
+      "content": [{ "type": "text", "text": "Third parties that provide or support the asset." }]
     }
   ]
 }

pkg/probo/templates/data_list.json.tmpl

@@ -8,7 +8,7 @@
     },
     {
       "type": "paragraph",
-      "content": [{ "type": "text", "text": "This document provides a comprehensive inventory of data assets managed by the organization. It serves as a record of all data items, their classification levels, ownership, and associated vendors." }]
+      "content": [{ "type": "text", "text": "This document provides a comprehensive inventory of data assets managed by the organization. It serves as a record of all data items, their classification levels, ownership, and associated third parties." }]
     },
     { "type": "horizontalRule" },
     {
@@ -25,7 +25,7 @@
             { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Name", "marks": [{ "type": "bold" }] }] }] },
             { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Classification", "marks": [{ "type": "bold" }] }] }] },
             { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [180] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Owner", "marks": [{ "type": "bold" }] }] }] },
-            { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Vendors", "marks": [{ "type": "bold" }] }] }] }
+            { "type": "tableHeader", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Third parties", "marks": [{ "type": "bold" }] }] }] }
           ]
         }{{range .Rows}},
         {
@@ -34,7 +34,7 @@
             { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Name}} }] }] },
             { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [130] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Classification}} }] }] },
             { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [180] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Owner}} }] }] },
-            { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .Vendors}} }] }] }
+            { "type": "tableCell", "attrs": { "colspan": 1, "rowspan": 1, "colwidth": [250] }, "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": {{json .ThirdParties}} }] }] }
           ]
         }{{end}}
       ]
@@ -71,11 +71,11 @@
     {
       "type": "heading",
       "attrs": { "level": 3 },
-      "content": [{ "type": "text", "text": "Vendors" }]
+      "content": [{ "type": "text", "text": "Third parties" }]
     },
     {
       "type": "paragraph",
-      "content": [{ "type": "text", "text": "Third-party vendors that process or have access to the data asset." }]
+      "content": [{ "type": "text", "text": "Third parties that process or have access to the data asset." }]
     }
   ]
 }

pkg/probo/templates/processing_activity_list.json.tmpl

@@ -186,8 +186,8 @@
     {
       "type": "paragraph",
       "content": [
-        { "type": "text", "text": "Vendors: ", "marks": [{ "type": "bold" }] },
-        { "type": "text", "text": {{json $r.Vendors}} }
+        { "type": "text", "text": "Third parties: ", "marks": [{ "type": "bold" }] },
+        { "type": "text", "text": {{json $r.ThirdParties}} }
       ]
     }{{end}},
     { "type": "horizontalRule" },

pkg/probo/templates/third_party_list.json.tmpl

@@ -8,13 +8,13 @@
     },
     {
       "type": "paragraph",
-      "content": [{ "type": "text", "text": "This document provides a comprehensive register of all vendors used by the organization. It captures vendor profile information, services consumed, contacts, risk assessments, compliance reports, and contractual agreements (BAA, DPA) for each vendor." }]
+      "content": [{ "type": "text", "text": "This document provides a comprehensive register of all thirdParties used by the organization. It captures thirdParty profile information, services consumed, contacts, risk assessments, compliance reports, and contractual agreements (BAA, DPA) for each thirdParty." }]
     },
     { "type": "horizontalRule" },
     {
       "type": "heading",
       "attrs": { "level": 1 },
-      "content": [{ "type": "text", "text": "2. Vendors" }]
+      "content": [{ "type": "text", "text": "2. ThirdParties" }]
     }{{range $i, $r := .Rows}},
     {
       "type": "heading",
@@ -272,11 +272,11 @@
     {
       "type": "bulletList",
       "content": [
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "None: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "No sensitive data is shared with the vendor." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Low: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The vendor processes low sensitivity data such as public information." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Medium: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The vendor processes medium sensitivity data such as internal business data." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "High: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The vendor processes high sensitivity data such as personal data, financial data, or trade secrets." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Critical: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The vendor processes the most sensitive categories of data, where unauthorized disclosure would cause severe harm." }] }] }
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "None: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "No sensitive data is shared with the thirdParty." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Low: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The thirdParty processes low sensitivity data such as public information." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Medium: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The thirdParty processes medium sensitivity data such as internal business data." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "High: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The thirdParty processes high sensitivity data such as personal data, financial data, or trade secrets." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Critical: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "The thirdParty processes the most sensitive categories of data, where unauthorized disclosure would cause severe harm." }] }] }
       ]
     },
     {
@@ -287,10 +287,10 @@
     {
       "type": "bulletList",
       "content": [
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Low: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Limited disruption to operations if the vendor service is unavailable." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Medium: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Significant disruption to operations if the vendor service is unavailable." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "High: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Severe disruption or outage if the vendor service is unavailable." }] }] },
-        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Critical: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Operations cannot continue if the vendor service is unavailable; immediate business-wide impact." }] }] }
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Low: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Limited disruption to operations if the thirdParty service is unavailable." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Medium: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Significant disruption to operations if the thirdParty service is unavailable." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "High: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Severe disruption or outage if the thirdParty service is unavailable." }] }] },
+        { "type": "listItem", "content": [{ "type": "paragraph", "content": [{ "type": "text", "text": "Critical: ", "marks": [{ "type": "bold" }] }, { "type": "text", "text": "Operations cannot continue if the thirdParty service is unavailable; immediate business-wide impact." }] }] }
       ]
     }
   ]

pkg/probo/third_party_business_associate_agreement_service.go

@@ -32,24 +32,24 @@ import (
 )
 
 type (
-	VendorBusinessAssociateAgreementService struct {
+	ThirdPartyBusinessAssociateAgreementService struct {
 		svc *TenantService
 	}
 
-	VendorBusinessAssociateAgreementCreateRequest struct {
+	ThirdPartyBusinessAssociateAgreementCreateRequest struct {
 		File       io.Reader
 		ValidFrom  *time.Time
 		ValidUntil *time.Time
 		FileName   string
 	}
 
-	VendorBusinessAssociateAgreementUpdateRequest struct {
+	ThirdPartyBusinessAssociateAgreementUpdateRequest struct {
 		ValidFrom  **time.Time
 		ValidUntil **time.Time
 	}
 )
 
-func (vbaacr *VendorBusinessAssociateAgreementCreateRequest) Validate() error {
+func (vbaacr *ThirdPartyBusinessAssociateAgreementCreateRequest) Validate() error {
 	v := validator.New()
 
 	v.Check(vbaacr.FileName, "file_name", validator.SafeTextNoNewLine(TitleMaxLength))
@@ -58,7 +58,7 @@ func (vbaacr *VendorBusinessAssociateAgreementCreateRequest) Validate() error {
 	return v.Error()
 }
 
-func (vbaaur *VendorBusinessAssociateAgreementUpdateRequest) Validate() error {
+func (vbaaur *ThirdPartyBusinessAssociateAgreementUpdateRequest) Validate() error {
 	v := validator.New()
 
 	v.Check(vbaaur.ValidUntil, "valid_until", validator.After(vbaaur.ValidFrom))
@@ -66,23 +66,23 @@ func (vbaaur *VendorBusinessAssociateAgreementUpdateRequest) Validate() error {
 	return v.Error()
 }
 
-func (s VendorBusinessAssociateAgreementService) GetByVendorID(
+func (s ThirdPartyBusinessAssociateAgreementService) GetByThirdPartyID(
 	ctx context.Context,
-	vendorID gid.GID,
-) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
-	var vendorBusinessAssociateAgreement *coredata.VendorBusinessAssociateAgreement
+	thirdPartyID gid.GID,
+) (*coredata.ThirdPartyBusinessAssociateAgreement, *coredata.File, error) {
+	var thirdPartyBusinessAssociateAgreement *coredata.ThirdPartyBusinessAssociateAgreement
 	var file *coredata.File
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorBusinessAssociateAgreement = &coredata.VendorBusinessAssociateAgreement{}
-			if err := vendorBusinessAssociateAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			thirdPartyBusinessAssociateAgreement = &coredata.ThirdPartyBusinessAssociateAgreement{}
+			if err := thirdPartyBusinessAssociateAgreement.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty business associate agreement: %w", err)
 			}
 
 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreement.FileID); err != nil {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, thirdPartyBusinessAssociateAgreement.FileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}
 
@@ -94,14 +94,14 @@ func (s VendorBusinessAssociateAgreementService) GetByVendorID(
 		return nil, nil, err
 	}
 
-	return vendorBusinessAssociateAgreement, file, nil
+	return thirdPartyBusinessAssociateAgreement, file, nil
 }
 
-func (s VendorBusinessAssociateAgreementService) Upload(
+func (s ThirdPartyBusinessAssociateAgreementService) Upload(
 	ctx context.Context,
-	vendorID gid.GID,
-	req *VendorBusinessAssociateAgreementCreateRequest,
-) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
+	thirdPartyID gid.GID,
+	req *ThirdPartyBusinessAssociateAgreementCreateRequest,
+) (*coredata.ThirdPartyBusinessAssociateAgreement, *coredata.File, error) {
 	if err := req.Validate(); err != nil {
 		return nil, nil, err
 	}
@@ -111,15 +111,15 @@ func (s VendorBusinessAssociateAgreementService) Upload(
 		return nil, nil, fmt.Errorf("cannot generate object key: %w", err)
 	}
 
-	var vendorBusinessAssociateAgreement *coredata.VendorBusinessAssociateAgreement
+	var thirdPartyBusinessAssociateAgreement *coredata.ThirdPartyBusinessAssociateAgreement
 	var file *coredata.File
 
 	err = s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			vendor := &coredata.Vendor{}
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
+			thirdParty := &coredata.ThirdParty{}
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
 
 			mimeType := mime.TypeByExtension(filepath.Ext(req.FileName))
@@ -131,9 +131,9 @@ func (s VendorBusinessAssociateAgreementService) Upload(
 				ContentType:  &mimeType,
 				CacheControl: new("private, max-age=3600"),
 				Metadata: map[string]string{
-					"type":            "vendor-business-associate-agreement",
-					"vendor-id":       vendorID.String(),
-					"organization-id": vendor.OrganizationID.String(),
+					"type":            "thirdParty-business-associate-agreement",
+					"thirdParty-id":   thirdPartyID.String(),
+					"organization-id": thirdParty.OrganizationID.String(),
 				},
 			})
 			if err != nil {
@@ -150,7 +150,7 @@ func (s VendorBusinessAssociateAgreementService) Upload(
 
 			now := time.Now()
 			fileID := gid.New(s.svc.scope.GetTenantID(), coredata.FileEntityType)
-			vendorBusinessAssociateAgreementID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorBusinessAssociateAgreementEntityType)
+			thirdPartyBusinessAssociateAgreementID := gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyBusinessAssociateAgreementEntityType)
 
 			file = &coredata.File{
 				ID:         fileID,
@@ -164,10 +164,10 @@ func (s VendorBusinessAssociateAgreementService) Upload(
 				UpdatedAt:  now,
 			}
 
-			vendorBusinessAssociateAgreement = &coredata.VendorBusinessAssociateAgreement{
-				ID:             vendorBusinessAssociateAgreementID,
-				OrganizationID: vendor.OrganizationID,
-				VendorID:       vendorID,
+			thirdPartyBusinessAssociateAgreement = &coredata.ThirdPartyBusinessAssociateAgreement{
+				ID:             thirdPartyBusinessAssociateAgreementID,
+				OrganizationID: thirdParty.OrganizationID,
+				ThirdPartyID:   thirdPartyID,
 				ValidFrom:      req.ValidFrom,
 				ValidUntil:     req.ValidUntil,
 				FileID:         fileID,
@@ -179,8 +179,8 @@ func (s VendorBusinessAssociateAgreementService) Upload(
 				return fmt.Errorf("cannot insert file: %w", err)
 			}
 
-			if err := vendorBusinessAssociateAgreement.Upsert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert vendor business associate agreement: %w", err)
+			if err := thirdPartyBusinessAssociateAgreement.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert thirdParty business associate agreement: %w", err)
 			}
 
 			return nil
@@ -191,26 +191,26 @@ func (s VendorBusinessAssociateAgreementService) Upload(
 		return nil, nil, err
 	}
 
-	return vendorBusinessAssociateAgreement, file, nil
+	return thirdPartyBusinessAssociateAgreement, file, nil
 }
 
-func (s VendorBusinessAssociateAgreementService) Get(
+func (s ThirdPartyBusinessAssociateAgreementService) Get(
 	ctx context.Context,
-	vendorBusinessAssociateAgreementID gid.GID,
-) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
-	var vendorBusinessAssociateAgreement *coredata.VendorBusinessAssociateAgreement
+	thirdPartyBusinessAssociateAgreementID gid.GID,
+) (*coredata.ThirdPartyBusinessAssociateAgreement, *coredata.File, error) {
+	var thirdPartyBusinessAssociateAgreement *coredata.ThirdPartyBusinessAssociateAgreement
 	var file *coredata.File
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorBusinessAssociateAgreement = &coredata.VendorBusinessAssociateAgreement{}
-			if err := vendorBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreementID); err != nil {
-				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			thirdPartyBusinessAssociateAgreement = &coredata.ThirdPartyBusinessAssociateAgreement{}
+			if err := thirdPartyBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, thirdPartyBusinessAssociateAgreementID); err != nil {
+				return fmt.Errorf("cannot load thirdParty business associate agreement: %w", err)
 			}
 
 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreement.FileID); err != nil {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, thirdPartyBusinessAssociateAgreement.FileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}
 
@@ -219,15 +219,15 @@ func (s VendorBusinessAssociateAgreementService) Get(
 	)
 
 	if err != nil {
-		return nil, nil, fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+		return nil, nil, fmt.Errorf("cannot load thirdParty business associate agreement: %w", err)
 	}
 
-	return vendorBusinessAssociateAgreement, file, nil
+	return thirdPartyBusinessAssociateAgreement, file, nil
 }
 
-func (s VendorBusinessAssociateAgreementService) GenerateFileURL(
+func (s ThirdPartyBusinessAssociateAgreementService) GenerateFileURL(
 	ctx context.Context,
-	vendorBusinessAssociateAgreementID gid.GID,
+	thirdPartyBusinessAssociateAgreementID gid.GID,
 	expiresIn time.Duration,
 ) (string, error) {
 	var file *coredata.File
@@ -235,13 +235,13 @@ func (s VendorBusinessAssociateAgreementService) GenerateFileURL(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorBusinessAssociateAgreement := &coredata.VendorBusinessAssociateAgreement{}
-			if err := vendorBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreementID); err != nil {
-				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			thirdPartyBusinessAssociateAgreement := &coredata.ThirdPartyBusinessAssociateAgreement{}
+			if err := thirdPartyBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, thirdPartyBusinessAssociateAgreementID); err != nil {
+				return fmt.Errorf("cannot load thirdParty business associate agreement: %w", err)
 			}
 
 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreement.FileID); err != nil {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, thirdPartyBusinessAssociateAgreement.FileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}
 
@@ -273,23 +273,23 @@ func (s VendorBusinessAssociateAgreementService) GenerateFileURL(
 	return presignedReq.URL, nil
 }
 
-func (s VendorBusinessAssociateAgreementService) Update(
+func (s ThirdPartyBusinessAssociateAgreementService) Update(
 	ctx context.Context,
-	vendorID gid.GID,
-	req *VendorBusinessAssociateAgreementUpdateRequest,
-) (*coredata.VendorBusinessAssociateAgreement, *coredata.File, error) {
+	thirdPartyID gid.GID,
+	req *ThirdPartyBusinessAssociateAgreementUpdateRequest,
+) (*coredata.ThirdPartyBusinessAssociateAgreement, *coredata.File, error) {
 	if err := req.Validate(); err != nil {
 		return nil, nil, err
 	}
 
-	existingAgreement := &coredata.VendorBusinessAssociateAgreement{}
+	existingAgreement := &coredata.ThirdPartyBusinessAssociateAgreement{}
 	file := &coredata.File{}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			if err := existingAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load existing vendor business associate agreement: %w", err)
+			if err := existingAgreement.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load existing thirdParty business associate agreement: %w", err)
 			}
 
 			now := time.Now()
@@ -303,7 +303,7 @@ func (s VendorBusinessAssociateAgreementService) Update(
 			existingAgreement.UpdatedAt = now
 
 			if err := existingAgreement.Update(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot update vendor business associate agreement: %w", err)
+				return fmt.Errorf("cannot update thirdParty business associate agreement: %w", err)
 			}
 
 			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
@@ -321,20 +321,20 @@ func (s VendorBusinessAssociateAgreementService) Update(
 	return existingAgreement, file, nil
 }
 
-func (s VendorBusinessAssociateAgreementService) Delete(
+func (s ThirdPartyBusinessAssociateAgreementService) Delete(
 	ctx context.Context,
-	vendorBusinessAssociateAgreementID gid.GID,
+	thirdPartyBusinessAssociateAgreementID gid.GID,
 ) error {
 	return s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			vendorBusinessAssociateAgreement := &coredata.VendorBusinessAssociateAgreement{}
-			if err := vendorBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, vendorBusinessAssociateAgreementID); err != nil {
-				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			thirdPartyBusinessAssociateAgreement := &coredata.ThirdPartyBusinessAssociateAgreement{}
+			if err := thirdPartyBusinessAssociateAgreement.LoadByID(ctx, conn, s.svc.scope, thirdPartyBusinessAssociateAgreementID); err != nil {
+				return fmt.Errorf("cannot load thirdParty business associate agreement: %w", err)
 			}
 
-			if err := vendorBusinessAssociateAgreement.Delete(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot delete vendor business associate agreement: %w", err)
+			if err := thirdPartyBusinessAssociateAgreement.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete thirdParty business associate agreement: %w", err)
 			}
 
 			return nil
@@ -342,20 +342,20 @@ func (s VendorBusinessAssociateAgreementService) Delete(
 	)
 }
 
-func (s VendorBusinessAssociateAgreementService) DeleteByVendorID(
+func (s ThirdPartyBusinessAssociateAgreementService) DeleteByThirdPartyID(
 	ctx context.Context,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	return s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			vendorBusinessAssociateAgreement := &coredata.VendorBusinessAssociateAgreement{}
-			if err := vendorBusinessAssociateAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor business associate agreement: %w", err)
+			thirdPartyBusinessAssociateAgreement := &coredata.ThirdPartyBusinessAssociateAgreement{}
+			if err := thirdPartyBusinessAssociateAgreement.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty business associate agreement: %w", err)
 			}
 
-			if err := vendorBusinessAssociateAgreement.DeleteByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot delete vendor business associate agreement: %w", err)
+			if err := thirdPartyBusinessAssociateAgreement.DeleteByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot delete thirdParty business associate agreement: %w", err)
 			}
 
 			return nil

pkg/probo/third_party_compliance_report_service.go

@@ -28,12 +28,12 @@ import (
 )
 
 type (
-	VendorComplianceReportService struct {
+	ThirdPartyComplianceReportService struct {
 		svc           *TenantService
 		fileValidator *filevalidation.FileValidator
 	}
 
-	VendorComplianceReportCreateRequest struct {
+	ThirdPartyComplianceReportCreateRequest struct {
 		File       FileUpload
 		ReportDate time.Time
 		ValidUntil *time.Time
@@ -41,7 +41,7 @@ type (
 	}
 )
 
-func (vcrcr *VendorComplianceReportCreateRequest) Validate() error {
+func (vcrcr *ThirdPartyComplianceReportCreateRequest) Validate() error {
 	v := validator.New()
 
 	v.Check(vcrcr.ReportName, "report_name", validator.SafeTextNoNewLine(TitleMaxLength))
@@ -49,17 +49,17 @@ func (vcrcr *VendorComplianceReportCreateRequest) Validate() error {
 	return v.Error()
 }
 
-func (s VendorComplianceReportService) ListForVendorID(
+func (s ThirdPartyComplianceReportService) ListForThirdPartyID(
 	ctx context.Context,
-	vendorID gid.GID,
-	cursor *page.Cursor[coredata.VendorComplianceReportOrderField],
-) (*page.Page[*coredata.VendorComplianceReport, coredata.VendorComplianceReportOrderField], error) {
-	var vendorComplianceReports coredata.VendorComplianceReports
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[coredata.ThirdPartyComplianceReportOrderField],
+) (*page.Page[*coredata.ThirdPartyComplianceReport, coredata.ThirdPartyComplianceReportOrderField], error) {
+	var thirdPartyComplianceReports coredata.ThirdPartyComplianceReports
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendorComplianceReports.LoadForVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
+			return thirdPartyComplianceReports.LoadForThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID, cursor)
 		},
 	)
 
@@ -67,30 +67,30 @@ func (s VendorComplianceReportService) ListForVendorID(
 		return nil, err
 	}
 
-	return page.NewPage(vendorComplianceReports, cursor), nil
+	return page.NewPage(thirdPartyComplianceReports, cursor), nil
 }
 
-func (s VendorComplianceReportService) Upload(
+func (s ThirdPartyComplianceReportService) Upload(
 	ctx context.Context,
-	vendorID gid.GID,
-	req *VendorComplianceReportCreateRequest,
-) (*coredata.VendorComplianceReport, error) {
+	thirdPartyID gid.GID,
+	req *ThirdPartyComplianceReportCreateRequest,
+) (*coredata.ThirdPartyComplianceReport, error) {
 	if err := req.Validate(); err != nil {
 		return nil, err
 	}
 
-	vendor, err := s.svc.Vendors.Get(ctx, vendorID)
+	thirdParty, err := s.svc.ThirdParties.Get(ctx, thirdPartyID)
 	if err != nil {
-		return nil, fmt.Errorf("cannot get vendor: %w", err)
+		return nil, fmt.Errorf("cannot get thirdParty: %w", err)
 	}
 
 	f, err := s.svc.Files.UploadAndSaveFile(
 		ctx,
 		s.fileValidator,
 		map[string]string{
-			"type":            "vendor-compliance-report",
-			"vendor-id":       vendorID.String(),
-			"organization-id": vendor.OrganizationID.String(),
+			"type":            "thirdParty-compliance-report",
+			"thirdParty-id":   thirdPartyID.String(),
+			"organization-id": thirdParty.OrganizationID.String(),
 		},
 		&req.File)
 
@@ -100,12 +100,12 @@ func (s VendorComplianceReportService) Upload(
 
 	now := time.Now()
 
-	vendorComplianceReportID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorComplianceReportEntityType)
+	thirdPartyComplianceReportID := gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyComplianceReportEntityType)
 
-	vendorComplianceReport := &coredata.VendorComplianceReport{
-		ID:             vendorComplianceReportID,
-		OrganizationID: vendor.OrganizationID,
-		VendorID:       vendorID,
+	thirdPartyComplianceReport := &coredata.ThirdPartyComplianceReport{
+		ID:             thirdPartyComplianceReportID,
+		OrganizationID: thirdParty.OrganizationID,
+		ThirdPartyID:   thirdPartyID,
 		ReportDate:     req.ReportDate,
 		ValidUntil:     req.ValidUntil,
 		ReportName:     req.ReportName,
@@ -117,7 +117,7 @@ func (s VendorComplianceReportService) Upload(
 	err = s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, tx pg.Tx) error {
-			return vendorComplianceReport.Insert(ctx, tx, s.svc.scope)
+			return thirdPartyComplianceReport.Insert(ctx, tx, s.svc.scope)
 		},
 	)
 
@@ -125,39 +125,39 @@ func (s VendorComplianceReportService) Upload(
 		return nil, err
 	}
 
-	return vendorComplianceReport, nil
+	return thirdPartyComplianceReport, nil
 }
 
-func (s VendorComplianceReportService) Get(
+func (s ThirdPartyComplianceReportService) Get(
 	ctx context.Context,
-	vendorComplianceReportID gid.GID,
-) (*coredata.VendorComplianceReport, error) {
-	vendorComplianceReport := &coredata.VendorComplianceReport{}
+	thirdPartyComplianceReportID gid.GID,
+) (*coredata.ThirdPartyComplianceReport, error) {
+	thirdPartyComplianceReport := &coredata.ThirdPartyComplianceReport{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendorComplianceReport.LoadByID(ctx, conn, s.svc.scope, vendorComplianceReportID)
+			return thirdPartyComplianceReport.LoadByID(ctx, conn, s.svc.scope, thirdPartyComplianceReportID)
 		},
 	)
 
 	if err != nil {
-		return nil, fmt.Errorf("cannot load vendor compliance report: %w", err)
+		return nil, fmt.Errorf("cannot load thirdParty compliance report: %w", err)
 	}
 
-	return vendorComplianceReport, nil
+	return thirdPartyComplianceReport, nil
 }
 
-func (s VendorComplianceReportService) Delete(
+func (s ThirdPartyComplianceReportService) Delete(
 	ctx context.Context,
-	vendorComplianceReportID gid.GID,
+	thirdPartyComplianceReportID gid.GID,
 ) error {
-	vendorComplianceReport := &coredata.VendorComplianceReport{ID: vendorComplianceReportID}
+	thirdPartyComplianceReport := &coredata.ThirdPartyComplianceReport{ID: thirdPartyComplianceReportID}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, tx pg.Tx) error {
-			if err := vendorComplianceReport.Delete(ctx, tx, s.svc.scope); err != nil {
+			if err := thirdPartyComplianceReport.Delete(ctx, tx, s.svc.scope); err != nil {
 				return err
 			}
 
@@ -166,7 +166,7 @@ func (s VendorComplianceReportService) Delete(
 	)
 
 	if err != nil {
-		return fmt.Errorf("cannot delete vendor compliance report: %w", err)
+		return fmt.Errorf("cannot delete thirdParty compliance report: %w", err)
 	}
 
 	return nil

pkg/probo/third_party_contact_service.go

@@ -0,0 +1,232 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/mail"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+type (
+	ThirdPartyContactService struct {
+		svc *TenantService
+	}
+
+	CreateThirdPartyContactRequest struct {
+		ThirdPartyID gid.GID
+		FullName     *string
+		Email        *mail.Addr
+		Phone        *string
+		Role         *string
+	}
+
+	UpdateThirdPartyContactRequest struct {
+		ID       gid.GID
+		FullName **string
+		Email    **mail.Addr
+		Phone    **string
+		Role     **string
+	}
+)
+
+func (cvcr *CreateThirdPartyContactRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(cvcr.ThirdPartyID, "third_party_id", validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
+	v.Check(cvcr.FullName, "fullName", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(cvcr.Phone, "phone", validator.SafeText(NameMaxLength))
+	v.Check(cvcr.Role, "role", validator.SafeText(TitleMaxLength))
+
+	return v.Error()
+}
+
+func (uvcr *UpdateThirdPartyContactRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(uvcr.ID, "id", validator.Required(), validator.GID(coredata.ThirdPartyContactEntityType))
+	v.Check(uvcr.FullName, "fullName", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(uvcr.Phone, "phone", validator.SafeText(NameMaxLength))
+	v.Check(uvcr.Role, "role", validator.SafeText(TitleMaxLength))
+
+	return v.Error()
+}
+
+func (s ThirdPartyContactService) Get(
+	ctx context.Context,
+	thirdPartyContactID gid.GID,
+) (*coredata.ThirdPartyContact, error) {
+	thirdPartyContact := &coredata.ThirdPartyContact{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := thirdPartyContact.LoadByID(ctx, conn, s.svc.scope, thirdPartyContactID)
+			if err != nil {
+				return fmt.Errorf("cannot load thirdParty contact: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return thirdPartyContact, nil
+}
+
+func (s ThirdPartyContactService) List(
+	ctx context.Context,
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[coredata.ThirdPartyContactOrderField],
+) (*page.Page[*coredata.ThirdPartyContact, coredata.ThirdPartyContactOrderField], error) {
+	var thirdPartyContacts coredata.ThirdPartyContacts
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := thirdPartyContacts.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load thirdParty contacts: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(thirdPartyContacts, cursor), nil
+}
+
+func (s ThirdPartyContactService) Create(
+	ctx context.Context,
+	req CreateThirdPartyContactRequest,
+) (*coredata.ThirdPartyContact, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	now := time.Now()
+	thirdPartyContact := &coredata.ThirdPartyContact{
+		ID:           gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyContactEntityType),
+		ThirdPartyID: req.ThirdPartyID,
+		FullName:     req.FullName,
+		Email:        req.Email,
+		Phone:        req.Phone,
+		Role:         req.Role,
+		CreatedAt:    now,
+		UpdatedAt:    now,
+	}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, conn pg.Tx) error {
+			thirdParty := &coredata.ThirdParty{}
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, req.ThirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
+			}
+
+			thirdPartyContact.OrganizationID = thirdParty.OrganizationID
+
+			if err := thirdPartyContact.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert thirdParty contact: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return thirdPartyContact, nil
+}
+
+func (s ThirdPartyContactService) Update(
+	ctx context.Context,
+	req UpdateThirdPartyContactRequest,
+) (*coredata.ThirdPartyContact, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	thirdPartyContact := &coredata.ThirdPartyContact{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, conn pg.Tx) error {
+			err := thirdPartyContact.LoadByID(ctx, conn, s.svc.scope, req.ID)
+			if err != nil {
+				return fmt.Errorf("cannot load thirdParty contact: %w", err)
+			}
+
+			if req.FullName != nil {
+				thirdPartyContact.FullName = *req.FullName
+			}
+			if req.Email != nil {
+				thirdPartyContact.Email = *req.Email
+			}
+			if req.Phone != nil {
+				thirdPartyContact.Phone = *req.Phone
+			}
+			if req.Role != nil {
+				thirdPartyContact.Role = *req.Role
+			}
+			thirdPartyContact.UpdatedAt = time.Now()
+
+			return thirdPartyContact.Update(ctx, conn, s.svc.scope)
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return thirdPartyContact, nil
+}
+
+func (s ThirdPartyContactService) Delete(
+	ctx context.Context,
+	thirdPartyContactID gid.GID,
+) error {
+	thirdPartyContact := coredata.ThirdPartyContact{ID: thirdPartyContactID}
+	return s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, conn pg.Tx) error {
+			if err := thirdPartyContact.LoadByID(ctx, conn, s.svc.scope, thirdPartyContactID); err != nil {
+				return fmt.Errorf("cannot load thirdParty contact: %w", err)
+			}
+
+			if err := thirdPartyContact.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete thirdParty contact: %w", err)
+			}
+
+			return nil
+		},
+	)
+}

pkg/probo/third_party_data_privacy_agreement_service.go

@@ -32,24 +32,24 @@ import (
 )
 
 type (
-	VendorDataPrivacyAgreementService struct {
+	ThirdPartyDataPrivacyAgreementService struct {
 		svc *TenantService
 	}
 
-	VendorDataPrivacyAgreementCreateRequest struct {
+	ThirdPartyDataPrivacyAgreementCreateRequest struct {
 		File       io.Reader
 		ValidFrom  *time.Time
 		ValidUntil *time.Time
 		FileName   string
 	}
 
-	VendorDataPrivacyAgreementUpdateRequest struct {
+	ThirdPartyDataPrivacyAgreementUpdateRequest struct {
 		ValidFrom  **time.Time
 		ValidUntil **time.Time
 	}
 )
 
-func (vdpacr *VendorDataPrivacyAgreementCreateRequest) Validate() error {
+func (vdpacr *ThirdPartyDataPrivacyAgreementCreateRequest) Validate() error {
 	v := validator.New()
 
 	v.Check(vdpacr.FileName, "file_name", validator.SafeTextNoNewLine(TitleMaxLength))
@@ -58,7 +58,7 @@ func (vdpacr *VendorDataPrivacyAgreementCreateRequest) Validate() error {
 	return v.Error()
 }
 
-func (vdpaur *VendorDataPrivacyAgreementUpdateRequest) Validate() error {
+func (vdpaur *ThirdPartyDataPrivacyAgreementUpdateRequest) Validate() error {
 	v := validator.New()
 
 	v.Check(vdpaur.ValidUntil, "valid_until", validator.After(vdpaur.ValidFrom))
@@ -66,23 +66,23 @@ func (vdpaur *VendorDataPrivacyAgreementUpdateRequest) Validate() error {
 	return v.Error()
 }
 
-func (s VendorDataPrivacyAgreementService) GetByVendorID(
+func (s ThirdPartyDataPrivacyAgreementService) GetByThirdPartyID(
 	ctx context.Context,
-	vendorID gid.GID,
-) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
-	var vendorDataPrivacyAgreement *coredata.VendorDataPrivacyAgreement
+	thirdPartyID gid.GID,
+) (*coredata.ThirdPartyDataPrivacyAgreement, *coredata.File, error) {
+	var thirdPartyDataPrivacyAgreement *coredata.ThirdPartyDataPrivacyAgreement
 	var file *coredata.File
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorDataPrivacyAgreement = &coredata.VendorDataPrivacyAgreement{}
-			if err := vendorDataPrivacyAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			thirdPartyDataPrivacyAgreement = &coredata.ThirdPartyDataPrivacyAgreement{}
+			if err := thirdPartyDataPrivacyAgreement.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty data privacy agreement: %w", err)
 			}
 
 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreement.FileID); err != nil {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, thirdPartyDataPrivacyAgreement.FileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}
 
@@ -94,14 +94,14 @@ func (s VendorDataPrivacyAgreementService) GetByVendorID(
 		return nil, nil, err
 	}
 
-	return vendorDataPrivacyAgreement, file, nil
+	return thirdPartyDataPrivacyAgreement, file, nil
 }
 
-func (s VendorDataPrivacyAgreementService) Upload(
+func (s ThirdPartyDataPrivacyAgreementService) Upload(
 	ctx context.Context,
-	vendorID gid.GID,
-	req *VendorDataPrivacyAgreementCreateRequest,
-) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
+	thirdPartyID gid.GID,
+	req *ThirdPartyDataPrivacyAgreementCreateRequest,
+) (*coredata.ThirdPartyDataPrivacyAgreement, *coredata.File, error) {
 	if err := req.Validate(); err != nil {
 		return nil, nil, err
 	}
@@ -111,16 +111,16 @@ func (s VendorDataPrivacyAgreementService) Upload(
 		return nil, nil, fmt.Errorf("cannot generate object key: %w", err)
 	}
 
-	var vendorDataPrivacyAgreement *coredata.VendorDataPrivacyAgreement
+	var thirdPartyDataPrivacyAgreement *coredata.ThirdPartyDataPrivacyAgreement
 	var file *coredata.File
-	var vendor *coredata.Vendor
+	var thirdParty *coredata.ThirdParty
 
 	err = s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			vendor = &coredata.Vendor{}
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
+			thirdParty = &coredata.ThirdParty{}
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
 
 			mimeType := mime.TypeByExtension(filepath.Ext(req.FileName))
@@ -131,9 +131,9 @@ func (s VendorDataPrivacyAgreementService) Upload(
 				ContentType:  &mimeType,
 				CacheControl: new("private, max-age=3600"),
 				Metadata: map[string]string{
-					"type":            "vendor-data-privacy-agreement",
-					"vendor-id":       vendorID.String(),
-					"organization-id": vendor.OrganizationID.String(),
+					"type":            "thirdParty-data-privacy-agreement",
+					"thirdParty-id":   thirdPartyID.String(),
+					"organization-id": thirdParty.OrganizationID.String(),
 				},
 			})
 			if err != nil {
@@ -149,7 +149,7 @@ func (s VendorDataPrivacyAgreementService) Upload(
 
 			now := time.Now()
 			fileID := gid.New(s.svc.scope.GetTenantID(), coredata.FileEntityType)
-			vendorDataPrivacyAgreementID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorDataPrivacyAgreementEntityType)
+			thirdPartyDataPrivacyAgreementID := gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyDataPrivacyAgreementEntityType)
 			file = &coredata.File{
 				ID:         fileID,
 				BucketName: s.svc.bucket,
@@ -162,10 +162,10 @@ func (s VendorDataPrivacyAgreementService) Upload(
 				UpdatedAt:  now,
 			}
 
-			vendorDataPrivacyAgreement = &coredata.VendorDataPrivacyAgreement{
-				ID:             vendorDataPrivacyAgreementID,
-				OrganizationID: vendor.OrganizationID,
-				VendorID:       vendorID,
+			thirdPartyDataPrivacyAgreement = &coredata.ThirdPartyDataPrivacyAgreement{
+				ID:             thirdPartyDataPrivacyAgreementID,
+				OrganizationID: thirdParty.OrganizationID,
+				ThirdPartyID:   thirdPartyID,
 				ValidFrom:      req.ValidFrom,
 				ValidUntil:     req.ValidUntil,
 				FileID:         fileID,
@@ -177,8 +177,8 @@ func (s VendorDataPrivacyAgreementService) Upload(
 				return fmt.Errorf("cannot insert file: %w", err)
 			}
 
-			if err := vendorDataPrivacyAgreement.Upsert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert vendor data privacy agreement: %w", err)
+			if err := thirdPartyDataPrivacyAgreement.Upsert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert thirdParty data privacy agreement: %w", err)
 			}
 
 			return nil
@@ -189,26 +189,26 @@ func (s VendorDataPrivacyAgreementService) Upload(
 		return nil, nil, err
 	}
 
-	return vendorDataPrivacyAgreement, file, nil
+	return thirdPartyDataPrivacyAgreement, file, nil
 }
 
-func (s VendorDataPrivacyAgreementService) Get(
+func (s ThirdPartyDataPrivacyAgreementService) Get(
 	ctx context.Context,
-	vendorDataPrivacyAgreementID gid.GID,
-) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
-	var vendorDataPrivacyAgreement *coredata.VendorDataPrivacyAgreement
+	thirdPartyDataPrivacyAgreementID gid.GID,
+) (*coredata.ThirdPartyDataPrivacyAgreement, *coredata.File, error) {
+	var thirdPartyDataPrivacyAgreement *coredata.ThirdPartyDataPrivacyAgreement
 	var file *coredata.File
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorDataPrivacyAgreement = &coredata.VendorDataPrivacyAgreement{}
-			if err := vendorDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreementID); err != nil {
-				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			thirdPartyDataPrivacyAgreement = &coredata.ThirdPartyDataPrivacyAgreement{}
+			if err := thirdPartyDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, thirdPartyDataPrivacyAgreementID); err != nil {
+				return fmt.Errorf("cannot load thirdParty data privacy agreement: %w", err)
 			}
 
 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreement.FileID); err != nil {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, thirdPartyDataPrivacyAgreement.FileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}
 
@@ -217,15 +217,15 @@ func (s VendorDataPrivacyAgreementService) Get(
 	)
 
 	if err != nil {
-		return nil, nil, fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+		return nil, nil, fmt.Errorf("cannot load thirdParty data privacy agreement: %w", err)
 	}
 
-	return vendorDataPrivacyAgreement, file, nil
+	return thirdPartyDataPrivacyAgreement, file, nil
 }
 
-func (s VendorDataPrivacyAgreementService) GenerateFileURL(
+func (s ThirdPartyDataPrivacyAgreementService) GenerateFileURL(
 	ctx context.Context,
-	vendorDataPrivacyAgreementID gid.GID,
+	thirdPartyDataPrivacyAgreementID gid.GID,
 	expiresIn time.Duration,
 ) (string, error) {
 	var file *coredata.File
@@ -233,13 +233,13 @@ func (s VendorDataPrivacyAgreementService) GenerateFileURL(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorDataPrivacyAgreement := &coredata.VendorDataPrivacyAgreement{}
-			if err := vendorDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreementID); err != nil {
-				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			thirdPartyDataPrivacyAgreement := &coredata.ThirdPartyDataPrivacyAgreement{}
+			if err := thirdPartyDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, thirdPartyDataPrivacyAgreementID); err != nil {
+				return fmt.Errorf("cannot load thirdParty data privacy agreement: %w", err)
 			}
 
 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreement.FileID); err != nil {
+			if err := file.LoadByID(ctx, conn, s.svc.scope, thirdPartyDataPrivacyAgreement.FileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}
 
@@ -271,23 +271,23 @@ func (s VendorDataPrivacyAgreementService) GenerateFileURL(
 	return presignedReq.URL, nil
 }
 
-func (s VendorDataPrivacyAgreementService) Update(
+func (s ThirdPartyDataPrivacyAgreementService) Update(
 	ctx context.Context,
-	vendorID gid.GID,
-	req *VendorDataPrivacyAgreementUpdateRequest,
-) (*coredata.VendorDataPrivacyAgreement, *coredata.File, error) {
+	thirdPartyID gid.GID,
+	req *ThirdPartyDataPrivacyAgreementUpdateRequest,
+) (*coredata.ThirdPartyDataPrivacyAgreement, *coredata.File, error) {
 	if err := req.Validate(); err != nil {
 		return nil, nil, err
 	}
 
-	existingAgreement := &coredata.VendorDataPrivacyAgreement{}
+	existingAgreement := &coredata.ThirdPartyDataPrivacyAgreement{}
 	file := &coredata.File{}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			if err := existingAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load existing vendor data privacy agreement: %w", err)
+			if err := existingAgreement.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load existing thirdParty data privacy agreement: %w", err)
 			}
 
 			now := time.Now()
@@ -301,7 +301,7 @@ func (s VendorDataPrivacyAgreementService) Update(
 			existingAgreement.UpdatedAt = now
 
 			if err := existingAgreement.Update(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
+				return fmt.Errorf("cannot update thirdParty data privacy agreement: %w", err)
 			}
 
 			if err := file.LoadByID(ctx, conn, s.svc.scope, existingAgreement.FileID); err != nil {
@@ -319,20 +319,20 @@ func (s VendorDataPrivacyAgreementService) Update(
 	return existingAgreement, file, nil
 }
 
-func (s VendorDataPrivacyAgreementService) Delete(
+func (s ThirdPartyDataPrivacyAgreementService) Delete(
 	ctx context.Context,
-	vendorDataPrivacyAgreementID gid.GID,
+	thirdPartyDataPrivacyAgreementID gid.GID,
 ) error {
 	return s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			vendorDataPrivacyAgreement := &coredata.VendorDataPrivacyAgreement{}
-			if err := vendorDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, vendorDataPrivacyAgreementID); err != nil {
-				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			thirdPartyDataPrivacyAgreement := &coredata.ThirdPartyDataPrivacyAgreement{}
+			if err := thirdPartyDataPrivacyAgreement.LoadByID(ctx, conn, s.svc.scope, thirdPartyDataPrivacyAgreementID); err != nil {
+				return fmt.Errorf("cannot load thirdParty data privacy agreement: %w", err)
 			}
 
-			if err := vendorDataPrivacyAgreement.Delete(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot delete vendor data privacy agreement: %w", err)
+			if err := thirdPartyDataPrivacyAgreement.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete thirdParty data privacy agreement: %w", err)
 			}
 
 			return nil
@@ -340,20 +340,20 @@ func (s VendorDataPrivacyAgreementService) Delete(
 	)
 }
 
-func (s VendorDataPrivacyAgreementService) DeleteByVendorID(
+func (s ThirdPartyDataPrivacyAgreementService) DeleteByThirdPartyID(
 	ctx context.Context,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	return s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			vendorDataPrivacyAgreement := &coredata.VendorDataPrivacyAgreement{}
-			if err := vendorDataPrivacyAgreement.LoadByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor data privacy agreement: %w", err)
+			thirdPartyDataPrivacyAgreement := &coredata.ThirdPartyDataPrivacyAgreement{}
+			if err := thirdPartyDataPrivacyAgreement.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty data privacy agreement: %w", err)
 			}
 
-			if err := vendorDataPrivacyAgreement.DeleteByVendorID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot delete vendor data privacy agreement: %w", err)
+			if err := thirdPartyDataPrivacyAgreement.DeleteByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot delete thirdParty data privacy agreement: %w", err)
 			}
 
 			return nil

pkg/probo/third_party_service.go

@@ -32,16 +32,16 @@ import (
 	webhooktypes "go.probo.inc/probo/pkg/webhook/types"
 )
 
-// ErrVendorAssessmentDisabled is returned by VendorAssessor.Assess when the
-// deployment has not configured an LLM provider for vendor assessment.
-var ErrVendorAssessmentDisabled = errors.New("vendor assessment is not configured on this deployment")
+// ErrThirdPartyAssessmentDisabled is returned by ThirdPartyAssessor.Assess when the
+// deployment has not configured an LLM provider for thirdParty assessment.
+var ErrThirdPartyAssessmentDisabled = errors.New("thirdParty assessment is not configured on this deployment")
 
-// VendorAssessor produces a vendor assessment report from a website URL and
+// ThirdPartyAssessor produces a thirdParty assessment report from a website URL and
 // an optional procedure description. Implementations that cannot perform
 // assessment (missing LLM credentials, misconfigured provider) must return
-// ErrVendorAssessmentDisabled from Assess so callers can surface a stable
+// ErrThirdPartyAssessmentDisabled from Assess so callers can surface a stable
 // "feature unavailable" error instead of a generic internal error.
-type VendorAssessor interface {
+type ThirdPartyAssessor interface {
 	Assess(
 		ctx context.Context,
 		websiteURL string,
@@ -50,35 +50,35 @@ type VendorAssessor interface {
 	) (*vetting.Result, error)
 }
 
-// DisabledVendorAssessor is the VendorAssessor implementation used when no
-// LLM provider is configured for the vendor-assessor agent. Its Assess
-// method always returns ErrVendorAssessmentDisabled.
-type DisabledVendorAssessor struct{}
+// DisabledThirdPartyAssessor is the ThirdPartyAssessor implementation used when no
+// LLM provider is configured for the third-party-assessor agent. Its Assess
+// method always returns ErrThirdPartyAssessmentDisabled.
+type DisabledThirdPartyAssessor struct{}
 
-var _ VendorAssessor = DisabledVendorAssessor{}
+var _ ThirdPartyAssessor = DisabledThirdPartyAssessor{}
 
-func (DisabledVendorAssessor) Assess(
+func (DisabledThirdPartyAssessor) Assess(
 	_ context.Context,
 	_ string,
 	_ string,
 	_ agent.ProgressReporter,
 ) (*vetting.Result, error) {
-	return nil, ErrVendorAssessmentDisabled
+	return nil, ErrThirdPartyAssessmentDisabled
 }
 
 type (
-	VendorService struct {
+	ThirdPartyService struct {
 		svc *TenantService
 	}
 
-	CreateVendorRequest struct {
+	CreateThirdPartyRequest struct {
 		OrganizationID                gid.GID
 		Name                          string
 		Description                   *string
 		HeadquarterAddress            *string
 		LegalName                     *string
 		WebsiteURL                    *string
-		Category                      *coredata.VendorCategory
+		Category                      *coredata.ThirdPartyCategory
 		PrivacyPolicyURL              *string
 		ServiceLevelAgreementURL      *string
 		DataProcessingAgreementURL    *string
@@ -94,7 +94,7 @@ type (
 		SecurityOwnerID               *gid.GID
 	}
 
-	UpdateVendorRequest struct {
+	UpdateThirdPartyRequest struct {
 		ID                            gid.GID
 		Name                          *string
 		Description                   **string
@@ -102,7 +102,7 @@ type (
 		LegalName                     **string
 		WebsiteURL                    **string
 		TermsOfServiceURL             **string
-		Category                      *coredata.VendorCategory
+		Category                      *coredata.ThirdPartyCategory
 		PrivacyPolicyURL              **string
 		ServiceLevelAgreementURL      **string
 		DataProcessingAgreementURL    **string
@@ -118,14 +118,14 @@ type (
 		ShowOnTrustCenter             *bool
 	}
 
-	AssessVendorRequest struct {
+	AssessThirdPartyRequest struct {
 		ID         gid.GID
 		WebsiteURL string
 		Procedure  *string
 	}
 
-	AssessVendorResult struct {
-		Vendor        *coredata.Vendor
+	AssessThirdPartyResult struct {
+		ThirdParty    *coredata.ThirdParty
 		Report        string
 		Subprocessors []Subprocessor
 	}
@@ -136,8 +136,8 @@ type (
 		Purpose string
 	}
 
-	CreateVendorRiskAssessmentRequest struct {
-		VendorID        gid.GID
+	CreateThirdPartyRiskAssessmentRequest struct {
+		ThirdPartyID    gid.GID
 		ExpiresAt       time.Time
 		DataSensitivity coredata.DataSensitivity
 		BusinessImpact  coredata.BusinessImpact
@@ -145,7 +145,7 @@ type (
 	}
 )
 
-func (cvr *CreateVendorRequest) Validate() error {
+func (cvr *CreateThirdPartyRequest) Validate() error {
 	v := validator.New()
 
 	v.Check(cvr.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType))
@@ -154,7 +154,7 @@ func (cvr *CreateVendorRequest) Validate() error {
 	v.Check(cvr.HeadquarterAddress, "headquarter_address", validator.SafeText(ContentMaxLength))
 	v.Check(cvr.LegalName, "cvr.LegalName", validator.SafeTextNoNewLine(TitleMaxLength))
 	v.Check(cvr.WebsiteURL, "website_url", validator.SafeText(2048))
-	v.Check(cvr.Category, "category", validator.OneOfSlice(coredata.VendorCategories()))
+	v.Check(cvr.Category, "category", validator.OneOfSlice(coredata.ThirdPartyCategories()))
 	v.Check(cvr.PrivacyPolicyURL, "privacy_policy_url", validator.SafeText(2048))
 	v.Check(cvr.ServiceLevelAgreementURL, "service_level_agreement_url", validator.SafeText(2048))
 	v.Check(cvr.DataProcessingAgreementURL, "data_processing_agreement_url", validator.SafeText(2048))
@@ -170,16 +170,16 @@ func (cvr *CreateVendorRequest) Validate() error {
 	return v.Error()
 }
 
-func (uvr *UpdateVendorRequest) Validate() error {
+func (uvr *UpdateThirdPartyRequest) Validate() error {
 	v := validator.New()
 
-	v.Check(uvr.ID, "id", validator.Required(), validator.GID(coredata.VendorEntityType))
+	v.Check(uvr.ID, "id", validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
 	v.Check(uvr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
 	v.Check(uvr.Description, "description", validator.SafeText(ContentMaxLength))
 	v.Check(uvr.HeadquarterAddress, "headquarter_address", validator.SafeText(ContentMaxLength))
 	v.Check(uvr.LegalName, "uvr.LegalName", validator.SafeTextNoNewLine(TitleMaxLength))
 	v.Check(uvr.WebsiteURL, "website_url", validator.SafeText(2048))
-	v.Check(uvr.Category, "category", validator.OneOfSlice(coredata.VendorCategories()))
+	v.Check(uvr.Category, "category", validator.OneOfSlice(coredata.ThirdPartyCategories()))
 	v.Check(uvr.PrivacyPolicyURL, "privacy_policy_url", validator.SafeText(2048))
 	v.Check(uvr.ServiceLevelAgreementURL, "service_level_agreement_url", validator.SafeText(2048))
 	v.Check(uvr.DataProcessingAgreementURL, "data_processing_agreement_url", validator.SafeText(2048))
@@ -195,10 +195,10 @@ func (uvr *UpdateVendorRequest) Validate() error {
 	return v.Error()
 }
 
-func (cvrar *CreateVendorRiskAssessmentRequest) Validate() error {
+func (cvrar *CreateThirdPartyRiskAssessmentRequest) Validate() error {
 	v := validator.New()
 
-	v.Check(cvrar.VendorID, "vendor_id", validator.Required(), validator.GID(coredata.VendorEntityType))
+	v.Check(cvrar.ThirdPartyID, "third_party_id", validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
 	v.Check(cvrar.DataSensitivity, "data_sensitivity", validator.Required(), validator.OneOfSlice(coredata.DataSensitivities()))
 	v.Check(cvrar.BusinessImpact, "business_impact", validator.Required(), validator.OneOfSlice(coredata.BusinessImpacts()))
 	v.Check(cvrar.Notes, "notes", validator.SafeText(ContentMaxLength))
@@ -206,7 +206,7 @@ func (cvrar *CreateVendorRiskAssessmentRequest) Validate() error {
 	return v.Error()
 }
 
-func (s VendorService) CountForOrganizationID(
+func (s ThirdPartyService) CountForOrganizationID(
 	ctx context.Context,
 	organizationID gid.GID,
 ) (int, error) {
@@ -215,11 +215,11 @@ func (s VendorService) CountForOrganizationID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) (err error) {
-			vendors := coredata.Vendors{}
-			filter := &coredata.VendorFilter{}
-			count, err = vendors.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID, filter)
+			thirdParties := coredata.ThirdParties{}
+			filter := &coredata.ThirdPartyFilter{}
+			count, err = thirdParties.CountByOrganizationID(ctx, conn, s.svc.scope, organizationID, filter)
 			if err != nil {
-				return fmt.Errorf("cannot count vendors: %w", err)
+				return fmt.Errorf("cannot count thirdParties: %w", err)
 			}
 
 			return nil
@@ -233,13 +233,13 @@ func (s VendorService) CountForOrganizationID(
 	return count, nil
 }
 
-func (s VendorService) ListForOrganizationID(
+func (s ThirdPartyService) ListForOrganizationID(
 	ctx context.Context,
 	organizationID gid.GID,
-	cursor *page.Cursor[coredata.VendorOrderField],
-	filter *coredata.VendorFilter,
-) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
-	var vendors coredata.Vendors
+	cursor *page.Cursor[coredata.ThirdPartyOrderField],
+	filter *coredata.ThirdPartyFilter,
+) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
+	var thirdParties coredata.ThirdParties
 	organization := &coredata.Organization{}
 
 	err := s.svc.pg.WithConn(
@@ -249,7 +249,7 @@ func (s VendorService) ListForOrganizationID(
 				return fmt.Errorf("cannot load organization: %w", err)
 			}
 
-			return vendors.LoadByOrganizationID(
+			return thirdParties.LoadByOrganizationID(
 				ctx,
 				conn,
 				s.svc.scope,
@@ -264,10 +264,10 @@ func (s VendorService) ListForOrganizationID(
 		return nil, err
 	}
 
-	return page.NewPage(vendors, cursor), nil
+	return page.NewPage(thirdParties, cursor), nil
 }
 
-func (s VendorService) CountForDatumID(
+func (s ThirdPartyService) CountForDatumID(
 	ctx context.Context,
 	datumID gid.GID,
 ) (int, error) {
@@ -276,10 +276,10 @@ func (s VendorService) CountForDatumID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) (err error) {
-			vendors := coredata.Vendors{}
-			count, err = vendors.CountByDatumID(ctx, conn, s.svc.scope, datumID)
+			thirdParties := coredata.ThirdParties{}
+			count, err = thirdParties.CountByDatumID(ctx, conn, s.svc.scope, datumID)
 			if err != nil {
-				return fmt.Errorf("cannot count vendors: %w", err)
+				return fmt.Errorf("cannot count thirdParties: %w", err)
 			}
 
 			return nil
@@ -293,17 +293,17 @@ func (s VendorService) CountForDatumID(
 	return count, nil
 }
 
-func (s VendorService) ListForDatumID(
+func (s ThirdPartyService) ListForDatumID(
 	ctx context.Context,
 	datumID gid.GID,
-	cursor *page.Cursor[coredata.VendorOrderField],
-) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
-	var vendors coredata.Vendors
+	cursor *page.Cursor[coredata.ThirdPartyOrderField],
+) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
+	var thirdParties coredata.ThirdParties
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendors.LoadByDatumID(
+			return thirdParties.LoadByDatumID(
 				ctx,
 				conn,
 				s.svc.scope,
@@ -317,102 +317,102 @@ func (s VendorService) ListForDatumID(
 		return nil, err
 	}
 
-	return page.NewPage(vendors, cursor), nil
+	return page.NewPage(thirdParties, cursor), nil
 }
 
-func (s VendorService) Update(
+func (s ThirdPartyService) Update(
 	ctx context.Context,
-	req UpdateVendorRequest,
-) (*coredata.Vendor, error) {
+	req UpdateThirdPartyRequest,
+) (*coredata.ThirdParty, error) {
 	if err := req.Validate(); err != nil {
 		return nil, err
 	}
 
-	vendor := &coredata.Vendor{}
+	thirdParty := &coredata.ThirdParty{}
 
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
-				return fmt.Errorf("cannot load vendor %q: %w", req.ID, err)
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load thirdParty %q: %w", req.ID, err)
 			}
 
 			if req.Name != nil {
-				vendor.Name = *req.Name
+				thirdParty.Name = *req.Name
 			}
 
 			if req.Description != nil {
-				vendor.Description = *req.Description
+				thirdParty.Description = *req.Description
 			}
 
 			if req.StatusPageURL != nil {
-				vendor.StatusPageURL = *req.StatusPageURL
+				thirdParty.StatusPageURL = *req.StatusPageURL
 			}
 
 			if req.TermsOfServiceURL != nil {
-				vendor.TermsOfServiceURL = *req.TermsOfServiceURL
+				thirdParty.TermsOfServiceURL = *req.TermsOfServiceURL
 			}
 
 			if req.PrivacyPolicyURL != nil {
-				vendor.PrivacyPolicyURL = *req.PrivacyPolicyURL
+				thirdParty.PrivacyPolicyURL = *req.PrivacyPolicyURL
 			}
 
 			if req.ServiceLevelAgreementURL != nil {
-				vendor.ServiceLevelAgreementURL = *req.ServiceLevelAgreementURL
+				thirdParty.ServiceLevelAgreementURL = *req.ServiceLevelAgreementURL
 			}
 
 			if req.DataProcessingAgreementURL != nil {
-				vendor.DataProcessingAgreementURL = *req.DataProcessingAgreementURL
+				thirdParty.DataProcessingAgreementURL = *req.DataProcessingAgreementURL
 			}
 
 			if req.BusinessAssociateAgreementURL != nil {
-				vendor.BusinessAssociateAgreementURL = *req.BusinessAssociateAgreementURL
+				thirdParty.BusinessAssociateAgreementURL = *req.BusinessAssociateAgreementURL
 			}
 
 			if req.SubprocessorsListURL != nil {
-				vendor.SubprocessorsListURL = *req.SubprocessorsListURL
+				thirdParty.SubprocessorsListURL = *req.SubprocessorsListURL
 			}
 
 			if req.Category != nil {
-				vendor.Category = *req.Category
+				thirdParty.Category = *req.Category
 			} else {
-				vendor.Category = coredata.VendorCategoryOther
+				thirdParty.Category = coredata.ThirdPartyCategoryOther
 			}
 
 			if req.SecurityPageURL != nil {
-				vendor.SecurityPageURL = *req.SecurityPageURL
+				thirdParty.SecurityPageURL = *req.SecurityPageURL
 			}
 
 			if req.ShowOnTrustCenter != nil {
-				vendor.ShowOnTrustCenter = *req.ShowOnTrustCenter
+				thirdParty.ShowOnTrustCenter = *req.ShowOnTrustCenter
 			}
 
 			if req.TrustPageURL != nil {
-				vendor.TrustPageURL = *req.TrustPageURL
+				thirdParty.TrustPageURL = *req.TrustPageURL
 			}
 
 			if req.HeadquarterAddress != nil {
-				vendor.HeadquarterAddress = *req.HeadquarterAddress
+				thirdParty.HeadquarterAddress = *req.HeadquarterAddress
 			}
 
 			if req.LegalName != nil {
-				vendor.LegalName = *req.LegalName
+				thirdParty.LegalName = *req.LegalName
 			}
 
 			if req.WebsiteURL != nil {
-				vendor.WebsiteURL = *req.WebsiteURL
+				thirdParty.WebsiteURL = *req.WebsiteURL
 			}
 
 			if req.TermsOfServiceURL != nil {
-				vendor.TermsOfServiceURL = *req.TermsOfServiceURL
+				thirdParty.TermsOfServiceURL = *req.TermsOfServiceURL
 			}
 
 			if req.Certifications != nil {
-				vendor.Certifications = req.Certifications
+				thirdParty.Certifications = req.Certifications
 			}
 
 			if req.Countries != nil {
-				vendor.Countries = req.Countries
+				thirdParty.Countries = req.Countries
 			}
 
 			if req.BusinessOwnerID != nil {
@@ -421,9 +421,9 @@ func (s VendorService) Update(
 					if err := businessOwner.LoadByID(ctx, conn, s.svc.scope, **req.BusinessOwnerID); err != nil {
 						return fmt.Errorf("cannot load business owner profile: %w", err)
 					}
-					vendor.BusinessOwnerID = &businessOwner.ID
+					thirdParty.BusinessOwnerID = &businessOwner.ID
 				} else {
-					vendor.BusinessOwnerID = nil
+					thirdParty.BusinessOwnerID = nil
 				}
 			}
 
@@ -433,25 +433,25 @@ func (s VendorService) Update(
 					if err := securityOwner.LoadByID(ctx, conn, s.svc.scope, **req.SecurityOwnerID); err != nil {
 						return fmt.Errorf("cannot load security owner profile: %w", err)
 					}
-					vendor.SecurityOwnerID = &securityOwner.ID
+					thirdParty.SecurityOwnerID = &securityOwner.ID
 				} else {
-					vendor.SecurityOwnerID = nil
+					thirdParty.SecurityOwnerID = nil
 				}
 			}
 
-			vendor.UpdatedAt = time.Now()
+			thirdParty.UpdatedAt = time.Now()
 
-			if err := vendor.Update(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot update vendor: %w", err)
+			if err := thirdParty.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update thirdParty: %w", err)
 			}
 
 			if err := webhook.InsertData(
 				ctx,
 				conn,
 				s.svc.scope,
-				vendor.OrganizationID,
-				coredata.WebhookEventTypeVendorUpdated,
-				webhooktypes.NewVendor(vendor),
+				thirdParty.OrganizationID,
+				coredata.WebhookEventTypeThirdPartyUpdated,
+				webhooktypes.NewThirdParty(thirdParty),
 			); err != nil {
 				return fmt.Errorf("cannot insert webhook event: %w", err)
 			}
@@ -464,19 +464,19 @@ func (s VendorService) Update(
 		return nil, err
 	}
 
-	return vendor, nil
+	return thirdParty, nil
 }
 
-func (s VendorService) Get(
+func (s ThirdPartyService) Get(
 	ctx context.Context,
-	vendorID gid.GID,
-) (*coredata.Vendor, error) {
-	vendor := &coredata.Vendor{}
+	thirdPartyID gid.GID,
+) (*coredata.ThirdParty, error) {
+	thirdParty := &coredata.ThirdParty{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendor.LoadByID(ctx, conn, s.svc.scope, vendorID)
+			return thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyID)
 		},
 	)
 
@@ -484,25 +484,25 @@ func (s VendorService) Get(
 		return nil, err
 	}
 
-	return vendor, nil
+	return thirdParty, nil
 }
 
-func (s VendorService) GetByIDs(
+func (s ThirdPartyService) GetByIDs(
 	ctx context.Context,
-	vendorIDs ...gid.GID,
-) (coredata.Vendors, error) {
-	var vendors coredata.Vendors
+	thirdPartyIDs ...gid.GID,
+) (coredata.ThirdParties, error) {
+	var thirdParties coredata.ThirdParties
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			if err := vendors.LoadByIDs(
+			if err := thirdParties.LoadByIDs(
 				ctx,
 				conn,
 				s.svc.scope,
-				vendorIDs,
+				thirdPartyIDs,
 			); err != nil {
-				return fmt.Errorf("cannot load vendors by ids: %w", err)
+				return fmt.Errorf("cannot load thirdParties by ids: %w", err)
 			}
 
 			return nil
@@ -512,49 +512,49 @@ func (s VendorService) GetByIDs(
 		return nil, err
 	}
 
-	return vendors, nil
+	return thirdParties, nil
 }
 
-func (s VendorService) Delete(
+func (s ThirdPartyService) Delete(
 	ctx context.Context,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
-	vendor := &coredata.Vendor{}
+	thirdParty := &coredata.ThirdParty{}
 
 	return s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
 
 			if err := webhook.InsertData(
 				ctx,
 				conn,
 				s.svc.scope,
-				vendor.OrganizationID,
-				coredata.WebhookEventTypeVendorDeleted,
-				webhooktypes.NewVendor(vendor),
+				thirdParty.OrganizationID,
+				coredata.WebhookEventTypeThirdPartyDeleted,
+				webhooktypes.NewThirdParty(thirdParty),
 			); err != nil {
 				return fmt.Errorf("cannot insert webhook event: %w", err)
 			}
 
-			return vendor.Delete(ctx, conn, s.svc.scope)
+			return thirdParty.Delete(ctx, conn, s.svc.scope)
 		},
 	)
 }
 
-func (s VendorService) Create(
+func (s ThirdPartyService) Create(
 	ctx context.Context,
-	req CreateVendorRequest,
-) (*coredata.Vendor, error) {
+	req CreateThirdPartyRequest,
+) (*coredata.ThirdParty, error) {
 	if err := req.Validate(); err != nil {
 		return nil, err
 	}
 
 	now := time.Now()
-	vendor := &coredata.Vendor{
-		ID:                            gid.New(s.svc.scope.GetTenantID(), coredata.VendorEntityType),
+	thirdParty := &coredata.ThirdParty{
+		ID:                            gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyEntityType),
 		Name:                          req.Name,
 		CreatedAt:                     now,
 		UpdatedAt:                     now,
@@ -584,14 +584,14 @@ func (s VendorService) Create(
 				return fmt.Errorf("cannot load organization %q: %w", req.OrganizationID, err)
 			}
 
-			vendor.OrganizationID = organization.ID
+			thirdParty.OrganizationID = organization.ID
 
 			if req.BusinessOwnerID != nil {
 				businessOwner := &coredata.MembershipProfile{}
 				if err := businessOwner.LoadByID(ctx, conn, s.svc.scope, *req.BusinessOwnerID); err != nil {
 					return fmt.Errorf("cannot load business owner profile: %w", err)
 				}
-				vendor.BusinessOwnerID = &businessOwner.ID
+				thirdParty.BusinessOwnerID = &businessOwner.ID
 			}
 
 			if req.SecurityOwnerID != nil {
@@ -599,17 +599,17 @@ func (s VendorService) Create(
 				if err := securityOwner.LoadByID(ctx, conn, s.svc.scope, *req.SecurityOwnerID); err != nil {
 					return fmt.Errorf("cannot load security owner profile: %w", err)
 				}
-				vendor.SecurityOwnerID = &securityOwner.ID
+				thirdParty.SecurityOwnerID = &securityOwner.ID
 			}
 
 			if req.Category != nil {
-				vendor.Category = *req.Category
+				thirdParty.Category = *req.Category
 			} else {
-				vendor.Category = coredata.VendorCategoryOther
+				thirdParty.Category = coredata.ThirdPartyCategoryOther
 			}
 
-			if err := vendor.Insert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert vendor: %w", err)
+			if err := thirdParty.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert thirdParty: %w", err)
 			}
 
 			if err := webhook.InsertData(
@@ -617,8 +617,8 @@ func (s VendorService) Create(
 				conn,
 				s.svc.scope,
 				organization.ID,
-				coredata.WebhookEventTypeVendorCreated,
-				webhooktypes.NewVendor(vendor),
+				coredata.WebhookEventTypeThirdPartyCreated,
+				webhooktypes.NewThirdParty(thirdParty),
 			); err != nil {
 				return fmt.Errorf("cannot insert webhook event: %w", err)
 			}
@@ -631,10 +631,10 @@ func (s VendorService) Create(
 		return nil, err
 	}
 
-	return vendor, nil
+	return thirdParty, nil
 }
 
-func (s VendorService) CountForAssetID(
+func (s ThirdPartyService) CountForAssetID(
 	ctx context.Context,
 	assetID gid.GID,
 ) (int, error) {
@@ -643,10 +643,10 @@ func (s VendorService) CountForAssetID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) (err error) {
-			vendors := coredata.Vendors{}
-			count, err = vendors.CountByAssetID(ctx, conn, s.svc.scope, assetID)
+			thirdParties := coredata.ThirdParties{}
+			count, err = thirdParties.CountByAssetID(ctx, conn, s.svc.scope, assetID)
 			if err != nil {
-				return fmt.Errorf("cannot count vendors: %w", err)
+				return fmt.Errorf("cannot count thirdParties: %w", err)
 			}
 
 			return nil
@@ -660,17 +660,17 @@ func (s VendorService) CountForAssetID(
 	return count, nil
 }
 
-func (s VendorService) ListForAssetID(
+func (s ThirdPartyService) ListForAssetID(
 	ctx context.Context,
 	assetID gid.GID,
-	cursor *page.Cursor[coredata.VendorOrderField],
-) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
-	var vendors coredata.Vendors
+	cursor *page.Cursor[coredata.ThirdPartyOrderField],
+) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
+	var thirdParties coredata.ThirdParties
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendors.LoadByAssetID(ctx, conn, s.svc.scope, assetID, cursor)
+			return thirdParties.LoadByAssetID(ctx, conn, s.svc.scope, assetID, cursor)
 		},
 	)
 
@@ -678,22 +678,22 @@ func (s VendorService) ListForAssetID(
 		return nil, err
 	}
 
-	return page.NewPage(vendors, cursor), nil
+	return page.NewPage(thirdParties, cursor), nil
 }
 
-func (s VendorService) ListForProcessingActivityID(
+func (s ThirdPartyService) ListForProcessingActivityID(
 	ctx context.Context,
 	processingActivityID gid.GID,
-	cursor *page.Cursor[coredata.VendorOrderField],
-) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
-	var vendors coredata.Vendors
+	cursor *page.Cursor[coredata.ThirdPartyOrderField],
+) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
+	var thirdParties coredata.ThirdParties
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := vendors.LoadByProcessingActivityID(ctx, conn, s.svc.scope, processingActivityID, cursor)
+			err := thirdParties.LoadByProcessingActivityID(ctx, conn, s.svc.scope, processingActivityID, cursor)
 			if err != nil {
-				return fmt.Errorf("cannot load vendors by processing activity: %w", err)
+				return fmt.Errorf("cannot load thirdParties by processing activity: %w", err)
 			}
 
 			return nil
@@ -704,20 +704,20 @@ func (s VendorService) ListForProcessingActivityID(
 		return nil, err
 	}
 
-	return page.NewPage(vendors, cursor), nil
+	return page.NewPage(thirdParties, cursor), nil
 }
 
-func (s VendorService) ListRiskAssessments(
+func (s ThirdPartyService) ListRiskAssessments(
 	ctx context.Context,
-	vendorID gid.GID,
-	cursor *page.Cursor[coredata.VendorRiskAssessmentOrderField],
-) (*page.Page[*coredata.VendorRiskAssessment, coredata.VendorRiskAssessmentOrderField], error) {
-	var vendorRiskAssessments coredata.VendorRiskAssessments
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[coredata.ThirdPartyRiskAssessmentOrderField],
+) (*page.Page[*coredata.ThirdPartyRiskAssessment, coredata.ThirdPartyRiskAssessmentOrderField], error) {
+	var thirdPartyRiskAssessments coredata.ThirdPartyRiskAssessments
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendorRiskAssessments.LoadByVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
+			return thirdPartyRiskAssessments.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID, cursor)
 		},
 	)
 
@@ -725,24 +725,24 @@ func (s VendorService) ListRiskAssessments(
 		return nil, err
 	}
 
-	return page.NewPage(vendorRiskAssessments, cursor), nil
+	return page.NewPage(thirdPartyRiskAssessments, cursor), nil
 }
 
-func (s VendorService) CreateRiskAssessment(
+func (s ThirdPartyService) CreateRiskAssessment(
 	ctx context.Context,
-	req CreateVendorRiskAssessmentRequest,
-) (*coredata.VendorRiskAssessment, error) {
+	req CreateThirdPartyRiskAssessmentRequest,
+) (*coredata.ThirdPartyRiskAssessment, error) {
 	if err := req.Validate(); err != nil {
 		return nil, err
 	}
 
-	vendorRiskAssessmentID := gid.New(s.svc.scope.GetTenantID(), coredata.VendorRiskAssessmentEntityType)
+	thirdPartyRiskAssessmentID := gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyRiskAssessmentEntityType)
 
 	now := time.Now()
 
-	vendorRiskAssessment := &coredata.VendorRiskAssessment{
-		ID:              vendorRiskAssessmentID,
-		VendorID:        req.VendorID,
+	thirdPartyRiskAssessment := &coredata.ThirdPartyRiskAssessment{
+		ID:              thirdPartyRiskAssessmentID,
+		ThirdPartyID:    req.ThirdPartyID,
 		ExpiresAt:       req.ExpiresAt,
 		DataSensitivity: req.DataSensitivity,
 		BusinessImpact:  req.BusinessImpact,
@@ -758,19 +758,19 @@ func (s VendorService) CreateRiskAssessment(
 	err := s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, tx pg.Tx) error {
-			vendor := coredata.Vendor{}
-			if err := vendor.LoadByID(ctx, tx, s.svc.scope, req.VendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
+			thirdParty := coredata.ThirdParty{}
+			if err := thirdParty.LoadByID(ctx, tx, s.svc.scope, req.ThirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
 
-			vendorRiskAssessment.OrganizationID = vendor.OrganizationID
+			thirdPartyRiskAssessment.OrganizationID = thirdParty.OrganizationID
 
-			if err := vendor.ExpireNonExpiredRiskAssessments(ctx, tx, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot expire vendor risk assessments: %w", err)
+			if err := thirdParty.ExpireNonExpiredRiskAssessments(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot expire thirdParty risk assessments: %w", err)
 			}
 
-			if err := vendorRiskAssessment.Insert(ctx, tx, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert vendor risk assessment: %w", err)
+			if err := thirdPartyRiskAssessment.Insert(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert thirdParty risk assessment: %w", err)
 			}
 			return nil
 		},
@@ -780,19 +780,19 @@ func (s VendorService) CreateRiskAssessment(
 		return nil, err
 	}
 
-	return vendorRiskAssessment, nil
+	return thirdPartyRiskAssessment, nil
 }
 
-func (s VendorService) GetRiskAssessment(
+func (s ThirdPartyService) GetRiskAssessment(
 	ctx context.Context,
-	vendorRiskAssessmentID gid.GID,
-) (*coredata.VendorRiskAssessment, error) {
-	vendorRiskAssessment := &coredata.VendorRiskAssessment{}
+	thirdPartyRiskAssessmentID gid.GID,
+) (*coredata.ThirdPartyRiskAssessment, error) {
+	thirdPartyRiskAssessment := &coredata.ThirdPartyRiskAssessment{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return vendorRiskAssessment.LoadByID(ctx, conn, s.svc.scope, vendorRiskAssessmentID)
+			return thirdPartyRiskAssessment.LoadByID(ctx, conn, s.svc.scope, thirdPartyRiskAssessmentID)
 		},
 	)
 
@@ -800,25 +800,25 @@ func (s VendorService) GetRiskAssessment(
 		return nil, err
 	}
 
-	return vendorRiskAssessment, nil
+	return thirdPartyRiskAssessment, nil
 }
 
-func (s VendorService) GetByRiskAssessmentID(
+func (s ThirdPartyService) GetByRiskAssessmentID(
 	ctx context.Context,
-	vendorRiskAssessmentID gid.GID,
-) (*coredata.Vendor, error) {
-	vendor := &coredata.Vendor{}
+	thirdPartyRiskAssessmentID gid.GID,
+) (*coredata.ThirdParty, error) {
+	thirdParty := &coredata.ThirdParty{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			vendorRiskAssessment := &coredata.VendorRiskAssessment{}
-			if err := vendorRiskAssessment.LoadByID(ctx, conn, s.svc.scope, vendorRiskAssessmentID); err != nil {
-				return fmt.Errorf("cannot load vendor risk assessment: %w", err)
+			thirdPartyRiskAssessment := &coredata.ThirdPartyRiskAssessment{}
+			if err := thirdPartyRiskAssessment.LoadByID(ctx, conn, s.svc.scope, thirdPartyRiskAssessmentID); err != nil {
+				return fmt.Errorf("cannot load thirdParty risk assessment: %w", err)
 			}
 
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorRiskAssessment.VendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyRiskAssessment.ThirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
 
 			return nil
@@ -829,91 +829,91 @@ func (s VendorService) GetByRiskAssessmentID(
 		return nil, err
 	}
 
-	return vendor, nil
+	return thirdParty, nil
 }
 
-func (s VendorService) Assess(
+func (s ThirdPartyService) Assess(
 	ctx context.Context,
-	req AssessVendorRequest,
-) (*AssessVendorResult, error) {
-	result, err := s.svc.vendorAssessor.Assess(ctx, req.WebsiteURL, ref.UnrefOrZero(req.Procedure), nil)
+	req AssessThirdPartyRequest,
+) (*AssessThirdPartyResult, error) {
+	result, err := s.svc.thirdPartyAssessor.Assess(ctx, req.WebsiteURL, ref.UnrefOrZero(req.Procedure), nil)
 	if err != nil {
-		return nil, fmt.Errorf("cannot assess vendor: %w", err)
+		return nil, fmt.Errorf("cannot assess thirdParty: %w", err)
 	}
 
-	vendor := &coredata.Vendor{}
+	thirdParty := &coredata.ThirdParty{}
 
 	err = s.svc.pg.WithTx(
 		ctx,
 		func(ctx context.Context, conn pg.Tx) error {
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
-				return fmt.Errorf("cannot load vendor %q: %w", req.ID, err)
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load thirdParty %q: %w", req.ID, err)
 			}
 
 			info := result.Info
 
 			if info.Name != "" {
-				vendor.Name = info.Name
+				thirdParty.Name = info.Name
 			}
 
-			vendor.WebsiteURL = &req.WebsiteURL
+			thirdParty.WebsiteURL = &req.WebsiteURL
 			if info.Category != "" {
-				vendor.Category = coredata.VendorCategory(info.Category)
+				thirdParty.Category = coredata.ThirdPartyCategory(info.Category)
 			}
-			vendor.UpdatedAt = time.Now()
+			thirdParty.UpdatedAt = time.Now()
 
 			if info.Description != "" {
-				vendor.Description = &info.Description
+				thirdParty.Description = &info.Description
 			}
 			if info.HeadquarterAddress != "" {
-				vendor.HeadquarterAddress = &info.HeadquarterAddress
+				thirdParty.HeadquarterAddress = &info.HeadquarterAddress
 			}
 			if info.LegalName != "" {
-				vendor.LegalName = &info.LegalName
+				thirdParty.LegalName = &info.LegalName
 			}
 			if info.PrivacyPolicyURL != "" {
-				vendor.PrivacyPolicyURL = &info.PrivacyPolicyURL
+				thirdParty.PrivacyPolicyURL = &info.PrivacyPolicyURL
 			}
 			if info.ServiceLevelAgreementURL != "" {
-				vendor.ServiceLevelAgreementURL = &info.ServiceLevelAgreementURL
+				thirdParty.ServiceLevelAgreementURL = &info.ServiceLevelAgreementURL
 			}
 			if info.DataProcessingAgreementURL != "" {
-				vendor.DataProcessingAgreementURL = &info.DataProcessingAgreementURL
+				thirdParty.DataProcessingAgreementURL = &info.DataProcessingAgreementURL
 			}
 			if info.BusinessAssociateAgreementURL != "" {
-				vendor.BusinessAssociateAgreementURL = &info.BusinessAssociateAgreementURL
+				thirdParty.BusinessAssociateAgreementURL = &info.BusinessAssociateAgreementURL
 			}
 			if info.SubprocessorsListURL != "" {
-				vendor.SubprocessorsListURL = &info.SubprocessorsListURL
+				thirdParty.SubprocessorsListURL = &info.SubprocessorsListURL
 			}
 			if info.SecurityPageURL != "" {
-				vendor.SecurityPageURL = &info.SecurityPageURL
+				thirdParty.SecurityPageURL = &info.SecurityPageURL
 			}
 			if info.TrustPageURL != "" {
-				vendor.TrustPageURL = &info.TrustPageURL
+				thirdParty.TrustPageURL = &info.TrustPageURL
 			}
 			if info.TermsOfServiceURL != "" {
-				vendor.TermsOfServiceURL = &info.TermsOfServiceURL
+				thirdParty.TermsOfServiceURL = &info.TermsOfServiceURL
 			}
 			if info.StatusPageURL != "" {
-				vendor.StatusPageURL = &info.StatusPageURL
+				thirdParty.StatusPageURL = &info.StatusPageURL
 			}
 
 			if len(info.Certifications) > 0 {
-				vendor.Certifications = info.Certifications
+				thirdParty.Certifications = info.Certifications
 			}
 
-			if err := vendor.Update(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot update vendor: %w", err)
+			if err := thirdParty.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update thirdParty: %w", err)
 			}
 
 			if err := webhook.InsertData(
 				ctx,
 				conn,
 				s.svc.scope,
-				vendor.OrganizationID,
-				coredata.WebhookEventTypeVendorUpdated,
-				webhooktypes.NewVendor(vendor),
+				thirdParty.OrganizationID,
+				coredata.WebhookEventTypeThirdPartyUpdated,
+				webhooktypes.NewThirdParty(thirdParty),
 			); err != nil {
 				return fmt.Errorf("cannot insert webhook event: %w", err)
 			}
@@ -934,8 +934,8 @@ func (s VendorService) Assess(
 		}
 	}
 
-	return &AssessVendorResult{
-		Vendor:        vendor,
+	return &AssessThirdPartyResult{
+		ThirdParty:    thirdParty,
 		Report:        result.Document,
 		Subprocessors: subprocessors,
 	}, nil

pkg/probo/third_party_service_service.go

@@ -0,0 +1,221 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+type (
+	ThirdPartyServiceService struct {
+		svc *TenantService
+	}
+
+	CreateThirdPartyServiceRequest struct {
+		ThirdPartyID gid.GID
+		Name         string
+		Description  *string
+	}
+
+	UpdateThirdPartyServiceRequest struct {
+		ID          gid.GID
+		Name        *string
+		Description **string
+	}
+)
+
+func (cvsr *CreateThirdPartyServiceRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(cvsr.ThirdPartyID, "third_party_id", validator.Required(), validator.GID(coredata.ThirdPartyEntityType))
+	v.Check(cvsr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(cvsr.Description, "description", validator.SafeText(ContentMaxLength))
+
+	return v.Error()
+}
+
+func (uvsr *UpdateThirdPartyServiceRequest) Validate() error {
+	v := validator.New()
+
+	v.Check(uvsr.ID, "id", validator.Required(), validator.GID(coredata.ThirdPartyServiceEntityType))
+	v.Check(uvsr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
+	v.Check(uvsr.Description, "description", validator.SafeText(ContentMaxLength))
+
+	return v.Error()
+}
+
+func (s ThirdPartyServiceService) Get(
+	ctx context.Context,
+	thirdPartyServiceID gid.GID,
+) (*coredata.ThirdPartyService, error) {
+	thirdPartyService := &coredata.ThirdPartyService{}
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := thirdPartyService.LoadByID(ctx, conn, s.svc.scope, thirdPartyServiceID)
+			if err != nil {
+				return fmt.Errorf("cannot load thirdParty service: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return thirdPartyService, nil
+}
+
+func (s ThirdPartyServiceService) List(
+	ctx context.Context,
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[coredata.ThirdPartyServiceOrderField],
+) (*page.Page[*coredata.ThirdPartyService, coredata.ThirdPartyServiceOrderField], error) {
+	var thirdPartyServices coredata.ThirdPartyServices
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(ctx context.Context, conn pg.Querier) error {
+			err := thirdPartyServices.LoadByThirdPartyID(ctx, conn, s.svc.scope, thirdPartyID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load thirdParty services: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(thirdPartyServices, cursor), nil
+}
+
+func (s ThirdPartyServiceService) Create(
+	ctx context.Context,
+	req CreateThirdPartyServiceRequest,
+) (*coredata.ThirdPartyService, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	now := time.Now()
+	thirdPartyService := &coredata.ThirdPartyService{
+		ID:           gid.New(s.svc.scope.GetTenantID(), coredata.ThirdPartyServiceEntityType),
+		ThirdPartyID: req.ThirdPartyID,
+		Name:         req.Name,
+		Description:  req.Description,
+		CreatedAt:    now,
+		UpdatedAt:    now,
+	}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, conn pg.Tx) error {
+			thirdParty := &coredata.ThirdParty{}
+			if err := thirdParty.LoadByID(ctx, conn, s.svc.scope, req.ThirdPartyID); err != nil {
+				return fmt.Errorf("cannot load thirdParty: %w", err)
+			}
+
+			thirdPartyService.OrganizationID = thirdParty.OrganizationID
+
+			if err := thirdPartyService.Insert(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert thirdParty service: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return thirdPartyService, nil
+}
+
+func (s ThirdPartyServiceService) Update(
+	ctx context.Context,
+	req UpdateThirdPartyServiceRequest,
+) (*coredata.ThirdPartyService, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	thirdPartyService := &coredata.ThirdPartyService{}
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, conn pg.Tx) error {
+			err := thirdPartyService.LoadByID(ctx, conn, s.svc.scope, req.ID)
+			if err != nil {
+				return fmt.Errorf("cannot load thirdParty service: %w", err)
+			}
+
+			if req.Name != nil {
+				thirdPartyService.Name = *req.Name
+			}
+			if req.Description != nil {
+				thirdPartyService.Description = *req.Description
+			}
+			thirdPartyService.UpdatedAt = time.Now()
+
+			if err := thirdPartyService.Update(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update thirdParty service: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return thirdPartyService, nil
+}
+
+func (s ThirdPartyServiceService) Delete(
+	ctx context.Context,
+	thirdPartyServiceID gid.GID,
+) error {
+	thirdPartyService := coredata.ThirdPartyService{ID: thirdPartyServiceID}
+	return s.svc.pg.WithTx(
+		ctx,
+		func(ctx context.Context, conn pg.Tx) error {
+			if err := thirdPartyService.LoadByID(ctx, conn, s.svc.scope, thirdPartyServiceID); err != nil {
+				return fmt.Errorf("cannot load thirdParty service: %w", err)
+			}
+
+			if err := thirdPartyService.Delete(ctx, conn, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete thirdParty service: %w", err)
+			}
+
+			return nil
+		},
+	)
+}

pkg/probo/vendor_contact_service.go

@@ -1,232 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package probo
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"go.gearno.de/kit/pg"
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/mail"
-	"go.probo.inc/probo/pkg/page"
-	"go.probo.inc/probo/pkg/validator"
-)
-
-type (
-	VendorContactService struct {
-		svc *TenantService
-	}
-
-	CreateVendorContactRequest struct {
-		VendorID gid.GID
-		FullName *string
-		Email    *mail.Addr
-		Phone    *string
-		Role     *string
-	}
-
-	UpdateVendorContactRequest struct {
-		ID       gid.GID
-		FullName **string
-		Email    **mail.Addr
-		Phone    **string
-		Role     **string
-	}
-)
-
-func (cvcr *CreateVendorContactRequest) Validate() error {
-	v := validator.New()
-
-	v.Check(cvcr.VendorID, "vendor_id", validator.Required(), validator.GID(coredata.VendorEntityType))
-	v.Check(cvcr.FullName, "fullName", validator.SafeTextNoNewLine(TitleMaxLength))
-	v.Check(cvcr.Phone, "phone", validator.SafeText(NameMaxLength))
-	v.Check(cvcr.Role, "role", validator.SafeText(TitleMaxLength))
-
-	return v.Error()
-}
-
-func (uvcr *UpdateVendorContactRequest) Validate() error {
-	v := validator.New()
-
-	v.Check(uvcr.ID, "id", validator.Required(), validator.GID(coredata.VendorContactEntityType))
-	v.Check(uvcr.FullName, "fullName", validator.SafeTextNoNewLine(TitleMaxLength))
-	v.Check(uvcr.Phone, "phone", validator.SafeText(NameMaxLength))
-	v.Check(uvcr.Role, "role", validator.SafeText(TitleMaxLength))
-
-	return v.Error()
-}
-
-func (s VendorContactService) Get(
-	ctx context.Context,
-	vendorContactID gid.GID,
-) (*coredata.VendorContact, error) {
-	vendorContact := &coredata.VendorContact{}
-
-	err := s.svc.pg.WithConn(
-		ctx,
-		func(ctx context.Context, conn pg.Querier) error {
-			err := vendorContact.LoadByID(ctx, conn, s.svc.scope, vendorContactID)
-			if err != nil {
-				return fmt.Errorf("cannot load vendor contact: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return vendorContact, nil
-}
-
-func (s VendorContactService) List(
-	ctx context.Context,
-	vendorID gid.GID,
-	cursor *page.Cursor[coredata.VendorContactOrderField],
-) (*page.Page[*coredata.VendorContact, coredata.VendorContactOrderField], error) {
-	var vendorContacts coredata.VendorContacts
-
-	err := s.svc.pg.WithConn(
-		ctx,
-		func(ctx context.Context, conn pg.Querier) error {
-			err := vendorContacts.LoadByVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
-			if err != nil {
-				return fmt.Errorf("cannot load vendor contacts: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return page.NewPage(vendorContacts, cursor), nil
-}
-
-func (s VendorContactService) Create(
-	ctx context.Context,
-	req CreateVendorContactRequest,
-) (*coredata.VendorContact, error) {
-	if err := req.Validate(); err != nil {
-		return nil, err
-	}
-
-	now := time.Now()
-	vendorContact := &coredata.VendorContact{
-		ID:        gid.New(s.svc.scope.GetTenantID(), coredata.VendorContactEntityType),
-		VendorID:  req.VendorID,
-		FullName:  req.FullName,
-		Email:     req.Email,
-		Phone:     req.Phone,
-		Role:      req.Role,
-		CreatedAt: now,
-		UpdatedAt: now,
-	}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(ctx context.Context, conn pg.Tx) error {
-			vendor := &coredata.Vendor{}
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, req.VendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
-			}
-
-			vendorContact.OrganizationID = vendor.OrganizationID
-
-			if err := vendorContact.Insert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert vendor contact: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return vendorContact, nil
-}
-
-func (s VendorContactService) Update(
-	ctx context.Context,
-	req UpdateVendorContactRequest,
-) (*coredata.VendorContact, error) {
-	if err := req.Validate(); err != nil {
-		return nil, err
-	}
-
-	vendorContact := &coredata.VendorContact{}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(ctx context.Context, conn pg.Tx) error {
-			err := vendorContact.LoadByID(ctx, conn, s.svc.scope, req.ID)
-			if err != nil {
-				return fmt.Errorf("cannot load vendor contact: %w", err)
-			}
-
-			if req.FullName != nil {
-				vendorContact.FullName = *req.FullName
-			}
-			if req.Email != nil {
-				vendorContact.Email = *req.Email
-			}
-			if req.Phone != nil {
-				vendorContact.Phone = *req.Phone
-			}
-			if req.Role != nil {
-				vendorContact.Role = *req.Role
-			}
-			vendorContact.UpdatedAt = time.Now()
-
-			return vendorContact.Update(ctx, conn, s.svc.scope)
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return vendorContact, nil
-}
-
-func (s VendorContactService) Delete(
-	ctx context.Context,
-	vendorContactID gid.GID,
-) error {
-	vendorContact := coredata.VendorContact{ID: vendorContactID}
-	return s.svc.pg.WithTx(
-		ctx,
-		func(ctx context.Context, conn pg.Tx) error {
-			if err := vendorContact.LoadByID(ctx, conn, s.svc.scope, vendorContactID); err != nil {
-				return fmt.Errorf("cannot load vendor contact: %w", err)
-			}
-
-			if err := vendorContact.Delete(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot delete vendor contact: %w", err)
-			}
-
-			return nil
-		},
-	)
-}

pkg/probo/vendor_service_service.go

@@ -1,221 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package probo
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	"go.gearno.de/kit/pg"
-	"go.probo.inc/probo/pkg/coredata"
-	"go.probo.inc/probo/pkg/gid"
-	"go.probo.inc/probo/pkg/page"
-	"go.probo.inc/probo/pkg/validator"
-)
-
-type (
-	VendorServiceService struct {
-		svc *TenantService
-	}
-
-	CreateVendorServiceRequest struct {
-		VendorID    gid.GID
-		Name        string
-		Description *string
-	}
-
-	UpdateVendorServiceRequest struct {
-		ID          gid.GID
-		Name        *string
-		Description **string
-	}
-)
-
-func (cvsr *CreateVendorServiceRequest) Validate() error {
-	v := validator.New()
-
-	v.Check(cvsr.VendorID, "vendor_id", validator.Required(), validator.GID(coredata.VendorEntityType))
-	v.Check(cvsr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
-	v.Check(cvsr.Description, "description", validator.SafeText(ContentMaxLength))
-
-	return v.Error()
-}
-
-func (uvsr *UpdateVendorServiceRequest) Validate() error {
-	v := validator.New()
-
-	v.Check(uvsr.ID, "id", validator.Required(), validator.GID(coredata.VendorServiceEntityType))
-	v.Check(uvsr.Name, "name", validator.SafeTextNoNewLine(TitleMaxLength))
-	v.Check(uvsr.Description, "description", validator.SafeText(ContentMaxLength))
-
-	return v.Error()
-}
-
-func (s VendorServiceService) Get(
-	ctx context.Context,
-	vendorServiceID gid.GID,
-) (*coredata.VendorService, error) {
-	vendorService := &coredata.VendorService{}
-
-	err := s.svc.pg.WithConn(
-		ctx,
-		func(ctx context.Context, conn pg.Querier) error {
-			err := vendorService.LoadByID(ctx, conn, s.svc.scope, vendorServiceID)
-			if err != nil {
-				return fmt.Errorf("cannot load vendor service: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return vendorService, nil
-}
-
-func (s VendorServiceService) List(
-	ctx context.Context,
-	vendorID gid.GID,
-	cursor *page.Cursor[coredata.VendorServiceOrderField],
-) (*page.Page[*coredata.VendorService, coredata.VendorServiceOrderField], error) {
-	var vendorServices coredata.VendorServices
-
-	err := s.svc.pg.WithConn(
-		ctx,
-		func(ctx context.Context, conn pg.Querier) error {
-			err := vendorServices.LoadByVendorID(ctx, conn, s.svc.scope, vendorID, cursor)
-			if err != nil {
-				return fmt.Errorf("cannot load vendor services: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return page.NewPage(vendorServices, cursor), nil
-}
-
-func (s VendorServiceService) Create(
-	ctx context.Context,
-	req CreateVendorServiceRequest,
-) (*coredata.VendorService, error) {
-	if err := req.Validate(); err != nil {
-		return nil, err
-	}
-
-	now := time.Now()
-	vendorService := &coredata.VendorService{
-		ID:          gid.New(s.svc.scope.GetTenantID(), coredata.VendorServiceEntityType),
-		VendorID:    req.VendorID,
-		Name:        req.Name,
-		Description: req.Description,
-		CreatedAt:   now,
-		UpdatedAt:   now,
-	}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(ctx context.Context, conn pg.Tx) error {
-			vendor := &coredata.Vendor{}
-			if err := vendor.LoadByID(ctx, conn, s.svc.scope, req.VendorID); err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
-			}
-
-			vendorService.OrganizationID = vendor.OrganizationID
-
-			if err := vendorService.Insert(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot insert vendor service: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return vendorService, nil
-}
-
-func (s VendorServiceService) Update(
-	ctx context.Context,
-	req UpdateVendorServiceRequest,
-) (*coredata.VendorService, error) {
-	if err := req.Validate(); err != nil {
-		return nil, err
-	}
-
-	vendorService := &coredata.VendorService{}
-
-	err := s.svc.pg.WithTx(
-		ctx,
-		func(ctx context.Context, conn pg.Tx) error {
-			err := vendorService.LoadByID(ctx, conn, s.svc.scope, req.ID)
-			if err != nil {
-				return fmt.Errorf("cannot load vendor service: %w", err)
-			}
-
-			if req.Name != nil {
-				vendorService.Name = *req.Name
-			}
-			if req.Description != nil {
-				vendorService.Description = *req.Description
-			}
-			vendorService.UpdatedAt = time.Now()
-
-			if err := vendorService.Update(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot update vendor service: %w", err)
-			}
-
-			return nil
-		},
-	)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return vendorService, nil
-}
-
-func (s VendorServiceService) Delete(
-	ctx context.Context,
-	vendorServiceID gid.GID,
-) error {
-	vendorService := coredata.VendorService{ID: vendorServiceID}
-	return s.svc.pg.WithTx(
-		ctx,
-		func(ctx context.Context, conn pg.Tx) error {
-			if err := vendorService.LoadByID(ctx, conn, s.svc.scope, vendorServiceID); err != nil {
-				return fmt.Errorf("cannot load vendor service: %w", err)
-			}
-
-			if err := vendorService.Delete(ctx, conn, s.svc.scope); err != nil {
-				return fmt.Errorf("cannot delete vendor service: %w", err)
-			}
-
-			return nil
-		},
-	)
-}

pkg/probod/probod.go

@@ -299,7 +299,7 @@ func (impl *Implm) Run(
 		return err
 	}
 
-	vendorAssessor, err := impl.buildVendorAssessor(l, tp, r)
+	thirdPartyAssessor, err := impl.buildThirdPartyAssessor(l, tp, r)
 	if err != nil {
 		return err
 	}
@@ -491,7 +491,7 @@ func (impl *Implm) Run(
 		esignService,
 		defaultConnectorRegistry,
 		time.Duration(impl.cfg.Auth.InvitationConfirmationTokenValidity)*time.Second,
-		vendorAssessor,
+		thirdPartyAssessor,
 	)
 	if err != nil {
 		return fmt.Errorf("cannot create probo service: %w", err)

pkg/probod/third_party_assessor.go

@@ -22,22 +22,22 @@ import (
 	"go.probo.inc/probo/pkg/vetting"
 )
 
-// buildVendorAssessor wires the vendor assessment agent. It is an opt-in
-// feature: deployments that do not set `llm.vendor-assessor.provider` get a
-// DisabledVendorAssessor that reports the feature as unavailable. The
-// vendor-assessor does not inherit the default provider because its
+// buildThirdPartyAssessor wires the thirdParty assessment agent. It is an opt-in
+// feature: deployments that do not set `llm.third-party-assessor.provider` get a
+// DisabledThirdPartyAssessor that reports the feature as unavailable. The
+// third-party-assessor does not inherit the default provider because its
 // pipeline (LLM + browser + search) is expensive and should not be enabled
 // implicitly.
-func (impl *Implm) buildVendorAssessor(
+func (impl *Implm) buildThirdPartyAssessor(
 	l *log.Logger,
 	tp trace.TracerProvider,
 	r prometheus.Registerer,
-) (probo.VendorAssessor, error) {
-	if impl.cfg.Agents.VendorAssessor.Provider == "" {
-		return probo.DisabledVendorAssessor{}, nil
+) (probo.ThirdPartyAssessor, error) {
+	if impl.cfg.Agents.ThirdPartyAssessor.Provider == "" {
+		return probo.DisabledThirdPartyAssessor{}, nil
 	}
 
-	agentCfg, llmClient, err := impl.resolveAgentClient("vendor-assessor", impl.cfg.Agents.VendorAssessor, l, tp, r)
+	agentCfg, llmClient, err := impl.resolveAgentClient("third-party-assessor", impl.cfg.Agents.ThirdPartyAssessor, l, tp, r)
 	if err != nil {
 		return nil, err
 	}
@@ -53,6 +53,6 @@ func (impl *Implm) buildVendorAssessor(
 		MaxTokens:      maxTokens,
 		ChromeAddr:     impl.cfg.ChromeDPAddr,
 		SearchEndpoint: impl.cfg.SearchEndpoint,
-		Logger:         l.Named("vendor-assessor"),
+		Logger:         l.Named("third-party-assessor"),
 	}), nil
 }

pkg/probodconfig/llm_config.go

@@ -44,11 +44,11 @@ type (
 	// settings. Default is used as a fallback when an agent-specific field
 	// is zero-valued.
 	AgentsConfig struct {
-		Providers         map[string]LLMProviderConfig `json:"providers"`
-		Default           LLMAgentConfig               `json:"defaults"`
-		Probo             LLMAgentConfig               `json:"probo"`
-		EvidenceDescriber LLMAgentConfig               `json:"evidence-describer"`
-		VendorAssessor    LLMAgentConfig               `json:"vendor-assessor"`
+		Providers          map[string]LLMProviderConfig `json:"providers"`
+		Default            LLMAgentConfig               `json:"defaults"`
+		Probo              LLMAgentConfig               `json:"probo"`
+		EvidenceDescriber  LLMAgentConfig               `json:"evidence-describer"`
+		ThirdPartyAssessor LLMAgentConfig               `json:"third-party-assessor"`
 	}
 )
 

pkg/server/api/console/v1/asset_resolvers.go

@@ -44,20 +44,20 @@ func (r *assetResolver) Owner(ctx context.Context, obj *types.Asset) (*types.Pro
 	return types.NewProfile(owner), nil
 }
 
-// Vendors is the resolver for the vendors field.
-func (r *assetResolver) Vendors(ctx context.Context, obj *types.Asset, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorOrderBy) (*types.VendorConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionVendorList); err != nil {
+// ThirdParties is the resolver for the thirdParties field.
+func (r *assetResolver) ThirdParties(ctx context.Context, obj *types.Asset, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
-		Field:     coredata.VendorOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
 			Field:     orderBy.Field,
 			Direction: orderBy.Direction,
 		}
@@ -65,13 +65,13 @@ func (r *assetResolver) Vendors(ctx context.Context, obj *types.Asset, first *in
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	page, err := prb.Vendors.ListForAssetID(ctx, obj.ID, cursor)
+	page, err := prb.ThirdParties.ListForAssetID(ctx, obj.ID, cursor)
 	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list asset vendors", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot list asset thirdParties", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewVendorConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID), nil
 }
 
 // Organization is the resolver for the organization field.
@@ -149,20 +149,20 @@ func (r *datumResolver) Owner(ctx context.Context, obj *types.Datum) (*types.Pro
 	return types.NewProfile(owner), nil
 }
 
-// Vendors is the resolver for the vendors field.
-func (r *datumResolver) Vendors(ctx context.Context, obj *types.Datum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorOrderBy) (*types.VendorConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionVendorList); err != nil {
+// ThirdParties is the resolver for the thirdParties field.
+func (r *datumResolver) ThirdParties(ctx context.Context, obj *types.Datum, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
-		Field:     coredata.VendorOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
 			Field:     orderBy.Field,
 			Direction: orderBy.Direction,
 		}
@@ -170,13 +170,13 @@ func (r *datumResolver) Vendors(ctx context.Context, obj *types.Datum, first *in
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	page, err := prb.Data.ListVendors(ctx, obj.ID, cursor)
+	page, err := prb.Data.ListThirdParties(ctx, obj.ID, cursor)
 	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list data vendors", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot list data thirdParties", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewVendorConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID), nil
 }
 
 // Organization is the resolver for the organization field.
@@ -244,7 +244,7 @@ func (r *mutationResolver) CreateAsset(ctx context.Context, input types.CreateAs
 			OwnerID:         input.OwnerID,
 			AssetType:       input.AssetType,
 			DataTypesStored: input.DataTypesStored,
-			VendorIDs:       input.VendorIds,
+			ThirdPartyIDs:   input.ThirdPartyIds,
 		},
 	)
 
@@ -278,7 +278,7 @@ func (r *mutationResolver) UpdateAsset(ctx context.Context, input types.UpdateAs
 			OwnerID:         input.OwnerID,
 			AssetType:       input.AssetType,
 			DataTypesStored: input.DataTypesStored,
-			VendorIDs:       input.VendorIds,
+			ThirdPartyIDs:   input.ThirdPartyIds,
 		},
 	)
 	if err != nil {
@@ -328,7 +328,7 @@ func (r *mutationResolver) CreateDatum(ctx context.Context, input types.CreateDa
 			Name:               input.Name,
 			DataClassification: input.DataClassification,
 			OwnerID:            input.OwnerID,
-			VendorIDs:          input.VendorIds,
+			ThirdPartyIDs:      input.ThirdPartyIds,
 		},
 	)
 
@@ -360,7 +360,7 @@ func (r *mutationResolver) UpdateDatum(ctx context.Context, input types.UpdateDa
 			Name:               input.Name,
 			DataClassification: input.DataClassification,
 			OwnerID:            input.OwnerID,
-			VendorIDs:          input.VendorIds,
+			ThirdPartyIDs:      input.ThirdPartyIds,
 		},
 	)
 

pkg/server/api/console/v1/base_resolvers.go

@@ -39,14 +39,14 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			}
 			return types.NewOrganization(organization), nil
 		}
-	case coredata.VendorEntityType:
-		action = probo.ActionVendorGet
+	case coredata.ThirdPartyEntityType:
+		action = probo.ActionThirdPartyGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			vendor, err := prb.Vendors.Get(ctx, id)
+			thirdParty, err := prb.ThirdParties.Get(ctx, id)
 			if err != nil {
 				return nil, err
 			}
-			return types.NewVendor(vendor), nil
+			return types.NewThirdParty(thirdParty), nil
 		}
 	case coredata.FrameworkEntityType:
 		action = probo.ActionFrameworkGet
@@ -111,32 +111,32 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			}
 			return types.NewRisk(risk), nil
 		}
-	case coredata.VendorComplianceReportEntityType:
-		action = probo.ActionVendorComplianceReportGet
+	case coredata.ThirdPartyComplianceReportEntityType:
+		action = probo.ActionThirdPartyComplianceReportGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			vendorComplianceReport, err := prb.VendorComplianceReports.Get(ctx, id)
+			thirdPartyComplianceReport, err := prb.ThirdPartyComplianceReports.Get(ctx, id)
 			if err != nil {
 				return nil, err
 			}
-			return types.NewVendorComplianceReport(vendorComplianceReport), nil
+			return types.NewThirdPartyComplianceReport(thirdPartyComplianceReport), nil
 		}
-	case coredata.VendorContactEntityType:
-		action = probo.ActionVendorContactGet
+	case coredata.ThirdPartyContactEntityType:
+		action = probo.ActionThirdPartyContactGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			vendorContact, err := prb.VendorContacts.Get(ctx, id)
+			thirdPartyContact, err := prb.ThirdPartyContacts.Get(ctx, id)
 			if err != nil {
 				return nil, err
 			}
-			return types.NewVendorContact(vendorContact), nil
+			return types.NewThirdPartyContact(thirdPartyContact), nil
 		}
-	case coredata.VendorServiceEntityType:
-		action = probo.ActionVendorServiceGet
+	case coredata.ThirdPartyServiceEntityType:
+		action = probo.ActionThirdPartyServiceGet
 		loadNode = func(ctx context.Context, id gid.GID) (types.Node, error) {
-			vendorService, err := prb.VendorServices.Get(ctx, id)
+			thirdPartyService, err := prb.ThirdPartyServices.Get(ctx, id)
 			if err != nil {
 				return nil, err
 			}
-			return types.NewVendorService(vendorService), nil
+			return types.NewThirdPartyService(thirdPartyService), nil
 		}
 	case coredata.DocumentVersionEntityType:
 		action = probo.ActionDocumentVersionList

pkg/server/api/console/v1/dataloader/dataloader.go

@@ -34,7 +34,7 @@ type (
 		Organization   *dataloadgen.Loader[gid.GID, *coredata.Organization]
 		Framework      *dataloadgen.Loader[gid.GID, *coredata.Framework]
 		Control        *dataloadgen.Loader[gid.GID, *coredata.Control]
-		Vendor         *dataloadgen.Loader[gid.GID, *coredata.Vendor]
+		ThirdParty     *dataloadgen.Loader[gid.GID, *coredata.ThirdParty]
 		Document       *dataloadgen.Loader[gid.GID, *coredata.Document]
 		Profile        *dataloadgen.Loader[gid.GID, *coredata.MembershipProfile]
 		Risk           *dataloadgen.Loader[gid.GID, *coredata.Risk]
@@ -77,7 +77,7 @@ func (f *batchFetcher) newLoaders() *Loaders {
 		Organization:   dataloadgen.NewMappedLoader(f.fetchOrganizations),
 		Framework:      dataloadgen.NewMappedLoader(f.fetchFrameworks),
 		Control:        dataloadgen.NewMappedLoader(f.fetchControls),
-		Vendor:         dataloadgen.NewMappedLoader(f.fetchVendors),
+		ThirdParty:     dataloadgen.NewMappedLoader(f.fetchThirdParties),
 		Document:       dataloadgen.NewMappedLoader(f.fetchDocuments),
 		Profile:        dataloadgen.NewMappedLoader(f.fetchProfiles),
 		Risk:           dataloadgen.NewMappedLoader(f.fetchRisks),
@@ -135,16 +135,16 @@ func (f *batchFetcher) fetchControls(ctx context.Context, keys []gid.GID) (map[g
 	return result, nil
 }
 
-func (f *batchFetcher) fetchVendors(ctx context.Context, keys []gid.GID) (map[gid.GID]*coredata.Vendor, error) {
+func (f *batchFetcher) fetchThirdParties(ctx context.Context, keys []gid.GID) (map[gid.GID]*coredata.ThirdParty, error) {
 	tenantSvc := f.probo.WithTenant(keys[0].TenantID())
 
-	vendors, err := tenantSvc.Vendors.GetByIDs(ctx, keys...)
+	thirdParties, err := tenantSvc.ThirdParties.GetByIDs(ctx, keys...)
 	if err != nil {
-		return nil, fmt.Errorf("cannot batch load vendors: %w", err)
+		return nil, fmt.Errorf("cannot batch load thirdParties: %w", err)
 	}
 
-	result := make(map[gid.GID]*coredata.Vendor, len(vendors))
-	for _, v := range vendors {
+	result := make(map[gid.GID]*coredata.ThirdParty, len(thirdParties))
+	for _, v := range thirdParties {
 		result[v.ID] = v
 	}
 	return result, nil

pkg/server/api/console/v1/graphql/asset.graphql

@@ -67,13 +67,13 @@ type Asset implements Node {
     name: String!
     amount: Int!
     owner: Profile! @goField(forceResolver: true)
-    vendors(
+    thirdParties(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
-        orderBy: VendorOrder
-    ): VendorConnection! @goField(forceResolver: true)
+        orderBy: ThirdPartyOrder
+    ): ThirdPartyConnection! @goField(forceResolver: true)
     assetType: AssetType!
     dataTypesStored: String!
     organization: Organization! @goField(forceResolver: true)
@@ -91,13 +91,13 @@ type Datum implements Node
     name: String!
     dataClassification: DataClassification!
     owner: Profile! @goField(forceResolver: true)
-    vendors(
+    thirdParties(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
-        orderBy: VendorOrder
-    ): VendorConnection! @goField(forceResolver: true)
+        orderBy: ThirdPartyOrder
+    ): ThirdPartyConnection! @goField(forceResolver: true)
     organization: Organization! @goField(forceResolver: true)
     createdAt: Datetime!
     updatedAt: Datetime!
@@ -155,7 +155,7 @@ input CreateAssetInput {
     ownerId: ID!
     assetType: AssetType!
     dataTypesStored: String!
-    vendorIds: [ID!]
+    thirdPartyIds: [ID!]
 }
 
 input UpdateAssetInput {
@@ -165,7 +165,7 @@ input UpdateAssetInput {
     ownerId: ID
     assetType: AssetType
     dataTypesStored: String
-    vendorIds: [ID!]
+    thirdPartyIds: [ID!]
 }
 
 input DeleteAssetInput {
@@ -177,7 +177,7 @@ input CreateDatumInput {
     name: String!
     dataClassification: DataClassification!
     ownerId: ID!
-    vendorIds: [ID!]
+    thirdPartyIds: [ID!]
 }
 
 input UpdateDatumInput {
@@ -185,7 +185,7 @@ input UpdateDatumInput {
     name: String
     dataClassification: DataClassification
     ownerId: ID
-    vendorIds: [ID!]
+    thirdPartyIds: [ID!]
 }
 
 input DeleteDatumInput {

pkg/server/api/console/v1/graphql/common_third_party.graphql

@@ -18,7 +18,7 @@ type CommonThirdParty
     ) {
     id: ID!
     name: String!
-    category: VendorCategory!
+    category: ThirdPartyCategory!
     websiteUrl: String
     headquarterAddress: String
     legalName: String

pkg/server/api/console/v1/graphql/organization.graphql

@@ -317,15 +317,15 @@ type Organization implements Node {
         orderBy: CookieBannerOrder
     ): CookieBannerConnection @goField(forceResolver: true)
 
-    vendors(
+    thirdParties(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
-        orderBy: VendorOrder
-    ): VendorConnection! @goField(forceResolver: true)
+        orderBy: ThirdPartyOrder
+    ): ThirdPartyConnection! @goField(forceResolver: true)
 
-    vendorsDocument: Document @goField(forceResolver: true)
+    thirdPartiesDocument: Document @goField(forceResolver: true)
 
     webhookSubscriptions(
         first: Int

pkg/server/api/console/v1/graphql/processing_activity.graphql

@@ -160,13 +160,13 @@ type ProcessingActivity implements Node {
     nextReviewDate: Datetime
     role: ProcessingActivityRole!
     dataProtectionOfficer: Profile @goField(forceResolver: true)
-    vendors(
+    thirdParties(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
-        orderBy: VendorOrder
-    ): VendorConnection! @goField(forceResolver: true)
+        orderBy: ThirdPartyOrder
+    ): ThirdPartyConnection! @goField(forceResolver: true)
     dataProtectionImpactAssessment: DataProtectionImpactAssessment
         @goField(forceResolver: true)
     transferImpactAssessment: TransferImpactAssessment
@@ -227,7 +227,7 @@ input CreateProcessingActivityInput {
     nextReviewDate: Datetime
     role: ProcessingActivityRole!
     dataProtectionOfficerId: ID
-    vendorIds: [ID!]
+    thirdPartyIds: [ID!]
 }
 
 input UpdateProcessingActivityInput {
@@ -252,7 +252,7 @@ input UpdateProcessingActivityInput {
     nextReviewDate: Datetime @goField(omittable: true)
     role: ProcessingActivityRole
     dataProtectionOfficerId: ID @goField(omittable: true)
-    vendorIds: [ID!]
+    thirdPartyIds: [ID!]
 }
 
 input DeleteProcessingActivityInput {

pkg/server/api/console/v1/graphql/third_party.graphql

@@ -0,0 +1,711 @@
+enum ThirdPartyCategory
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategory") {
+    ANALYTICS
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryAnalytics"
+        )
+    CLOUD_MONITORING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCloudMonitoring"
+        )
+    CLOUD_PROVIDER
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCloudProvider"
+        )
+    COLLABORATION
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCollaboration"
+        )
+    CUSTOMER_SUPPORT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCustomerSupport"
+        )
+    DATA_STORAGE_AND_PROCESSING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryDataStorageAndProcessing"
+        )
+    DOCUMENT_MANAGEMENT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryDocumentManagement"
+        )
+    EMPLOYEE_MANAGEMENT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryEmployeeManagement"
+        )
+    ENGINEERING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryEngineering"
+        )
+    FINANCE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryFinance")
+    IDENTITY_PROVIDER
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryIdentityProvider"
+        )
+    IT @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryIT")
+    MARKETING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryMarketing"
+        )
+    OFFICE_OPERATIONS
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryOfficeOperations"
+        )
+    OTHER @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryOther")
+    PASSWORD_MANAGEMENT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryPasswordManagement"
+        )
+    PRODUCT_AND_DESIGN
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryProductAndDesign"
+        )
+    PROFESSIONAL_SERVICES
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryProfessionalServices"
+        )
+    RECRUITING
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryRecruiting"
+        )
+    SALES @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategorySales")
+    SECURITY
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategorySecurity")
+    VERSION_CONTROL
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryVersionControl"
+        )
+}
+
+enum DataSensitivity
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.DataSensitivity") {
+    NONE @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityNone")
+    LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityLow")
+    MEDIUM
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityMedium")
+    HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityHigh")
+    CRITICAL
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.DataSensitivityCritical"
+        )
+}
+
+enum BusinessImpact
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.BusinessImpact") {
+    LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactLow")
+    MEDIUM
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactMedium")
+    HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactHigh")
+    CRITICAL
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactCritical")
+}
+
+enum ThirdPartyOrderField
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ThirdPartyOrderField") {
+    NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyOrderFieldName")
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyOrderFieldCreatedAt"
+        )
+    UPDATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyOrderFieldUpdatedAt"
+        )
+}
+
+enum ThirdPartyComplianceReportOrderField
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.ThirdPartyComplianceReportOrderField"
+    ) {
+    REPORT_DATE
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyComplianceReportOrderFieldReportDate"
+        )
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyComplianceReportOrderFieldCreatedAt"
+        )
+}
+
+enum ThirdPartyContactOrderField
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ThirdPartyContactOrderField") {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyContactOrderFieldCreatedAt"
+        )
+    FULL_NAME
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyContactOrderFieldFullName"
+        )
+    EMAIL
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyContactOrderFieldEmail"
+        )
+}
+
+enum ThirdPartyServiceOrderField
+    @goModel(model: "go.probo.inc/probo/pkg/coredata.ThirdPartyServiceOrderField") {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyServiceOrderFieldCreatedAt"
+        )
+    NAME
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyServiceOrderFieldName"
+        )
+}
+
+enum ThirdPartyRiskAssessmentOrderField
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.ThirdPartyRiskAssessmentOrderField"
+    ) {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyRiskAssessmentOrderFieldCreatedAt"
+        )
+    EXPIRES_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ThirdPartyRiskAssessmentOrderFieldExpiresAt"
+        )
+}
+
+input ThirdPartyOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ThirdPartyOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ThirdPartyOrderField!
+}
+
+input ThirdPartyComplianceReportOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ThirdPartyComplianceReportOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ThirdPartyComplianceReportOrderField!
+}
+
+input ThirdPartyContactOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ThirdPartyContactOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ThirdPartyContactOrderField!
+}
+
+input ThirdPartyServiceOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ThirdPartyServiceOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ThirdPartyServiceOrderField!
+}
+
+input ThirdPartyRiskAssessmentOrder {
+    field: ThirdPartyRiskAssessmentOrderField!
+    direction: OrderDirection!
+}
+
+type ThirdParty implements Node {
+    id: ID!
+    name: String!
+    category: ThirdPartyCategory!
+    description: String
+
+    organization: Organization! @goField(forceResolver: true)
+
+    complianceReports(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ThirdPartyComplianceReportOrder
+    ): ThirdPartyComplianceReportConnection! @goField(forceResolver: true)
+
+    businessAssociateAgreement: ThirdPartyBusinessAssociateAgreement
+        @goField(forceResolver: true)
+    dataPrivacyAgreement: ThirdPartyDataPrivacyAgreement
+        @goField(forceResolver: true)
+
+    contacts(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ThirdPartyContactOrder
+    ): ThirdPartyContactConnection! @goField(forceResolver: true)
+
+    services(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ThirdPartyServiceOrder
+    ): ThirdPartyServiceConnection! @goField(forceResolver: true)
+
+    riskAssessments(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ThirdPartyRiskAssessmentOrder
+    ): ThirdPartyRiskAssessmentConnection! @goField(forceResolver: true)
+
+    businessOwner: Profile @goField(forceResolver: true)
+    securityOwner: Profile @goField(forceResolver: true)
+
+    statusPageUrl: String
+    termsOfServiceUrl: String
+    privacyPolicyUrl: String
+    serviceLevelAgreementUrl: String
+    dataProcessingAgreementUrl: String
+    businessAssociateAgreementUrl: String
+    subprocessorsListUrl: String
+    certifications: [String!]!
+    countries: [CountryCode!]!
+    securityPageUrl: String
+    trustPageUrl: String
+    headquarterAddress: String
+    legalName: String
+    websiteUrl: String
+    showOnTrustCenter: Boolean!
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyComplianceReport implements Node {
+    id: ID!
+    thirdParty: ThirdParty! @goField(forceResolver: true)
+    reportDate: Datetime!
+    validUntil: Datetime
+    reportName: String!
+    file: File @goField(forceResolver: true)
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyBusinessAssociateAgreement implements Node {
+    id: ID!
+    thirdParty: ThirdParty! @goField(forceResolver: true)
+    validFrom: Datetime
+    validUntil: Datetime
+    fileName: String!
+    fileUrl: String! @goField(forceResolver: true)
+    fileSize: BigInt!
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyContact implements Node {
+    id: ID!
+    thirdParty: ThirdParty! @goField(forceResolver: true)
+    fullName: String
+    email: EmailAddr
+    phone: String
+    role: String
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyService implements Node {
+    id: ID!
+    thirdParty: ThirdParty! @goField(forceResolver: true)
+    name: String!
+    description: String
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyDataPrivacyAgreement implements Node {
+    id: ID!
+    thirdParty: ThirdParty! @goField(forceResolver: true)
+    validFrom: Datetime
+    validUntil: Datetime
+    fileName: String!
+    fileUrl: String! @goField(forceResolver: true)
+    fileSize: BigInt!
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyRiskAssessment implements Node {
+    id: ID!
+    thirdParty: ThirdParty! @goField(forceResolver: true)
+    expiresAt: Datetime!
+    dataSensitivity: DataSensitivity!
+    businessImpact: BusinessImpact!
+    notes: String
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ThirdPartyConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ThirdPartyConnection"
+    ) {
+    totalCount: Int! @goField(forceResolver: true)
+    edges: [ThirdPartyEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ThirdPartyEdge {
+    cursor: CursorKey!
+    node: ThirdParty!
+}
+
+type ThirdPartyComplianceReportConnection {
+    edges: [ThirdPartyComplianceReportEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ThirdPartyComplianceReportEdge {
+    cursor: CursorKey!
+    node: ThirdPartyComplianceReport!
+}
+
+type ThirdPartyContactConnection {
+    edges: [ThirdPartyContactEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ThirdPartyContactEdge {
+    cursor: CursorKey!
+    node: ThirdPartyContact!
+}
+
+type ThirdPartyServiceConnection {
+    edges: [ThirdPartyServiceEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ThirdPartyServiceEdge {
+    cursor: CursorKey!
+    node: ThirdPartyService!
+}
+
+type ThirdPartyRiskAssessmentConnection {
+    edges: [ThirdPartyRiskAssessmentEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ThirdPartyRiskAssessmentEdge {
+    cursor: CursorKey!
+    node: ThirdPartyRiskAssessment!
+}
+
+extend type Mutation {
+    createThirdParty(input: CreateThirdPartyInput!): CreateThirdPartyPayload!
+    updateThirdParty(input: UpdateThirdPartyInput!): UpdateThirdPartyPayload!
+    deleteThirdParty(input: DeleteThirdPartyInput!): DeleteThirdPartyPayload!
+    createThirdPartyContact(
+        input: CreateThirdPartyContactInput!
+    ): CreateThirdPartyContactPayload!
+    updateThirdPartyContact(
+        input: UpdateThirdPartyContactInput!
+    ): UpdateThirdPartyContactPayload!
+    deleteThirdPartyContact(
+        input: DeleteThirdPartyContactInput!
+    ): DeleteThirdPartyContactPayload!
+    createThirdPartyService(
+        input: CreateThirdPartyServiceInput!
+    ): CreateThirdPartyServicePayload!
+    updateThirdPartyService(
+        input: UpdateThirdPartyServiceInput!
+    ): UpdateThirdPartyServicePayload!
+    deleteThirdPartyService(
+        input: DeleteThirdPartyServiceInput!
+    ): DeleteThirdPartyServicePayload!
+    uploadThirdPartyComplianceReport(
+        input: UploadThirdPartyComplianceReportInput!
+    ): UploadThirdPartyComplianceReportPayload!
+    deleteThirdPartyComplianceReport(
+        input: DeleteThirdPartyComplianceReportInput!
+    ): DeleteThirdPartyComplianceReportPayload!
+    uploadThirdPartyBusinessAssociateAgreement(
+        input: UploadThirdPartyBusinessAssociateAgreementInput!
+    ): UploadThirdPartyBusinessAssociateAgreementPayload!
+    updateThirdPartyBusinessAssociateAgreement(
+        input: UpdateThirdPartyBusinessAssociateAgreementInput!
+    ): UpdateThirdPartyBusinessAssociateAgreementPayload!
+    deleteThirdPartyBusinessAssociateAgreement(
+        input: DeleteThirdPartyBusinessAssociateAgreementInput!
+    ): DeleteThirdPartyBusinessAssociateAgreementPayload!
+    uploadThirdPartyDataPrivacyAgreement(
+        input: UploadThirdPartyDataPrivacyAgreementInput!
+    ): UploadThirdPartyDataPrivacyAgreementPayload!
+    updateThirdPartyDataPrivacyAgreement(
+        input: UpdateThirdPartyDataPrivacyAgreementInput!
+    ): UpdateThirdPartyDataPrivacyAgreementPayload!
+    deleteThirdPartyDataPrivacyAgreement(
+        input: DeleteThirdPartyDataPrivacyAgreementInput!
+    ): DeleteThirdPartyDataPrivacyAgreementPayload!
+    createThirdPartyRiskAssessment(
+        input: CreateThirdPartyRiskAssessmentInput!
+    ): CreateThirdPartyRiskAssessmentPayload!
+    assessThirdParty(input: AssessThirdPartyInput!): AssessThirdPartyPayload!
+    publishThirdPartyList(
+        input: PublishThirdPartyListInput!
+    ): PublishThirdPartyListPayload!
+}
+
+input PublishThirdPartyListInput {
+    organizationId: ID!
+    approverIds: [ID!]
+    minor: Boolean!
+}
+
+type PublishThirdPartyListPayload {
+    documentEdge: DocumentEdge!
+    documentVersionEdge: DocumentVersionEdge!
+}
+
+input CreateThirdPartyInput {
+    organizationId: ID!
+    name: String!
+    description: String
+    headquarterAddress: String
+    legalName: String
+    websiteUrl: String
+    privacyPolicyUrl: String
+    category: ThirdPartyCategory
+    serviceLevelAgreementUrl: String
+    dataProcessingAgreementUrl: String
+    businessAssociateAgreementUrl: String
+    subprocessorsListUrl: String
+    certifications: [String!]
+    countries: [CountryCode!]
+    securityPageUrl: String
+    trustPageUrl: String
+    statusPageUrl: String
+    termsOfServiceUrl: String
+    businessOwnerId: ID
+    securityOwnerId: ID
+}
+
+input UpdateThirdPartyInput {
+    id: ID!
+    name: String
+    description: String @goField(omittable: true)
+    statusPageUrl: String @goField(omittable: true)
+    termsOfServiceUrl: String @goField(omittable: true)
+    privacyPolicyUrl: String @goField(omittable: true)
+    serviceLevelAgreementUrl: String @goField(omittable: true)
+    dataProcessingAgreementUrl: String @goField(omittable: true)
+    businessAssociateAgreementUrl: String @goField(omittable: true)
+    subprocessorsListUrl: String @goField(omittable: true)
+    websiteUrl: String @goField(omittable: true)
+    legalName: String @goField(omittable: true)
+    headquarterAddress: String @goField(omittable: true)
+    category: ThirdPartyCategory
+    certifications: [String!]
+    countries: [CountryCode!]
+    securityPageUrl: String @goField(omittable: true)
+    trustPageUrl: String @goField(omittable: true)
+    businessOwnerId: ID @goField(omittable: true)
+    securityOwnerId: ID @goField(omittable: true)
+    showOnTrustCenter: Boolean
+}
+
+input DeleteThirdPartyInput {
+    thirdPartyId: ID!
+}
+
+input CreateThirdPartyContactInput {
+    thirdPartyId: ID!
+    fullName: String
+    email: EmailAddr
+    phone: String
+    role: String
+}
+
+input UpdateThirdPartyContactInput {
+    id: ID!
+    fullName: String @goField(omittable: true)
+    email: EmailAddr @goField(omittable: true)
+    phone: String @goField(omittable: true)
+    role: String @goField(omittable: true)
+}
+
+input DeleteThirdPartyContactInput {
+    thirdPartyContactId: ID!
+}
+
+input CreateThirdPartyServiceInput {
+    thirdPartyId: ID!
+    name: String!
+    description: String
+    url: String
+    type: String
+}
+
+input UpdateThirdPartyServiceInput {
+    id: ID!
+    name: String
+    description: String @goField(omittable: true)
+    url: String
+    type: String
+}
+
+input DeleteThirdPartyServiceInput {
+    thirdPartyServiceId: ID!
+}
+
+input UploadThirdPartyComplianceReportInput {
+    thirdPartyId: ID!
+    reportDate: Datetime!
+    validUntil: Datetime
+    reportName: String!
+    file: Upload!
+}
+
+input DeleteThirdPartyComplianceReportInput {
+    reportId: ID!
+}
+
+input UploadThirdPartyBusinessAssociateAgreementInput {
+    thirdPartyId: ID!
+    validFrom: Datetime
+    validUntil: Datetime
+    fileName: String!
+    file: Upload!
+}
+
+input UpdateThirdPartyBusinessAssociateAgreementInput {
+    thirdPartyId: ID!
+    validFrom: Datetime @goField(omittable: true)
+    validUntil: Datetime @goField(omittable: true)
+}
+
+input DeleteThirdPartyBusinessAssociateAgreementInput {
+    thirdPartyId: ID!
+}
+
+input UploadThirdPartyDataPrivacyAgreementInput {
+    thirdPartyId: ID!
+    validFrom: Datetime
+    validUntil: Datetime
+    fileName: String!
+    file: Upload!
+}
+
+input UpdateThirdPartyDataPrivacyAgreementInput {
+    thirdPartyId: ID!
+    validFrom: Datetime @goField(omittable: true)
+    validUntil: Datetime @goField(omittable: true)
+}
+
+input DeleteThirdPartyDataPrivacyAgreementInput {
+    thirdPartyId: ID!
+}
+
+input CreateThirdPartyRiskAssessmentInput {
+    thirdPartyId: ID!
+    expiresAt: Datetime!
+    dataSensitivity: DataSensitivity!
+    businessImpact: BusinessImpact!
+    notes: String
+}
+
+input AssessThirdPartyInput {
+    id: ID!
+    websiteUrl: String!
+    procedure: String
+}
+
+type ThirdPartySubprocessor {
+    name: String!
+    country: String!
+    purpose: String!
+}
+
+type CreateThirdPartyPayload {
+    thirdPartyEdge: ThirdPartyEdge!
+}
+
+type UpdateThirdPartyPayload {
+    thirdParty: ThirdParty!
+}
+
+type DeleteThirdPartyPayload {
+    deletedThirdPartyId: ID!
+}
+
+type CreateThirdPartyContactPayload {
+    thirdPartyContactEdge: ThirdPartyContactEdge!
+}
+
+type UpdateThirdPartyContactPayload {
+    thirdPartyContact: ThirdPartyContact!
+}
+
+type DeleteThirdPartyContactPayload {
+    deletedThirdPartyContactId: ID!
+}
+
+type CreateThirdPartyServicePayload {
+    thirdPartyServiceEdge: ThirdPartyServiceEdge!
+}
+
+type UpdateThirdPartyServicePayload {
+    thirdPartyService: ThirdPartyService!
+}
+
+type DeleteThirdPartyServicePayload {
+    deletedThirdPartyServiceId: ID!
+}
+
+type UploadThirdPartyComplianceReportPayload {
+    thirdPartyComplianceReportEdge: ThirdPartyComplianceReportEdge!
+}
+
+type DeleteThirdPartyComplianceReportPayload {
+    deletedThirdPartyComplianceReportId: ID!
+}
+
+type UploadThirdPartyBusinessAssociateAgreementPayload {
+    thirdPartyBusinessAssociateAgreement: ThirdPartyBusinessAssociateAgreement!
+}
+
+type UpdateThirdPartyBusinessAssociateAgreementPayload {
+    thirdPartyBusinessAssociateAgreement: ThirdPartyBusinessAssociateAgreement!
+}
+
+type DeleteThirdPartyBusinessAssociateAgreementPayload {
+    deletedThirdPartyId: ID!
+}
+
+type UploadThirdPartyDataPrivacyAgreementPayload {
+    thirdPartyDataPrivacyAgreement: ThirdPartyDataPrivacyAgreement!
+}
+
+type UpdateThirdPartyDataPrivacyAgreementPayload {
+    thirdPartyDataPrivacyAgreement: ThirdPartyDataPrivacyAgreement!
+}
+
+type DeleteThirdPartyDataPrivacyAgreementPayload {
+    deletedThirdPartyId: ID!
+}
+
+type CreateThirdPartyRiskAssessmentPayload {
+    thirdPartyRiskAssessmentEdge: ThirdPartyRiskAssessmentEdge!
+}
+
+type AssessThirdPartyPayload {
+    thirdParty: ThirdParty!
+    report: String!
+    subprocessors: [ThirdPartySubprocessor!]!
+}

pkg/server/api/console/v1/graphql/vendor.graphql

@@ -1,711 +0,0 @@
-enum VendorCategory
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorCategory") {
-    ANALYTICS
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryAnalytics"
-        )
-    CLOUD_MONITORING
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCloudMonitoring"
-        )
-    CLOUD_PROVIDER
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCloudProvider"
-        )
-    COLLABORATION
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCollaboration"
-        )
-    CUSTOMER_SUPPORT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCustomerSupport"
-        )
-    DATA_STORAGE_AND_PROCESSING
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryDataStorageAndProcessing"
-        )
-    DOCUMENT_MANAGEMENT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryDocumentManagement"
-        )
-    EMPLOYEE_MANAGEMENT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEmployeeManagement"
-        )
-    ENGINEERING
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEngineering"
-        )
-    FINANCE
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryFinance")
-    IDENTITY_PROVIDER
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryIdentityProvider"
-        )
-    IT @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryIT")
-    MARKETING
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryMarketing"
-        )
-    OFFICE_OPERATIONS
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryOfficeOperations"
-        )
-    OTHER @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryOther")
-    PASSWORD_MANAGEMENT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryPasswordManagement"
-        )
-    PRODUCT_AND_DESIGN
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryProductAndDesign"
-        )
-    PROFESSIONAL_SERVICES
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryProfessionalServices"
-        )
-    RECRUITING
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryRecruiting"
-        )
-    SALES @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySales")
-    SECURITY
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySecurity")
-    VERSION_CONTROL
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorCategoryVersionControl"
-        )
-}
-
-enum DataSensitivity
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.DataSensitivity") {
-    NONE @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityNone")
-    LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityLow")
-    MEDIUM
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityMedium")
-    HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.DataSensitivityHigh")
-    CRITICAL
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.DataSensitivityCritical"
-        )
-}
-
-enum BusinessImpact
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.BusinessImpact") {
-    LOW @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactLow")
-    MEDIUM
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactMedium")
-    HIGH @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactHigh")
-    CRITICAL
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.BusinessImpactCritical")
-}
-
-enum VendorOrderField
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorOrderField") {
-    NAME @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldName")
-    CREATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldCreatedAt"
-        )
-    UPDATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorOrderFieldUpdatedAt"
-        )
-}
-
-enum VendorComplianceReportOrderField
-    @goModel(
-        model: "go.probo.inc/probo/pkg/coredata.VendorComplianceReportOrderField"
-    ) {
-    REPORT_DATE
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorComplianceReportOrderFieldReportDate"
-        )
-    CREATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorComplianceReportOrderFieldCreatedAt"
-        )
-}
-
-enum VendorContactOrderField
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorContactOrderField") {
-    CREATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorContactOrderFieldCreatedAt"
-        )
-    FULL_NAME
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorContactOrderFieldFullName"
-        )
-    EMAIL
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorContactOrderFieldEmail"
-        )
-}
-
-enum VendorServiceOrderField
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorServiceOrderField") {
-    CREATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorServiceOrderFieldCreatedAt"
-        )
-    NAME
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorServiceOrderFieldName"
-        )
-}
-
-enum VendorRiskAssessmentOrderField
-    @goModel(
-        model: "go.probo.inc/probo/pkg/coredata.VendorRiskAssessmentOrderField"
-    ) {
-    CREATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorRiskAssessmentOrderFieldCreatedAt"
-        )
-    EXPIRES_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.VendorRiskAssessmentOrderFieldExpiresAt"
-        )
-}
-
-input VendorOrder
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.VendorOrderBy"
-    ) {
-    direction: OrderDirection!
-    field: VendorOrderField!
-}
-
-input VendorComplianceReportOrder
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.VendorComplianceReportOrderBy"
-    ) {
-    direction: OrderDirection!
-    field: VendorComplianceReportOrderField!
-}
-
-input VendorContactOrder
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.VendorContactOrderBy"
-    ) {
-    direction: OrderDirection!
-    field: VendorContactOrderField!
-}
-
-input VendorServiceOrder
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.VendorServiceOrderBy"
-    ) {
-    direction: OrderDirection!
-    field: VendorServiceOrderField!
-}
-
-input VendorRiskAssessmentOrder {
-    field: VendorRiskAssessmentOrderField!
-    direction: OrderDirection!
-}
-
-type Vendor implements Node {
-    id: ID!
-    name: String!
-    category: VendorCategory!
-    description: String
-
-    organization: Organization! @goField(forceResolver: true)
-
-    complianceReports(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: VendorComplianceReportOrder
-    ): VendorComplianceReportConnection! @goField(forceResolver: true)
-
-    businessAssociateAgreement: VendorBusinessAssociateAgreement
-        @goField(forceResolver: true)
-    dataPrivacyAgreement: VendorDataPrivacyAgreement
-        @goField(forceResolver: true)
-
-    contacts(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: VendorContactOrder
-    ): VendorContactConnection! @goField(forceResolver: true)
-
-    services(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: VendorServiceOrder
-    ): VendorServiceConnection! @goField(forceResolver: true)
-
-    riskAssessments(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: VendorRiskAssessmentOrder
-    ): VendorRiskAssessmentConnection! @goField(forceResolver: true)
-
-    businessOwner: Profile @goField(forceResolver: true)
-    securityOwner: Profile @goField(forceResolver: true)
-
-    statusPageUrl: String
-    termsOfServiceUrl: String
-    privacyPolicyUrl: String
-    serviceLevelAgreementUrl: String
-    dataProcessingAgreementUrl: String
-    businessAssociateAgreementUrl: String
-    subprocessorsListUrl: String
-    certifications: [String!]!
-    countries: [CountryCode!]!
-    securityPageUrl: String
-    trustPageUrl: String
-    headquarterAddress: String
-    legalName: String
-    websiteUrl: String
-    showOnTrustCenter: Boolean!
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorComplianceReport implements Node {
-    id: ID!
-    vendor: Vendor! @goField(forceResolver: true)
-    reportDate: Datetime!
-    validUntil: Datetime
-    reportName: String!
-    file: File @goField(forceResolver: true)
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorBusinessAssociateAgreement implements Node {
-    id: ID!
-    vendor: Vendor! @goField(forceResolver: true)
-    validFrom: Datetime
-    validUntil: Datetime
-    fileName: String!
-    fileUrl: String! @goField(forceResolver: true)
-    fileSize: BigInt!
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorContact implements Node {
-    id: ID!
-    vendor: Vendor! @goField(forceResolver: true)
-    fullName: String
-    email: EmailAddr
-    phone: String
-    role: String
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorService implements Node {
-    id: ID!
-    vendor: Vendor! @goField(forceResolver: true)
-    name: String!
-    description: String
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorDataPrivacyAgreement implements Node {
-    id: ID!
-    vendor: Vendor! @goField(forceResolver: true)
-    validFrom: Datetime
-    validUntil: Datetime
-    fileName: String!
-    fileUrl: String! @goField(forceResolver: true)
-    fileSize: BigInt!
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorRiskAssessment implements Node {
-    id: ID!
-    vendor: Vendor! @goField(forceResolver: true)
-    expiresAt: Datetime!
-    dataSensitivity: DataSensitivity!
-    businessImpact: BusinessImpact!
-    notes: String
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type VendorConnection
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.VendorConnection"
-    ) {
-    totalCount: Int! @goField(forceResolver: true)
-    edges: [VendorEdge!]!
-    pageInfo: PageInfo!
-}
-
-type VendorEdge {
-    cursor: CursorKey!
-    node: Vendor!
-}
-
-type VendorComplianceReportConnection {
-    edges: [VendorComplianceReportEdge!]!
-    pageInfo: PageInfo!
-}
-
-type VendorComplianceReportEdge {
-    cursor: CursorKey!
-    node: VendorComplianceReport!
-}
-
-type VendorContactConnection {
-    edges: [VendorContactEdge!]!
-    pageInfo: PageInfo!
-}
-
-type VendorContactEdge {
-    cursor: CursorKey!
-    node: VendorContact!
-}
-
-type VendorServiceConnection {
-    edges: [VendorServiceEdge!]!
-    pageInfo: PageInfo!
-}
-
-type VendorServiceEdge {
-    cursor: CursorKey!
-    node: VendorService!
-}
-
-type VendorRiskAssessmentConnection {
-    edges: [VendorRiskAssessmentEdge!]!
-    pageInfo: PageInfo!
-}
-
-type VendorRiskAssessmentEdge {
-    cursor: CursorKey!
-    node: VendorRiskAssessment!
-}
-
-extend type Mutation {
-    createVendor(input: CreateVendorInput!): CreateVendorPayload!
-    updateVendor(input: UpdateVendorInput!): UpdateVendorPayload!
-    deleteVendor(input: DeleteVendorInput!): DeleteVendorPayload!
-    createVendorContact(
-        input: CreateVendorContactInput!
-    ): CreateVendorContactPayload!
-    updateVendorContact(
-        input: UpdateVendorContactInput!
-    ): UpdateVendorContactPayload!
-    deleteVendorContact(
-        input: DeleteVendorContactInput!
-    ): DeleteVendorContactPayload!
-    createVendorService(
-        input: CreateVendorServiceInput!
-    ): CreateVendorServicePayload!
-    updateVendorService(
-        input: UpdateVendorServiceInput!
-    ): UpdateVendorServicePayload!
-    deleteVendorService(
-        input: DeleteVendorServiceInput!
-    ): DeleteVendorServicePayload!
-    uploadVendorComplianceReport(
-        input: UploadVendorComplianceReportInput!
-    ): UploadVendorComplianceReportPayload!
-    deleteVendorComplianceReport(
-        input: DeleteVendorComplianceReportInput!
-    ): DeleteVendorComplianceReportPayload!
-    uploadVendorBusinessAssociateAgreement(
-        input: UploadVendorBusinessAssociateAgreementInput!
-    ): UploadVendorBusinessAssociateAgreementPayload!
-    updateVendorBusinessAssociateAgreement(
-        input: UpdateVendorBusinessAssociateAgreementInput!
-    ): UpdateVendorBusinessAssociateAgreementPayload!
-    deleteVendorBusinessAssociateAgreement(
-        input: DeleteVendorBusinessAssociateAgreementInput!
-    ): DeleteVendorBusinessAssociateAgreementPayload!
-    uploadVendorDataPrivacyAgreement(
-        input: UploadVendorDataPrivacyAgreementInput!
-    ): UploadVendorDataPrivacyAgreementPayload!
-    updateVendorDataPrivacyAgreement(
-        input: UpdateVendorDataPrivacyAgreementInput!
-    ): UpdateVendorDataPrivacyAgreementPayload!
-    deleteVendorDataPrivacyAgreement(
-        input: DeleteVendorDataPrivacyAgreementInput!
-    ): DeleteVendorDataPrivacyAgreementPayload!
-    createVendorRiskAssessment(
-        input: CreateVendorRiskAssessmentInput!
-    ): CreateVendorRiskAssessmentPayload!
-    assessVendor(input: AssessVendorInput!): AssessVendorPayload!
-    publishVendorList(
-        input: PublishVendorListInput!
-    ): PublishVendorListPayload!
-}
-
-input PublishVendorListInput {
-    organizationId: ID!
-    approverIds: [ID!]
-    minor: Boolean!
-}
-
-type PublishVendorListPayload {
-    documentEdge: DocumentEdge!
-    documentVersionEdge: DocumentVersionEdge!
-}
-
-input CreateVendorInput {
-    organizationId: ID!
-    name: String!
-    description: String
-    headquarterAddress: String
-    legalName: String
-    websiteUrl: String
-    privacyPolicyUrl: String
-    category: VendorCategory
-    serviceLevelAgreementUrl: String
-    dataProcessingAgreementUrl: String
-    businessAssociateAgreementUrl: String
-    subprocessorsListUrl: String
-    certifications: [String!]
-    countries: [CountryCode!]
-    securityPageUrl: String
-    trustPageUrl: String
-    statusPageUrl: String
-    termsOfServiceUrl: String
-    businessOwnerId: ID
-    securityOwnerId: ID
-}
-
-input UpdateVendorInput {
-    id: ID!
-    name: String
-    description: String @goField(omittable: true)
-    statusPageUrl: String @goField(omittable: true)
-    termsOfServiceUrl: String @goField(omittable: true)
-    privacyPolicyUrl: String @goField(omittable: true)
-    serviceLevelAgreementUrl: String @goField(omittable: true)
-    dataProcessingAgreementUrl: String @goField(omittable: true)
-    businessAssociateAgreementUrl: String @goField(omittable: true)
-    subprocessorsListUrl: String @goField(omittable: true)
-    websiteUrl: String @goField(omittable: true)
-    legalName: String @goField(omittable: true)
-    headquarterAddress: String @goField(omittable: true)
-    category: VendorCategory
-    certifications: [String!]
-    countries: [CountryCode!]
-    securityPageUrl: String @goField(omittable: true)
-    trustPageUrl: String @goField(omittable: true)
-    businessOwnerId: ID @goField(omittable: true)
-    securityOwnerId: ID @goField(omittable: true)
-    showOnTrustCenter: Boolean
-}
-
-input DeleteVendorInput {
-    vendorId: ID!
-}
-
-input CreateVendorContactInput {
-    vendorId: ID!
-    fullName: String
-    email: EmailAddr
-    phone: String
-    role: String
-}
-
-input UpdateVendorContactInput {
-    id: ID!
-    fullName: String @goField(omittable: true)
-    email: EmailAddr @goField(omittable: true)
-    phone: String @goField(omittable: true)
-    role: String @goField(omittable: true)
-}
-
-input DeleteVendorContactInput {
-    vendorContactId: ID!
-}
-
-input CreateVendorServiceInput {
-    vendorId: ID!
-    name: String!
-    description: String
-    url: String
-    type: String
-}
-
-input UpdateVendorServiceInput {
-    id: ID!
-    name: String
-    description: String @goField(omittable: true)
-    url: String
-    type: String
-}
-
-input DeleteVendorServiceInput {
-    vendorServiceId: ID!
-}
-
-input UploadVendorComplianceReportInput {
-    vendorId: ID!
-    reportDate: Datetime!
-    validUntil: Datetime
-    reportName: String!
-    file: Upload!
-}
-
-input DeleteVendorComplianceReportInput {
-    reportId: ID!
-}
-
-input UploadVendorBusinessAssociateAgreementInput {
-    vendorId: ID!
-    validFrom: Datetime
-    validUntil: Datetime
-    fileName: String!
-    file: Upload!
-}
-
-input UpdateVendorBusinessAssociateAgreementInput {
-    vendorId: ID!
-    validFrom: Datetime @goField(omittable: true)
-    validUntil: Datetime @goField(omittable: true)
-}
-
-input DeleteVendorBusinessAssociateAgreementInput {
-    vendorId: ID!
-}
-
-input UploadVendorDataPrivacyAgreementInput {
-    vendorId: ID!
-    validFrom: Datetime
-    validUntil: Datetime
-    fileName: String!
-    file: Upload!
-}
-
-input UpdateVendorDataPrivacyAgreementInput {
-    vendorId: ID!
-    validFrom: Datetime @goField(omittable: true)
-    validUntil: Datetime @goField(omittable: true)
-}
-
-input DeleteVendorDataPrivacyAgreementInput {
-    vendorId: ID!
-}
-
-input CreateVendorRiskAssessmentInput {
-    vendorId: ID!
-    expiresAt: Datetime!
-    dataSensitivity: DataSensitivity!
-    businessImpact: BusinessImpact!
-    notes: String
-}
-
-input AssessVendorInput {
-    id: ID!
-    websiteUrl: String!
-    procedure: String
-}
-
-type VendorSubprocessor {
-    name: String!
-    country: String!
-    purpose: String!
-}
-
-type CreateVendorPayload {
-    vendorEdge: VendorEdge!
-}
-
-type UpdateVendorPayload {
-    vendor: Vendor!
-}
-
-type DeleteVendorPayload {
-    deletedVendorId: ID!
-}
-
-type CreateVendorContactPayload {
-    vendorContactEdge: VendorContactEdge!
-}
-
-type UpdateVendorContactPayload {
-    vendorContact: VendorContact!
-}
-
-type DeleteVendorContactPayload {
-    deletedVendorContactId: ID!
-}
-
-type CreateVendorServicePayload {
-    vendorServiceEdge: VendorServiceEdge!
-}
-
-type UpdateVendorServicePayload {
-    vendorService: VendorService!
-}
-
-type DeleteVendorServicePayload {
-    deletedVendorServiceId: ID!
-}
-
-type UploadVendorComplianceReportPayload {
-    vendorComplianceReportEdge: VendorComplianceReportEdge!
-}
-
-type DeleteVendorComplianceReportPayload {
-    deletedVendorComplianceReportId: ID!
-}
-
-type UploadVendorBusinessAssociateAgreementPayload {
-    vendorBusinessAssociateAgreement: VendorBusinessAssociateAgreement!
-}
-
-type UpdateVendorBusinessAssociateAgreementPayload {
-    vendorBusinessAssociateAgreement: VendorBusinessAssociateAgreement!
-}
-
-type DeleteVendorBusinessAssociateAgreementPayload {
-    deletedVendorId: ID!
-}
-
-type UploadVendorDataPrivacyAgreementPayload {
-    vendorDataPrivacyAgreement: VendorDataPrivacyAgreement!
-}
-
-type UpdateVendorDataPrivacyAgreementPayload {
-    vendorDataPrivacyAgreement: VendorDataPrivacyAgreement!
-}
-
-type DeleteVendorDataPrivacyAgreementPayload {
-    deletedVendorId: ID!
-}
-
-type CreateVendorRiskAssessmentPayload {
-    vendorRiskAssessmentEdge: VendorRiskAssessmentEdge!
-}
-
-type AssessVendorPayload {
-    vendor: Vendor!
-    report: String!
-    subprocessors: [VendorSubprocessor!]!
-}

pkg/server/api/console/v1/graphql/webhook.graphql

@@ -1,11 +1,11 @@
 enum WebhookEventType
     @goModel(model: "go.probo.inc/probo/pkg/coredata.WebhookEventType") {
-    VENDOR_CREATED
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeVendorCreated")
-    VENDOR_UPDATED
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeVendorUpdated")
-    VENDOR_DELETED
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeVendorDeleted")
+    THIRD_PARTY_CREATED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeThirdPartyCreated")
+    THIRD_PARTY_UPDATED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeThirdPartyUpdated")
+    THIRD_PARTY_DELETED
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeThirdPartyDeleted")
     USER_CREATED
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.WebhookEventTypeUserCreated")
     USER_UPDATED

pkg/server/api/console/v1/organization_resolvers.go

@@ -1208,20 +1208,20 @@ func (r *organizationResolver) CookieBanners(ctx context.Context, obj *types.Org
 	return types.NewCookieBannerConnection(p, r, obj.ID), nil
 }
 
-// Vendors is the resolver for the vendors field.
-func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorOrderBy) (*types.VendorConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionVendorList); err != nil {
+// ThirdParties is the resolver for the thirdParties field.
+func (r *organizationResolver) ThirdParties(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
-		Field:     coredata.VendorOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
 			Field:     orderBy.Field,
 			Direction: orderBy.Direction,
 		}
@@ -1229,28 +1229,28 @@ func (r *organizationResolver) Vendors(ctx context.Context, obj *types.Organizat
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	vendorFilter := coredata.NewVendorFilter(nil)
+	thirdPartyFilter := coredata.NewThirdPartyFilter(nil)
 
-	page, err := prb.Vendors.ListForOrganizationID(ctx, obj.ID, cursor, vendorFilter)
+	page, err := prb.ThirdParties.ListForOrganizationID(ctx, obj.ID, cursor, thirdPartyFilter)
 	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list organization vendors", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot list organization thirdParties", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewVendorConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID), nil
 }
 
-// VendorsDocument is the resolver for the vendorsDocument field.
-func (r *organizationResolver) VendorsDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
+// ThirdPartiesDocument is the resolver for the thirdPartiesDocument field.
+func (r *organizationResolver) ThirdPartiesDocument(ctx context.Context, obj *types.Organization) (*types.Document, error) {
 	if err := r.authorize(ctx, obj.ID, probo.ActionDocumentGet); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	documentID, err := prb.GeneratedDocuments.GetVendorsDocumentID(ctx, obj.ID)
+	documentID, err := prb.GeneratedDocuments.GetThirdPartiesDocumentID(ctx, obj.ID)
 	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot get vendors document ID", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot get thirdParties document ID", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 	if documentID == nil {
@@ -1262,7 +1262,7 @@ func (r *organizationResolver) VendorsDocument(ctx context.Context, obj *types.O
 		if errors.Is(err, coredata.ErrResourceNotFound) {
 			return nil, nil
 		}
-		r.logger.ErrorCtx(ctx, "cannot load vendors document", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot load thirdParties document", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 

pkg/server/api/console/v1/processing_activity_resolvers.go

@@ -49,7 +49,7 @@ func (r *mutationResolver) CreateProcessingActivity(ctx context.Context, input t
 		NextReviewDate:                       input.NextReviewDate,
 		Role:                                 input.Role,
 		DataProtectionOfficerID:              input.DataProtectionOfficerID,
-		VendorIDs:                            input.VendorIds,
+		ThirdPartyIDs:                        input.ThirdPartyIds,
 	}
 
 	activity, err := prb.ProcessingActivities.Create(ctx, &req)
@@ -91,7 +91,7 @@ func (r *mutationResolver) UpdateProcessingActivity(ctx context.Context, input t
 		NextReviewDate:                       gqlutils.UnwrapOmittable(input.NextReviewDate),
 		Role:                                 input.Role,
 		DataProtectionOfficerID:              gqlutils.UnwrapOmittable(input.DataProtectionOfficerID),
-		VendorIDs:                            &input.VendorIds,
+		ThirdPartyIDs:                        &input.ThirdPartyIds,
 	}
 
 	activity, err := prb.ProcessingActivities.Update(ctx, &req)
@@ -196,20 +196,20 @@ func (r *processingActivityResolver) DataProtectionOfficer(ctx context.Context,
 	return types.NewProfile(dpo), nil
 }
 
-// Vendors is the resolver for the vendors field.
-func (r *processingActivityResolver) Vendors(ctx context.Context, obj *types.ProcessingActivity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.VendorOrderBy) (*types.VendorConnection, error) {
-	if err := r.authorize(ctx, obj.ID, probo.ActionVendorList); err != nil {
+// ThirdParties is the resolver for the thirdParties field.
+func (r *processingActivityResolver) ThirdParties(ctx context.Context, obj *types.ProcessingActivity, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.ThirdPartyOrderBy) (*types.ThirdPartyConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionThirdPartyList); err != nil {
 		return nil, err
 	}
 
 	prb := r.ProboService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
-		Field:     coredata.VendorOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if orderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
 			Field:     orderBy.Field,
 			Direction: orderBy.Direction,
 		}
@@ -217,13 +217,13 @@ func (r *processingActivityResolver) Vendors(ctx context.Context, obj *types.Pro
 
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	page, err := prb.Vendors.ListForProcessingActivityID(ctx, obj.ID, cursor)
+	page, err := prb.ThirdParties.ListForProcessingActivityID(ctx, obj.ID, cursor)
 	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot list processing activity vendors", log.Error(err))
+		r.logger.ErrorCtx(ctx, "cannot list processing activity thirdParties", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewVendorConnection(page, r, obj.ID), nil
+	return types.NewThirdPartyConnection(page, r, obj.ID), nil
 }
 
 // DataProtectionImpactAssessment is the resolver for the dataProtectionImpactAssessment field.

pkg/server/api/console/v1/types/common_third_party.go

@@ -20,21 +20,21 @@ import (
 )
 
 type CommonThirdParty struct {
-	ID                         gid.GID                 `json:"id"`
-	Name                       string                  `json:"name"`
-	Category                   coredata.VendorCategory `json:"category"`
-	WebsiteURL                 *string                 `json:"websiteUrl,omitempty"`
-	HeadquarterAddress         *string                 `json:"headquarterAddress,omitempty"`
-	LegalName                  *string                 `json:"legalName,omitempty"`
-	PrivacyPolicyURL           *string                 `json:"privacyPolicyUrl,omitempty"`
-	ServiceLevelAgreementURL   *string                 `json:"serviceLevelAgreementUrl,omitempty"`
-	DataProcessingAgreementURL *string                 `json:"dataProcessingAgreementUrl,omitempty"`
-	Certifications             []string                `json:"certifications"`
-	SecurityPageURL            *string                 `json:"securityPageUrl,omitempty"`
-	TrustPageURL               *string                 `json:"trustPageUrl,omitempty"`
-	StatusPageURL              *string                 `json:"statusPageUrl,omitempty"`
-	TermsOfServiceURL          *string                 `json:"termsOfServiceUrl,omitempty"`
-	LogoFileID                 *gid.GID                `json:"logoFileId,omitempty"`
+	ID                         gid.GID                     `json:"id"`
+	Name                       string                      `json:"name"`
+	Category                   coredata.ThirdPartyCategory `json:"category"`
+	WebsiteURL                 *string                     `json:"websiteUrl,omitempty"`
+	HeadquarterAddress         *string                     `json:"headquarterAddress,omitempty"`
+	LegalName                  *string                     `json:"legalName,omitempty"`
+	PrivacyPolicyURL           *string                     `json:"privacyPolicyUrl,omitempty"`
+	ServiceLevelAgreementURL   *string                     `json:"serviceLevelAgreementUrl,omitempty"`
+	DataProcessingAgreementURL *string                     `json:"dataProcessingAgreementUrl,omitempty"`
+	Certifications             []string                    `json:"certifications"`
+	SecurityPageURL            *string                     `json:"securityPageUrl,omitempty"`
+	TrustPageURL               *string                     `json:"trustPageUrl,omitempty"`
+	StatusPageURL              *string                     `json:"statusPageUrl,omitempty"`
+	TermsOfServiceURL          *string                     `json:"termsOfServiceUrl,omitempty"`
+	LogoFileID                 *gid.GID                    `json:"logoFileId,omitempty"`
 }
 
 func NewCommonThirdParty(c *coredata.CommonThirdParty) *CommonThirdParty {

pkg/server/api/console/v1/types/datum.go

@@ -28,7 +28,7 @@ type Datum struct {
 	Name               string                      `json:"name"`
 	DataClassification coredata.DataClassification `json:"dataClassification"`
 	Owner              *Profile                    `json:"owner"`
-	Vendors            *VendorConnection           `json:"vendors"`
+	ThirdParties       *ThirdPartyConnection       `json:"third_parties"`
 	Organization       *Organization               `json:"organization"`
 	CreatedAt          time.Time                   `json:"createdAt"`
 	UpdatedAt          time.Time                   `json:"updatedAt"`

pkg/server/api/console/v1/types/third_party.go

@@ -22,11 +22,11 @@ import (
 )
 
 type (
-	VendorOrderBy OrderBy[coredata.VendorOrderField]
+	ThirdPartyOrderBy OrderBy[coredata.ThirdPartyOrderField]
 
-	VendorConnection struct {
+	ThirdPartyConnection struct {
 		TotalCount int
-		Edges      []*VendorEdge
+		Edges      []*ThirdPartyEdge
 		PageInfo   PageInfo
 
 		Resolver any
@@ -34,18 +34,18 @@ type (
 	}
 )
 
-func NewVendorConnection(
-	p *page.Page[*coredata.Vendor, coredata.VendorOrderField],
+func NewThirdPartyConnection(
+	p *page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField],
 	parentType any,
 	parentID gid.GID,
-) *VendorConnection {
-	var edges = make([]*VendorEdge, len(p.Data))
+) *ThirdPartyConnection {
+	var edges = make([]*ThirdPartyEdge, len(p.Data))
 
 	for i := range edges {
-		edges[i] = NewVendorEdge(p.Data[i], p.Cursor.OrderBy.Field)
+		edges[i] = NewThirdPartyEdge(p.Data[i], p.Cursor.OrderBy.Field)
 	}
 
-	return &VendorConnection{
+	return &ThirdPartyConnection{
 		Edges:    edges,
 		PageInfo: *NewPageInfo(p),
 
@@ -54,15 +54,15 @@ func NewVendorConnection(
 	}
 }
 
-func NewVendorEdge(v *coredata.Vendor, orderBy coredata.VendorOrderField) *VendorEdge {
-	return &VendorEdge{
+func NewThirdPartyEdge(v *coredata.ThirdParty, orderBy coredata.ThirdPartyOrderField) *ThirdPartyEdge {
+	return &ThirdPartyEdge{
 		Cursor: v.CursorKey(orderBy),
-		Node:   NewVendor(v),
+		Node:   NewThirdParty(v),
 	}
 }
 
-func NewVendor(v *coredata.Vendor) *Vendor {
-	object := &Vendor{
+func NewThirdParty(v *coredata.ThirdParty) *ThirdParty {
+	object := &ThirdParty{
 		ID: v.ID,
 		Organization: &Organization{
 			ID: v.OrganizationID,
@@ -104,10 +104,10 @@ func NewVendor(v *coredata.Vendor) *Vendor {
 	return object
 }
 
-func NewVendorSubprocessors(sps []probo.Subprocessor) []*VendorSubprocessor {
-	result := make([]*VendorSubprocessor, len(sps))
+func NewThirdPartySubprocessors(sps []probo.Subprocessor) []*ThirdPartySubprocessor {
+	result := make([]*ThirdPartySubprocessor, len(sps))
 	for i, sp := range sps {
-		result[i] = &VendorSubprocessor{
+		result[i] = &ThirdPartySubprocessor{
 			Name:    sp.Name,
 			Country: sp.Country,
 			Purpose: sp.Purpose,

pkg/server/api/console/v1/types/third_party_business_associate_agreement.go

@@ -18,11 +18,11 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 )
 
-func NewVendorDataPrivacyAgreement(v *coredata.VendorDataPrivacyAgreement, file *coredata.File) *VendorDataPrivacyAgreement {
-	return &VendorDataPrivacyAgreement{
+func NewThirdPartyBusinessAssociateAgreement(v *coredata.ThirdPartyBusinessAssociateAgreement, file *coredata.File) *ThirdPartyBusinessAssociateAgreement {
+	return &ThirdPartyBusinessAssociateAgreement{
 		ID: v.ID,
-		Vendor: &Vendor{
-			ID: v.VendorID,
+		ThirdParty: &ThirdParty{
+			ID: v.ThirdPartyID,
 		},
 		ValidFrom:  v.ValidFrom,
 		ValidUntil: v.ValidUntil,

pkg/server/api/console/v1/types/third_party_compliance_report.go

@@ -20,34 +20,34 @@ import (
 )
 
 type (
-	VendorComplianceReportOrderBy OrderBy[coredata.VendorComplianceReportOrderField]
+	ThirdPartyComplianceReportOrderBy OrderBy[coredata.ThirdPartyComplianceReportOrderField]
 )
 
-func NewVendorComplianceReportConnection(p *page.Page[*coredata.VendorComplianceReport, coredata.VendorComplianceReportOrderField]) *VendorComplianceReportConnection {
-	var edges = make([]*VendorComplianceReportEdge, len(p.Data))
+func NewThirdPartyComplianceReportConnection(p *page.Page[*coredata.ThirdPartyComplianceReport, coredata.ThirdPartyComplianceReportOrderField]) *ThirdPartyComplianceReportConnection {
+	var edges = make([]*ThirdPartyComplianceReportEdge, len(p.Data))
 
 	for i := range edges {
-		edges[i] = NewVendorComplianceReportEdge(p.Data[i], p.Cursor.OrderBy.Field)
+		edges[i] = NewThirdPartyComplianceReportEdge(p.Data[i], p.Cursor.OrderBy.Field)
 	}
 
-	return &VendorComplianceReportConnection{
+	return &ThirdPartyComplianceReportConnection{
 		Edges:    edges,
 		PageInfo: NewPageInfo(p),
 	}
 }
 
-func NewVendorComplianceReportEdge(c *coredata.VendorComplianceReport, orderBy coredata.VendorComplianceReportOrderField) *VendorComplianceReportEdge {
-	return &VendorComplianceReportEdge{
+func NewThirdPartyComplianceReportEdge(c *coredata.ThirdPartyComplianceReport, orderBy coredata.ThirdPartyComplianceReportOrderField) *ThirdPartyComplianceReportEdge {
+	return &ThirdPartyComplianceReportEdge{
 		Cursor: c.CursorKey(orderBy),
-		Node:   NewVendorComplianceReport(c),
+		Node:   NewThirdPartyComplianceReport(c),
 	}
 }
 
-func NewVendorComplianceReport(c *coredata.VendorComplianceReport) *VendorComplianceReport {
-	object := &VendorComplianceReport{
+func NewThirdPartyComplianceReport(c *coredata.ThirdPartyComplianceReport) *ThirdPartyComplianceReport {
+	object := &ThirdPartyComplianceReport{
 		ID: c.ID,
-		Vendor: &Vendor{
-			ID: c.VendorID,
+		ThirdParty: &ThirdParty{
+			ID: c.ThirdPartyID,
 		},
 		ReportDate: c.ReportDate,
 		ValidUntil: c.ValidUntil,

pkg/server/api/console/v1/types/third_party_contact.go

@@ -20,34 +20,34 @@ import (
 )
 
 type (
-	VendorContactOrderBy OrderBy[coredata.VendorContactOrderField]
+	ThirdPartyContactOrderBy OrderBy[coredata.ThirdPartyContactOrderField]
 )
 
-func NewVendorContactConnection(p *page.Page[*coredata.VendorContact, coredata.VendorContactOrderField]) *VendorContactConnection {
-	var edges = make([]*VendorContactEdge, len(p.Data))
+func NewThirdPartyContactConnection(p *page.Page[*coredata.ThirdPartyContact, coredata.ThirdPartyContactOrderField]) *ThirdPartyContactConnection {
+	var edges = make([]*ThirdPartyContactEdge, len(p.Data))
 
 	for i := range edges {
-		edges[i] = NewVendorContactEdge(p.Data[i], p.Cursor.OrderBy.Field)
+		edges[i] = NewThirdPartyContactEdge(p.Data[i], p.Cursor.OrderBy.Field)
 	}
 
-	return &VendorContactConnection{
+	return &ThirdPartyContactConnection{
 		Edges:    edges,
 		PageInfo: NewPageInfo(p),
 	}
 }
 
-func NewVendorContactEdge(c *coredata.VendorContact, orderBy coredata.VendorContactOrderField) *VendorContactEdge {
-	return &VendorContactEdge{
+func NewThirdPartyContactEdge(c *coredata.ThirdPartyContact, orderBy coredata.ThirdPartyContactOrderField) *ThirdPartyContactEdge {
+	return &ThirdPartyContactEdge{
 		Cursor: c.CursorKey(orderBy),
-		Node:   NewVendorContact(c),
+		Node:   NewThirdPartyContact(c),
 	}
 }
 
-func NewVendorContact(c *coredata.VendorContact) *VendorContact {
-	return &VendorContact{
+func NewThirdPartyContact(c *coredata.ThirdPartyContact) *ThirdPartyContact {
+	return &ThirdPartyContact{
 		ID: c.ID,
-		Vendor: &Vendor{
-			ID: c.VendorID,
+		ThirdParty: &ThirdParty{
+			ID: c.ThirdPartyID,
 		},
 		FullName:  c.FullName,
 		Email:     c.Email,

pkg/server/api/console/v1/types/third_party_data_privacy_agreement.go

@@ -18,11 +18,11 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 )
 
-func NewVendorBusinessAssociateAgreement(v *coredata.VendorBusinessAssociateAgreement, file *coredata.File) *VendorBusinessAssociateAgreement {
-	return &VendorBusinessAssociateAgreement{
+func NewThirdPartyDataPrivacyAgreement(v *coredata.ThirdPartyDataPrivacyAgreement, file *coredata.File) *ThirdPartyDataPrivacyAgreement {
+	return &ThirdPartyDataPrivacyAgreement{
 		ID: v.ID,
-		Vendor: &Vendor{
-			ID: v.VendorID,
+		ThirdParty: &ThirdParty{
+			ID: v.ThirdPartyID,
 		},
 		ValidFrom:  v.ValidFrom,
 		ValidUntil: v.ValidUntil,

pkg/server/api/console/v1/types/third_party_risk_assessment.go

@@ -20,34 +20,34 @@ import (
 )
 
 type (
-	VendorRiskAssessmentOrderBy OrderBy[coredata.VendorRiskAssessmentOrderField]
+	ThirdPartyRiskAssessmentOrderBy OrderBy[coredata.ThirdPartyRiskAssessmentOrderField]
 )
 
-func NewVendorRiskAssessmentConnection(p *page.Page[*coredata.VendorRiskAssessment, coredata.VendorRiskAssessmentOrderField]) *VendorRiskAssessmentConnection {
-	var edges = make([]*VendorRiskAssessmentEdge, len(p.Data))
+func NewThirdPartyRiskAssessmentConnection(p *page.Page[*coredata.ThirdPartyRiskAssessment, coredata.ThirdPartyRiskAssessmentOrderField]) *ThirdPartyRiskAssessmentConnection {
+	var edges = make([]*ThirdPartyRiskAssessmentEdge, len(p.Data))
 
 	for i := range edges {
-		edges[i] = NewVendorRiskAssessmentEdge(p.Data[i], p.Cursor.OrderBy.Field)
+		edges[i] = NewThirdPartyRiskAssessmentEdge(p.Data[i], p.Cursor.OrderBy.Field)
 	}
 
-	return &VendorRiskAssessmentConnection{
+	return &ThirdPartyRiskAssessmentConnection{
 		Edges:    edges,
 		PageInfo: NewPageInfo(p),
 	}
 }
 
-func NewVendorRiskAssessmentEdge(c *coredata.VendorRiskAssessment, orderBy coredata.VendorRiskAssessmentOrderField) *VendorRiskAssessmentEdge {
-	return &VendorRiskAssessmentEdge{
+func NewThirdPartyRiskAssessmentEdge(c *coredata.ThirdPartyRiskAssessment, orderBy coredata.ThirdPartyRiskAssessmentOrderField) *ThirdPartyRiskAssessmentEdge {
+	return &ThirdPartyRiskAssessmentEdge{
 		Cursor: c.CursorKey(orderBy),
-		Node:   NewVendorRiskAssessment(c),
+		Node:   NewThirdPartyRiskAssessment(c),
 	}
 }
 
-func NewVendorRiskAssessment(c *coredata.VendorRiskAssessment) *VendorRiskAssessment {
-	return &VendorRiskAssessment{
+func NewThirdPartyRiskAssessment(c *coredata.ThirdPartyRiskAssessment) *ThirdPartyRiskAssessment {
+	return &ThirdPartyRiskAssessment{
 		ID: c.ID,
-		Vendor: &Vendor{
-			ID: c.VendorID,
+		ThirdParty: &ThirdParty{
+			ID: c.ThirdPartyID,
 		},
 		ExpiresAt:       c.ExpiresAt,
 		DataSensitivity: c.DataSensitivity,

pkg/server/api/console/v1/types/third_party_service.go

@@ -20,34 +20,34 @@ import (
 )
 
 type (
-	VendorServiceOrderBy OrderBy[coredata.VendorServiceOrderField]
+	ThirdPartyServiceOrderBy OrderBy[coredata.ThirdPartyServiceOrderField]
 )
 
-func NewVendorServiceConnection(p *page.Page[*coredata.VendorService, coredata.VendorServiceOrderField]) *VendorServiceConnection {
-	var edges = make([]*VendorServiceEdge, len(p.Data))
+func NewThirdPartyServiceConnection(p *page.Page[*coredata.ThirdPartyService, coredata.ThirdPartyServiceOrderField]) *ThirdPartyServiceConnection {
+	var edges = make([]*ThirdPartyServiceEdge, len(p.Data))
 
 	for i := range edges {
-		edges[i] = NewVendorServiceEdge(p.Data[i], p.Cursor.OrderBy.Field)
+		edges[i] = NewThirdPartyServiceEdge(p.Data[i], p.Cursor.OrderBy.Field)
 	}
 
-	return &VendorServiceConnection{
+	return &ThirdPartyServiceConnection{
 		Edges:    edges,
 		PageInfo: NewPageInfo(p),
 	}
 }
 
-func NewVendorServiceEdge(s *coredata.VendorService, orderBy coredata.VendorServiceOrderField) *VendorServiceEdge {
-	return &VendorServiceEdge{
+func NewThirdPartyServiceEdge(s *coredata.ThirdPartyService, orderBy coredata.ThirdPartyServiceOrderField) *ThirdPartyServiceEdge {
+	return &ThirdPartyServiceEdge{
 		Cursor: s.CursorKey(orderBy),
-		Node:   NewVendorService(s),
+		Node:   NewThirdPartyService(s),
 	}
 }
 
-func NewVendorService(s *coredata.VendorService) *VendorService {
-	return &VendorService{
+func NewThirdPartyService(s *coredata.ThirdPartyService) *ThirdPartyService {
+	return &ThirdPartyService{
 		ID: s.ID,
-		Vendor: &Vendor{
-			ID: s.VendorID,
+		ThirdParty: &ThirdParty{
+			ID: s.ThirdPartyID,
 		},
 		Name:        s.Name,
 		Description: s.Description,

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -45,19 +45,19 @@ func (r *Resolver) ListOrganizationsTool(ctx context.Context, req *mcp.CallToolR
 	return nil, result, nil
 }
 
-// ListVendorsTool handles the listVendors tool
-// List all vendors for the organization
-func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorsInput) (*mcp.CallToolResult, types.ListVendorsOutput, error) {
-	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionVendorList)
+// ListThirdPartiesTool handles the listThirdParties tool
+// List all thirdParties for the organization
+func (r *Resolver) ListThirdPartiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartiesInput) (*mcp.CallToolResult, types.ListThirdPartiesOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionThirdPartyList)
 
 	prb := r.ProboService(ctx, input.OrganizationID)
 
-	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
-		Field:     coredata.VendorOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if input.OrderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyOrderField]{
 			Field:     input.OrderBy.Field,
 			Direction: input.OrderBy.Direction,
 		}
@@ -65,26 +65,26 @@ func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	vendorFilter := coredata.NewVendorFilter(nil)
+	thirdPartyFilter := coredata.NewThirdPartyFilter(nil)
 
-	page, err := prb.Vendors.ListForOrganizationID(ctx, input.OrganizationID, cursor, vendorFilter)
+	page, err := prb.ThirdParties.ListForOrganizationID(ctx, input.OrganizationID, cursor, thirdPartyFilter)
 	if err != nil {
-		panic(fmt.Errorf("cannot list organization vendors: %w", err))
+		panic(fmt.Errorf("cannot list organization thirdParties: %w", err))
 	}
 
-	return nil, types.NewListVendorsOutput(page), nil
+	return nil, types.NewListThirdPartiesOutput(page), nil
 }
 
-// AddVendorTool handles the addVendor tool
-// Add a new vendor to the organization
-func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorInput) (*mcp.CallToolResult, types.AddVendorOutput, error) {
-	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionVendorCreate)
+// AddThirdPartyTool handles the addThirdParty tool
+// Add a new thirdParty to the organization
+func (r *Resolver) AddThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyInput) (*mcp.CallToolResult, types.AddThirdPartyOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionThirdPartyCreate)
 
 	svc := r.ProboService(ctx, input.OrganizationID)
 
-	var category *coredata.VendorCategory
+	var category *coredata.ThirdPartyCategory
 	if input.Category != nil {
-		cat := coredata.VendorCategory(*input.Category)
+		cat := coredata.ThirdPartyCategory(*input.Category)
 		category = &cat
 	}
 
@@ -96,9 +96,9 @@ func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest,
 		}
 	}
 
-	vendor, err := svc.Vendors.Create(
+	thirdParty, err := svc.ThirdParties.Create(
 		ctx,
-		probo.CreateVendorRequest{
+		probo.CreateThirdPartyRequest{
 			OrganizationID:                input.OrganizationID,
 			Name:                          input.Name,
 			Description:                   input.Description,
@@ -122,16 +122,16 @@ func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest,
 		},
 	)
 	if err != nil {
-		return nil, types.AddVendorOutput{}, fmt.Errorf("failed to create vendor: %w", err)
+		return nil, types.AddThirdPartyOutput{}, fmt.Errorf("failed to create thirdParty: %w", err)
 	}
 
-	return nil, types.NewAddVendorOutput(vendor), nil
+	return nil, types.NewAddThirdPartyOutput(thirdParty), nil
 }
 
-// UpdateVendorTool handles the updateVendor tool
-// Update an existing vendor
-func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateVendorInput) (*mcp.CallToolResult, types.UpdateVendorOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorUpdate)
+// UpdateThirdPartyTool handles the updateThirdParty tool
+// Update an existing thirdParty
+func (r *Resolver) UpdateThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateThirdPartyInput) (*mcp.CallToolResult, types.UpdateThirdPartyOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyUpdate)
 
 	svc := r.ProboService(ctx, input.ID)
 
@@ -210,9 +210,9 @@ func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolReques
 		securityOwnerID = &input.SecurityOwnerID
 	}
 
-	var category *coredata.VendorCategory
+	var category *coredata.ThirdPartyCategory
 	if input.Category != nil {
-		cat := coredata.VendorCategory(*input.Category)
+		cat := coredata.ThirdPartyCategory(*input.Category)
 		category = &cat
 	}
 
@@ -224,9 +224,9 @@ func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolReques
 		}
 	}
 
-	vendor, err := svc.Vendors.Update(
+	thirdParty, err := svc.ThirdParties.Update(
 		ctx,
-		probo.UpdateVendorRequest{
+		probo.UpdateThirdPartyRequest{
 			ID:                            input.ID,
 			Name:                          input.Name,
 			Description:                   description,
@@ -250,10 +250,10 @@ func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolReques
 		},
 	)
 	if err != nil {
-		return nil, types.UpdateVendorOutput{}, fmt.Errorf("failed to update vendor: %w", err)
+		return nil, types.UpdateThirdPartyOutput{}, fmt.Errorf("failed to update thirdParty: %w", err)
 	}
 
-	return nil, types.NewUpdateVendorOutput(vendor), nil
+	return nil, types.NewUpdateThirdPartyOutput(thirdParty), nil
 }
 
 func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRisksInput) (*mcp.CallToolResult, types.ListRisksOutput, error) {
@@ -593,7 +593,7 @@ func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, i
 			OwnerID:         input.OwnerID,
 			AssetType:       input.AssetType,
 			DataTypesStored: input.DataTypesStored,
-			VendorIDs:       input.VendorIds,
+			ThirdPartyIDs:   input.ThirdPartyIds,
 		},
 	)
 	if err != nil {
@@ -619,7 +619,7 @@ func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest
 			OwnerID:         input.OwnerID,
 			AssetType:       input.AssetType,
 			DataTypesStored: input.DataTypesStored,
-			VendorIDs:       input.VendorIds,
+			ThirdPartyIDs:   input.ThirdPartyIds,
 		},
 	)
 	if err != nil {
@@ -684,7 +684,7 @@ func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, i
 			Name:               input.Name,
 			DataClassification: input.DataClassification,
 			OwnerID:            input.OwnerID,
-			VendorIDs:          input.VendorIds,
+			ThirdPartyIDs:      input.ThirdPartyIds,
 		},
 	)
 	if err != nil {
@@ -708,7 +708,7 @@ func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest
 			Name:               input.Name,
 			DataClassification: input.DataClassification,
 			OwnerID:            input.OwnerID,
-			VendorIDs:          input.VendorIds,
+			ThirdPartyIDs:      input.ThirdPartyIds,
 		},
 	)
 	if err != nil {
@@ -1004,7 +1004,7 @@ func (r *Resolver) AddProcessingActivityTool(ctx context.Context, req *mcp.CallT
 			NextReviewDate:                       input.NextReviewDate,
 			Role:                                 input.Role,
 			DataProtectionOfficerID:              input.DataProtectionOfficerID,
-			VendorIDs:                            input.VendorIds,
+			ThirdPartyIDs:                        input.ThirdPartyIds,
 		},
 	)
 	if err != nil {
@@ -1021,9 +1021,9 @@ func (r *Resolver) UpdateProcessingActivityTool(ctx context.Context, req *mcp.Ca
 
 	svc := r.ProboService(ctx, input.ID)
 
-	var vendorIDs *[]gid.GID
-	if input.VendorIds != nil {
-		vendorIDs = &input.VendorIds
+	var thirdPartyIDs *[]gid.GID
+	if input.ThirdPartyIds != nil {
+		thirdPartyIDs = &input.ThirdPartyIds
 	}
 
 	processingActivity, err := svc.ProcessingActivities.Update(
@@ -1049,7 +1049,7 @@ func (r *Resolver) UpdateProcessingActivityTool(ctx context.Context, req *mcp.Ca
 			NextReviewDate:                       UnwrapOmittable(input.NextReviewDate),
 			Role:                                 input.Role,
 			DataProtectionOfficerID:              UnwrapOmittable(input.DataProtectionOfficerID),
-			VendorIDs:                            vendorIDs,
+			ThirdPartyIDs:                        thirdPartyIDs,
 		},
 	)
 	if err != nil {
@@ -2729,19 +2729,19 @@ func (r *Resolver) DeleteApplicabilityStatementTool(ctx context.Context, req *mc
 	}, nil
 }
 
-// ListVendorRiskAssessmentsTool handles the listVendorRiskAssessments tool
-// List all risk assessments for a vendor
-func (r *Resolver) ListVendorRiskAssessmentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorRiskAssessmentsInput) (*mcp.CallToolResult, types.ListVendorRiskAssessmentsOutput, error) {
-	r.MustAuthorize(ctx, input.VendorID, probo.ActionVendorRiskAssessmentList)
+// ListThirdPartyRiskAssessmentsTool handles the listThirdPartyRiskAssessments tool
+// List all risk assessments for a thirdParty
+func (r *Resolver) ListThirdPartyRiskAssessmentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartyRiskAssessmentsInput) (*mcp.CallToolResult, types.ListThirdPartyRiskAssessmentsOutput, error) {
+	r.MustAuthorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentList)
 
-	prb := r.ProboService(ctx, input.VendorID)
+	prb := r.ProboService(ctx, input.ThirdPartyID)
 
-	pageOrderBy := page.OrderBy[coredata.VendorRiskAssessmentOrderField]{
-		Field:     coredata.VendorRiskAssessmentOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyRiskAssessmentOrderField]{
+		Field:     coredata.ThirdPartyRiskAssessmentOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if input.OrderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorRiskAssessmentOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyRiskAssessmentOrderField]{
 			Field:     input.OrderBy.Field,
 			Direction: input.OrderBy.Direction,
 		}
@@ -2749,25 +2749,25 @@ func (r *Resolver) ListVendorRiskAssessmentsTool(ctx context.Context, req *mcp.C
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	p, err := prb.Vendors.ListRiskAssessments(ctx, input.VendorID, cursor)
+	p, err := prb.ThirdParties.ListRiskAssessments(ctx, input.ThirdPartyID, cursor)
 	if err != nil {
-		return nil, types.ListVendorRiskAssessmentsOutput{}, fmt.Errorf("cannot list vendor risk assessments: %w", err)
+		return nil, types.ListThirdPartyRiskAssessmentsOutput{}, fmt.Errorf("cannot list thirdParty risk assessments: %w", err)
 	}
 
-	return nil, types.NewListVendorRiskAssessmentsOutput(p), nil
+	return nil, types.NewListThirdPartyRiskAssessmentsOutput(p), nil
 }
 
-// AddVendorRiskAssessmentTool handles the addVendorRiskAssessment tool
-// Add a new risk assessment for a vendor
-func (r *Resolver) AddVendorRiskAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorRiskAssessmentInput) (*mcp.CallToolResult, types.AddVendorRiskAssessmentOutput, error) {
-	r.MustAuthorize(ctx, input.VendorID, probo.ActionVendorRiskAssessmentCreate)
+// AddThirdPartyRiskAssessmentTool handles the addThirdPartyRiskAssessment tool
+// Add a new risk assessment for a thirdParty
+func (r *Resolver) AddThirdPartyRiskAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyRiskAssessmentInput) (*mcp.CallToolResult, types.AddThirdPartyRiskAssessmentOutput, error) {
+	r.MustAuthorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyRiskAssessmentCreate)
 
-	prb := r.ProboService(ctx, input.VendorID)
+	prb := r.ProboService(ctx, input.ThirdPartyID)
 
-	assessment, err := prb.Vendors.CreateRiskAssessment(
+	assessment, err := prb.ThirdParties.CreateRiskAssessment(
 		ctx,
-		probo.CreateVendorRiskAssessmentRequest{
-			VendorID:        input.VendorID,
+		probo.CreateThirdPartyRiskAssessmentRequest{
+			ThirdPartyID:    input.ThirdPartyID,
 			ExpiresAt:       input.ExpiresAt,
 			DataSensitivity: input.DataSensitivity,
 			BusinessImpact:  input.BusinessImpact,
@@ -2775,24 +2775,24 @@ func (r *Resolver) AddVendorRiskAssessmentTool(ctx context.Context, req *mcp.Cal
 		},
 	)
 	if err != nil {
-		return nil, types.AddVendorRiskAssessmentOutput{}, fmt.Errorf("failed to create vendor risk assessment: %w", err)
+		return nil, types.AddThirdPartyRiskAssessmentOutput{}, fmt.Errorf("failed to create thirdParty risk assessment: %w", err)
 	}
 
-	return nil, types.NewAddVendorRiskAssessmentOutput(assessment), nil
+	return nil, types.NewAddThirdPartyRiskAssessmentOutput(assessment), nil
 }
 
-func (r *Resolver) DeleteVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteVendorInput) (*mcp.CallToolResult, types.DeleteVendorOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorDelete)
+func (r *Resolver) DeleteThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyInput) (*mcp.CallToolResult, types.DeleteThirdPartyOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyDelete)
 
 	svc := r.ProboService(ctx, input.ID)
 
-	err := svc.Vendors.Delete(ctx, input.ID)
+	err := svc.ThirdParties.Delete(ctx, input.ID)
 	if err != nil {
-		return nil, types.DeleteVendorOutput{}, fmt.Errorf("failed to delete vendor: %w", err)
+		return nil, types.DeleteThirdPartyOutput{}, fmt.Errorf("failed to delete thirdParty: %w", err)
 	}
 
-	return nil, types.DeleteVendorOutput{
-		DeletedVendorID: input.ID,
+	return nil, types.DeleteThirdPartyOutput{
+		DeletedThirdPartyID: input.ID,
 	}, nil
 }
 
@@ -3841,19 +3841,19 @@ func (r *Resolver) PublishAssetListTool(ctx context.Context, req *mcp.CallToolRe
 	}, nil
 }
 
-// ListVendorContactsTool handles the listVendorContacts tool
-// List all contacts for a vendor
-func (r *Resolver) ListVendorContactsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorContactsInput) (*mcp.CallToolResult, types.ListVendorContactsOutput, error) {
-	r.MustAuthorize(ctx, input.VendorID, probo.ActionVendorContactList)
+// ListThirdPartyContactsTool handles the listThirdPartyContacts tool
+// List all contacts for a thirdParty
+func (r *Resolver) ListThirdPartyContactsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartyContactsInput) (*mcp.CallToolResult, types.ListThirdPartyContactsOutput, error) {
+	r.MustAuthorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactList)
 
-	prb := r.ProboService(ctx, input.VendorID)
+	prb := r.ProboService(ctx, input.ThirdPartyID)
 
-	pageOrderBy := page.OrderBy[coredata.VendorContactOrderField]{
-		Field:     coredata.VendorContactOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyContactOrderField]{
+		Field:     coredata.ThirdPartyContactOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if input.OrderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorContactOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyContactOrderField]{
 			Field:     input.OrderBy.Field,
 			Direction: input.OrderBy.Direction,
 		}
@@ -3861,50 +3861,50 @@ func (r *Resolver) ListVendorContactsTool(ctx context.Context, req *mcp.CallTool
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	p, err := prb.VendorContacts.List(ctx, input.VendorID, cursor)
+	p, err := prb.ThirdPartyContacts.List(ctx, input.ThirdPartyID, cursor)
 	if err != nil {
-		return nil, types.ListVendorContactsOutput{}, fmt.Errorf("cannot list vendor contacts: %w", err)
+		return nil, types.ListThirdPartyContactsOutput{}, fmt.Errorf("cannot list thirdParty contacts: %w", err)
 	}
 
-	return nil, types.NewListVendorContactsOutput(p), nil
+	return nil, types.NewListThirdPartyContactsOutput(p), nil
 }
 
-// AddVendorContactTool handles the addVendorContact tool
-// Add a new contact to a vendor
-func (r *Resolver) AddVendorContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorContactInput) (*mcp.CallToolResult, types.AddVendorContactOutput, error) {
-	r.MustAuthorize(ctx, input.VendorID, probo.ActionVendorContactCreate)
+// AddThirdPartyContactTool handles the addThirdPartyContact tool
+// Add a new contact to a thirdParty
+func (r *Resolver) AddThirdPartyContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyContactInput) (*mcp.CallToolResult, types.AddThirdPartyContactOutput, error) {
+	r.MustAuthorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyContactCreate)
 
-	prb := r.ProboService(ctx, input.VendorID)
+	prb := r.ProboService(ctx, input.ThirdPartyID)
 
 	emailAddr, err := mail.ParseAddr(input.Email)
 	if err != nil {
-		return nil, types.AddVendorContactOutput{}, fmt.Errorf("invalid email address: %w", err)
+		return nil, types.AddThirdPartyContactOutput{}, fmt.Errorf("invalid email address: %w", err)
 	}
 
-	vendorContact, err := prb.VendorContacts.Create(ctx, probo.CreateVendorContactRequest{
-		VendorID: input.VendorID,
-		FullName: &input.FullName,
-		Email:    &emailAddr,
-		Phone:    &input.Phone,
-		Role:     &input.Role,
+	thirdPartyContact, err := prb.ThirdPartyContacts.Create(ctx, probo.CreateThirdPartyContactRequest{
+		ThirdPartyID: input.ThirdPartyID,
+		FullName:     &input.FullName,
+		Email:        &emailAddr,
+		Phone:        &input.Phone,
+		Role:         &input.Role,
 	})
 	if err != nil {
-		return nil, types.AddVendorContactOutput{}, fmt.Errorf("cannot create vendor contact: %w", err)
+		return nil, types.AddThirdPartyContactOutput{}, fmt.Errorf("cannot create thirdParty contact: %w", err)
 	}
 
-	return nil, types.AddVendorContactOutput{
-		VendorContact: types.NewVendorContact(vendorContact),
+	return nil, types.AddThirdPartyContactOutput{
+		ThirdPartyContact: types.NewThirdPartyContact(thirdPartyContact),
 	}, nil
 }
 
-// UpdateVendorContactTool handles the updateVendorContact tool
-// Update an existing vendor contact
-func (r *Resolver) UpdateVendorContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateVendorContactInput) (*mcp.CallToolResult, types.UpdateVendorContactOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorContactUpdate)
+// UpdateThirdPartyContactTool handles the updateThirdPartyContact tool
+// Update an existing thirdParty contact
+func (r *Resolver) UpdateThirdPartyContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateThirdPartyContactInput) (*mcp.CallToolResult, types.UpdateThirdPartyContactOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyContactUpdate)
 
 	prb := r.ProboService(ctx, input.ID)
 
-	updateReq := probo.UpdateVendorContactRequest{
+	updateReq := probo.UpdateThirdPartyContactRequest{
 		ID: input.ID,
 	}
 
@@ -3915,7 +3915,7 @@ func (r *Resolver) UpdateVendorContactTool(ctx context.Context, req *mcp.CallToo
 	if input.Email != nil {
 		emailAddr, err := mail.ParseAddr(*input.Email)
 		if err != nil {
-			return nil, types.UpdateVendorContactOutput{}, fmt.Errorf("invalid email address: %w", err)
+			return nil, types.UpdateThirdPartyContactOutput{}, fmt.Errorf("invalid email address: %w", err)
 		}
 		emailPtr := &emailAddr
 		updateReq.Email = &emailPtr
@@ -3929,46 +3929,46 @@ func (r *Resolver) UpdateVendorContactTool(ctx context.Context, req *mcp.CallToo
 		updateReq.Role = &input.Role
 	}
 
-	vendorContact, err := prb.VendorContacts.Update(ctx, updateReq)
+	thirdPartyContact, err := prb.ThirdPartyContacts.Update(ctx, updateReq)
 	if err != nil {
-		return nil, types.UpdateVendorContactOutput{}, fmt.Errorf("cannot update vendor contact: %w", err)
+		return nil, types.UpdateThirdPartyContactOutput{}, fmt.Errorf("cannot update thirdParty contact: %w", err)
 	}
 
-	return nil, types.UpdateVendorContactOutput{
-		VendorContact: types.NewVendorContact(vendorContact),
+	return nil, types.UpdateThirdPartyContactOutput{
+		ThirdPartyContact: types.NewThirdPartyContact(thirdPartyContact),
 	}, nil
 }
 
-// DeleteVendorContactTool handles the deleteVendorContact tool
-// Delete a vendor contact
-func (r *Resolver) DeleteVendorContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteVendorContactInput) (*mcp.CallToolResult, types.DeleteVendorContactOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorContactDelete)
+// DeleteThirdPartyContactTool handles the deleteThirdPartyContact tool
+// Delete a thirdParty contact
+func (r *Resolver) DeleteThirdPartyContactTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyContactInput) (*mcp.CallToolResult, types.DeleteThirdPartyContactOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyContactDelete)
 
 	prb := r.ProboService(ctx, input.ID)
 
-	err := prb.VendorContacts.Delete(ctx, input.ID)
+	err := prb.ThirdPartyContacts.Delete(ctx, input.ID)
 	if err != nil {
-		return nil, types.DeleteVendorContactOutput{}, fmt.Errorf("cannot delete vendor contact: %w", err)
+		return nil, types.DeleteThirdPartyContactOutput{}, fmt.Errorf("cannot delete thirdParty contact: %w", err)
 	}
 
-	return nil, types.DeleteVendorContactOutput{
-		DeletedVendorContactID: input.ID,
+	return nil, types.DeleteThirdPartyContactOutput{
+		DeletedThirdPartyContactID: input.ID,
 	}, nil
 }
 
-// ListVendorServicesTool handles the listVendorServices tool
-// List all services for a vendor
-func (r *Resolver) ListVendorServicesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorServicesInput) (*mcp.CallToolResult, types.ListVendorServicesOutput, error) {
-	r.MustAuthorize(ctx, input.VendorID, probo.ActionVendorServiceList)
+// ListThirdPartyServicesTool handles the listThirdPartyServices tool
+// List all services for a thirdParty
+func (r *Resolver) ListThirdPartyServicesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListThirdPartyServicesInput) (*mcp.CallToolResult, types.ListThirdPartyServicesOutput, error) {
+	r.MustAuthorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceList)
 
-	prb := r.ProboService(ctx, input.VendorID)
+	prb := r.ProboService(ctx, input.ThirdPartyID)
 
-	pageOrderBy := page.OrderBy[coredata.VendorServiceOrderField]{
-		Field:     coredata.VendorServiceOrderFieldCreatedAt,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyServiceOrderField]{
+		Field:     coredata.ThirdPartyServiceOrderFieldCreatedAt,
 		Direction: page.OrderDirectionDesc,
 	}
 	if input.OrderBy != nil {
-		pageOrderBy = page.OrderBy[coredata.VendorServiceOrderField]{
+		pageOrderBy = page.OrderBy[coredata.ThirdPartyServiceOrderField]{
 			Field:     input.OrderBy.Field,
 			Direction: input.OrderBy.Direction,
 		}
@@ -3976,43 +3976,43 @@ func (r *Resolver) ListVendorServicesTool(ctx context.Context, req *mcp.CallTool
 
 	cursor := types.NewCursor(input.Size, input.Cursor, pageOrderBy)
 
-	p, err := prb.VendorServices.List(ctx, input.VendorID, cursor)
+	p, err := prb.ThirdPartyServices.List(ctx, input.ThirdPartyID, cursor)
 	if err != nil {
-		return nil, types.ListVendorServicesOutput{}, fmt.Errorf("cannot list vendor services: %w", err)
+		return nil, types.ListThirdPartyServicesOutput{}, fmt.Errorf("cannot list thirdParty services: %w", err)
 	}
 
-	return nil, types.NewListVendorServicesOutput(p), nil
+	return nil, types.NewListThirdPartyServicesOutput(p), nil
 }
 
-// AddVendorServiceTool handles the addVendorService tool
-// Add a new service to a vendor
-func (r *Resolver) AddVendorServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorServiceInput) (*mcp.CallToolResult, types.AddVendorServiceOutput, error) {
-	r.MustAuthorize(ctx, input.VendorID, probo.ActionVendorServiceCreate)
+// AddThirdPartyServiceTool handles the addThirdPartyService tool
+// Add a new service to a thirdParty
+func (r *Resolver) AddThirdPartyServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddThirdPartyServiceInput) (*mcp.CallToolResult, types.AddThirdPartyServiceOutput, error) {
+	r.MustAuthorize(ctx, input.ThirdPartyID, probo.ActionThirdPartyServiceCreate)
 
-	prb := r.ProboService(ctx, input.VendorID)
+	prb := r.ProboService(ctx, input.ThirdPartyID)
 
-	vendorService, err := prb.VendorServices.Create(ctx, probo.CreateVendorServiceRequest{
-		VendorID:    input.VendorID,
-		Name:        input.Name,
-		Description: input.Description,
+	thirdPartyService, err := prb.ThirdPartyServices.Create(ctx, probo.CreateThirdPartyServiceRequest{
+		ThirdPartyID: input.ThirdPartyID,
+		Name:         input.Name,
+		Description:  input.Description,
 	})
 	if err != nil {
-		return nil, types.AddVendorServiceOutput{}, fmt.Errorf("cannot create vendor service: %w", err)
+		return nil, types.AddThirdPartyServiceOutput{}, fmt.Errorf("cannot create thirdParty service: %w", err)
 	}
 
-	return nil, types.AddVendorServiceOutput{
-		VendorService: types.NewVendorService(vendorService),
+	return nil, types.AddThirdPartyServiceOutput{
+		ThirdPartyService: types.NewThirdPartyService(thirdPartyService),
 	}, nil
 }
 
-// UpdateVendorServiceTool handles the updateVendorService tool
-// Update an existing vendor service
-func (r *Resolver) UpdateVendorServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateVendorServiceInput) (*mcp.CallToolResult, types.UpdateVendorServiceOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorServiceUpdate)
+// UpdateThirdPartyServiceTool handles the updateThirdPartyService tool
+// Update an existing thirdParty service
+func (r *Resolver) UpdateThirdPartyServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateThirdPartyServiceInput) (*mcp.CallToolResult, types.UpdateThirdPartyServiceOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyServiceUpdate)
 
 	prb := r.ProboService(ctx, input.ID)
 
-	updateReq := probo.UpdateVendorServiceRequest{
+	updateReq := probo.UpdateThirdPartyServiceRequest{
 		ID: input.ID,
 	}
 
@@ -4024,30 +4024,30 @@ func (r *Resolver) UpdateVendorServiceTool(ctx context.Context, req *mcp.CallToo
 		updateReq.Description = &input.Description
 	}
 
-	vendorService, err := prb.VendorServices.Update(ctx, updateReq)
+	thirdPartyService, err := prb.ThirdPartyServices.Update(ctx, updateReq)
 	if err != nil {
-		return nil, types.UpdateVendorServiceOutput{}, fmt.Errorf("cannot update vendor service: %w", err)
+		return nil, types.UpdateThirdPartyServiceOutput{}, fmt.Errorf("cannot update thirdParty service: %w", err)
 	}
 
-	return nil, types.UpdateVendorServiceOutput{
-		VendorService: types.NewVendorService(vendorService),
+	return nil, types.UpdateThirdPartyServiceOutput{
+		ThirdPartyService: types.NewThirdPartyService(thirdPartyService),
 	}, nil
 }
 
-// DeleteVendorServiceTool handles the deleteVendorService tool
-// Delete a vendor service
-func (r *Resolver) DeleteVendorServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteVendorServiceInput) (*mcp.CallToolResult, types.DeleteVendorServiceOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorServiceDelete)
+// DeleteThirdPartyServiceTool handles the deleteThirdPartyService tool
+// Delete a thirdParty service
+func (r *Resolver) DeleteThirdPartyServiceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteThirdPartyServiceInput) (*mcp.CallToolResult, types.DeleteThirdPartyServiceOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyServiceDelete)
 
 	prb := r.ProboService(ctx, input.ID)
 
-	err := prb.VendorServices.Delete(ctx, input.ID)
+	err := prb.ThirdPartyServices.Delete(ctx, input.ID)
 	if err != nil {
-		return nil, types.DeleteVendorServiceOutput{}, fmt.Errorf("cannot delete vendor service: %w", err)
+		return nil, types.DeleteThirdPartyServiceOutput{}, fmt.Errorf("cannot delete thirdParty service: %w", err)
 	}
 
-	return nil, types.DeleteVendorServiceOutput{
-		DeletedVendorServiceID: input.ID,
+	return nil, types.DeleteThirdPartyServiceOutput{
+		DeletedThirdPartyServiceID: input.ID,
 	}, nil
 }
 func (r *Resolver) DeleteAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteAssetInput) (*mcp.CallToolResult, types.DeleteAssetOutput, error) {
@@ -4572,24 +4572,24 @@ func (r *Resolver) DeleteCustomDomainTool(ctx context.Context, req *mcp.CallTool
 	return nil, types.DeleteCustomDomainOutput{DeletedCustomDomain: deletedDomain}, nil
 }
 
-func (r *Resolver) AssessVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssessVendorInput) (*mcp.CallToolResult, types.AssessVendorOutput, error) {
-	r.MustAuthorize(ctx, input.ID, probo.ActionVendorAssess)
+func (r *Resolver) AssessThirdPartyTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssessThirdPartyInput) (*mcp.CallToolResult, types.AssessThirdPartyOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionThirdPartyAssess)
 
 	svc := r.ProboService(ctx, input.ID)
 
-	result, err := svc.Vendors.Assess(
+	result, err := svc.ThirdParties.Assess(
 		ctx,
-		probo.AssessVendorRequest{
+		probo.AssessThirdPartyRequest{
 			ID:         input.ID,
 			WebsiteURL: input.WebsiteURL,
 			Procedure:  input.Procedure,
 		},
 	)
 	if err != nil {
-		return nil, types.AssessVendorOutput{}, fmt.Errorf("cannot assess vendor: %w", err)
+		return nil, types.AssessThirdPartyOutput{}, fmt.Errorf("cannot assess thirdParty: %w", err)
 	}
 
-	return nil, types.NewAssessVendorOutput(result), nil
+	return nil, types.NewAssessThirdPartyOutput(result), nil
 }
 
 func (r *Resolver) PublishFindingListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishFindingListInput) (*mcp.CallToolResult, types.PublishFindingListOutput, error) {
@@ -4672,17 +4672,17 @@ func (r *Resolver) PublishTransferImpactAssessmentListTool(ctx context.Context,
 	}, nil
 }
 
-func (r *Resolver) PublishVendorListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishVendorListInput) (*mcp.CallToolResult, types.PublishVendorListOutput, error) {
-	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionVendorPublish)
+func (r *Resolver) PublishThirdPartyListTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishThirdPartyListInput) (*mcp.CallToolResult, types.PublishThirdPartyListOutput, error) {
+	r.MustAuthorize(ctx, input.OrganizationID, probo.ActionThirdPartyPublish)
 
 	svc := r.ProboService(ctx, input.OrganizationID)
 
-	document, documentVersion, err := svc.GeneratedDocuments.PublishVendorList(ctx, input.OrganizationID, input.ApproverIds, input.Minor)
+	document, documentVersion, err := svc.GeneratedDocuments.PublishThirdPartyList(ctx, input.OrganizationID, input.ApproverIds, input.Minor)
 	if err != nil {
-		return nil, types.PublishVendorListOutput{}, fmt.Errorf("cannot publish vendor list: %w", err)
+		return nil, types.PublishThirdPartyListOutput{}, fmt.Errorf("cannot publish thirdParty list: %w", err)
 	}
 
-	return nil, types.PublishVendorListOutput{
+	return nil, types.PublishThirdPartyListOutput{
 		DocumentID:        document.ID,
 		DocumentVersionID: documentVersion.ID,
 	}, nil

pkg/server/api/mcp/v1/types/third_party.go

@@ -20,11 +20,11 @@ import (
 	"go.probo.inc/probo/pkg/probo"
 )
 
-func NewVendorRiskAssessment(v *coredata.VendorRiskAssessment) *VendorRiskAssessment {
-	return &VendorRiskAssessment{
+func NewThirdPartyRiskAssessment(v *coredata.ThirdPartyRiskAssessment) *ThirdPartyRiskAssessment {
+	return &ThirdPartyRiskAssessment{
 		ID:              v.ID,
 		OrganizationID:  v.OrganizationID,
-		VendorID:        v.VendorID,
+		ThirdPartyID:    v.ThirdPartyID,
 		ExpiresAt:       v.ExpiresAt,
 		DataSensitivity: v.DataSensitivity,
 		BusinessImpact:  v.BusinessImpact,
@@ -34,10 +34,10 @@ func NewVendorRiskAssessment(v *coredata.VendorRiskAssessment) *VendorRiskAssess
 	}
 }
 
-func NewListVendorRiskAssessmentsOutput(p *page.Page[*coredata.VendorRiskAssessment, coredata.VendorRiskAssessmentOrderField]) ListVendorRiskAssessmentsOutput {
-	assessments := make([]*VendorRiskAssessment, 0, len(p.Data))
+func NewListThirdPartyRiskAssessmentsOutput(p *page.Page[*coredata.ThirdPartyRiskAssessment, coredata.ThirdPartyRiskAssessmentOrderField]) ListThirdPartyRiskAssessmentsOutput {
+	assessments := make([]*ThirdPartyRiskAssessment, 0, len(p.Data))
 	for _, v := range p.Data {
-		assessments = append(assessments, NewVendorRiskAssessment(v))
+		assessments = append(assessments, NewThirdPartyRiskAssessment(v))
 	}
 
 	var nextCursor *page.CursorKey
@@ -46,30 +46,30 @@ func NewListVendorRiskAssessmentsOutput(p *page.Page[*coredata.VendorRiskAssessm
 		nextCursor = &cursorKey
 	}
 
-	return ListVendorRiskAssessmentsOutput{
-		NextCursor:            nextCursor,
-		VendorRiskAssessments: assessments,
+	return ListThirdPartyRiskAssessmentsOutput{
+		NextCursor:                nextCursor,
+		ThirdPartyRiskAssessments: assessments,
 	}
 }
 
-func NewAddVendorRiskAssessmentOutput(v *coredata.VendorRiskAssessment) AddVendorRiskAssessmentOutput {
-	return AddVendorRiskAssessmentOutput{
-		VendorRiskAssessment: NewVendorRiskAssessment(v),
+func NewAddThirdPartyRiskAssessmentOutput(v *coredata.ThirdPartyRiskAssessment) AddThirdPartyRiskAssessmentOutput {
+	return AddThirdPartyRiskAssessmentOutput{
+		ThirdPartyRiskAssessment: NewThirdPartyRiskAssessment(v),
 	}
 }
 
-func NewVendor(v *coredata.Vendor) *Vendor {
+func NewThirdParty(v *coredata.ThirdParty) *ThirdParty {
 	countries := make([]string, len(v.Countries))
 	for i, c := range v.Countries {
 		countries[i] = string(c)
 	}
 
-	return &Vendor{
+	return &ThirdParty{
 		ID:                            v.ID,
 		OrganizationID:                v.OrganizationID,
 		Name:                          v.Name,
 		Description:                   v.Description,
-		Category:                      VendorCategory(v.Category),
+		Category:                      ThirdPartyCategory(v.Category),
 		HeadquarterAddress:            v.HeadquarterAddress,
 		LegalName:                     v.LegalName,
 		WebsiteURL:                    v.WebsiteURL,
@@ -91,37 +91,37 @@ func NewVendor(v *coredata.Vendor) *Vendor {
 	}
 }
 
-func NewListVendorsOutput(vendorPage *page.Page[*coredata.Vendor, coredata.VendorOrderField]) ListVendorsOutput {
-	vendors := make([]*Vendor, 0, len(vendorPage.Data))
-	for _, v := range vendorPage.Data {
-		vendors = append(vendors, NewVendor(v))
+func NewListThirdPartiesOutput(thirdPartyPage *page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField]) ListThirdPartiesOutput {
+	thirdParties := make([]*ThirdParty, 0, len(thirdPartyPage.Data))
+	for _, v := range thirdPartyPage.Data {
+		thirdParties = append(thirdParties, NewThirdParty(v))
 	}
 
 	var nextCursor *page.CursorKey
-	if len(vendorPage.Data) > 0 {
-		cursorKey := vendorPage.Data[len(vendorPage.Data)-1].CursorKey(vendorPage.Cursor.OrderBy.Field)
+	if len(thirdPartyPage.Data) > 0 {
+		cursorKey := thirdPartyPage.Data[len(thirdPartyPage.Data)-1].CursorKey(thirdPartyPage.Cursor.OrderBy.Field)
 		nextCursor = &cursorKey
 	}
 
-	return ListVendorsOutput{
-		NextCursor: nextCursor,
-		Vendors:    vendors,
+	return ListThirdPartiesOutput{
+		NextCursor:   nextCursor,
+		ThirdParties: thirdParties,
 	}
 }
 
-func NewAddVendorOutput(v *coredata.Vendor) AddVendorOutput {
-	return AddVendorOutput{
-		Vendor: NewVendor(v),
+func NewAddThirdPartyOutput(v *coredata.ThirdParty) AddThirdPartyOutput {
+	return AddThirdPartyOutput{
+		ThirdParty: NewThirdParty(v),
 	}
 }
 
-func NewUpdateVendorOutput(v *coredata.Vendor) UpdateVendorOutput {
-	return UpdateVendorOutput{
-		Vendor: NewVendor(v),
+func NewUpdateThirdPartyOutput(v *coredata.ThirdParty) UpdateThirdPartyOutput {
+	return UpdateThirdPartyOutput{
+		ThirdParty: NewThirdParty(v),
 	}
 }
 
-func NewVendorContact(vc *coredata.VendorContact) *VendorContact {
+func NewThirdPartyContact(vc *coredata.ThirdPartyContact) *ThirdPartyContact {
 	var fullName string
 	if vc.FullName != nil {
 		fullName = *vc.FullName
@@ -142,22 +142,22 @@ func NewVendorContact(vc *coredata.VendorContact) *VendorContact {
 		role = *vc.Role
 	}
 
-	return &VendorContact{
-		ID:        vc.ID,
-		VendorID:  vc.VendorID,
-		FullName:  fullName,
-		Email:     email,
-		Phone:     phone,
-		Role:      role,
-		CreatedAt: vc.CreatedAt,
-		UpdatedAt: vc.UpdatedAt,
+	return &ThirdPartyContact{
+		ID:           vc.ID,
+		ThirdPartyID: vc.ThirdPartyID,
+		FullName:     fullName,
+		Email:        email,
+		Phone:        phone,
+		Role:         role,
+		CreatedAt:    vc.CreatedAt,
+		UpdatedAt:    vc.UpdatedAt,
 	}
 }
 
-func NewListVendorContactsOutput(p *page.Page[*coredata.VendorContact, coredata.VendorContactOrderField]) ListVendorContactsOutput {
-	contacts := make([]*VendorContact, 0, len(p.Data))
+func NewListThirdPartyContactsOutput(p *page.Page[*coredata.ThirdPartyContact, coredata.ThirdPartyContactOrderField]) ListThirdPartyContactsOutput {
+	contacts := make([]*ThirdPartyContact, 0, len(p.Data))
 	for _, vc := range p.Data {
-		contacts = append(contacts, NewVendorContact(vc))
+		contacts = append(contacts, NewThirdPartyContact(vc))
 	}
 
 	var nextCursor *page.CursorKey
@@ -166,32 +166,32 @@ func NewListVendorContactsOutput(p *page.Page[*coredata.VendorContact, coredata.
 		nextCursor = &cursorKey
 	}
 
-	return ListVendorContactsOutput{
-		NextCursor:     nextCursor,
-		VendorContacts: contacts,
+	return ListThirdPartyContactsOutput{
+		NextCursor:         nextCursor,
+		ThirdPartyContacts: contacts,
 	}
 }
 
-func NewVendorService(vs *coredata.VendorService) *VendorService {
+func NewThirdPartyService(vs *coredata.ThirdPartyService) *ThirdPartyService {
 	var description string
 	if vs.Description != nil {
 		description = *vs.Description
 	}
 
-	return &VendorService{
-		ID:          vs.ID,
-		VendorID:    vs.VendorID,
-		Name:        vs.Name,
-		Description: description,
-		CreatedAt:   vs.CreatedAt,
-		UpdatedAt:   vs.UpdatedAt,
+	return &ThirdPartyService{
+		ID:           vs.ID,
+		ThirdPartyID: vs.ThirdPartyID,
+		Name:         vs.Name,
+		Description:  description,
+		CreatedAt:    vs.CreatedAt,
+		UpdatedAt:    vs.UpdatedAt,
 	}
 }
 
-func NewListVendorServicesOutput(p *page.Page[*coredata.VendorService, coredata.VendorServiceOrderField]) ListVendorServicesOutput {
-	services := make([]*VendorService, 0, len(p.Data))
+func NewListThirdPartyServicesOutput(p *page.Page[*coredata.ThirdPartyService, coredata.ThirdPartyServiceOrderField]) ListThirdPartyServicesOutput {
+	services := make([]*ThirdPartyService, 0, len(p.Data))
 	for _, vs := range p.Data {
-		services = append(services, NewVendorService(vs))
+		services = append(services, NewThirdPartyService(vs))
 	}
 
 	var nextCursor *page.CursorKey
@@ -200,16 +200,16 @@ func NewListVendorServicesOutput(p *page.Page[*coredata.VendorService, coredata.
 		nextCursor = &cursorKey
 	}
 
-	return ListVendorServicesOutput{
-		NextCursor:     nextCursor,
-		VendorServices: services,
+	return ListThirdPartyServicesOutput{
+		NextCursor:         nextCursor,
+		ThirdPartyServices: services,
 	}
 }
 
-func NewVendorSubprocessors(sps []probo.Subprocessor) []*VendorSubprocessor {
-	result := make([]*VendorSubprocessor, len(sps))
+func NewThirdPartySubprocessors(sps []probo.Subprocessor) []*ThirdPartySubprocessor {
+	result := make([]*ThirdPartySubprocessor, len(sps))
 	for i, sp := range sps {
-		result[i] = &VendorSubprocessor{
+		result[i] = &ThirdPartySubprocessor{
 			Name:    sp.Name,
 			Country: sp.Country,
 			Purpose: sp.Purpose,
@@ -218,10 +218,10 @@ func NewVendorSubprocessors(sps []probo.Subprocessor) []*VendorSubprocessor {
 	return result
 }
 
-func NewAssessVendorOutput(result *probo.AssessVendorResult) AssessVendorOutput {
-	return AssessVendorOutput{
-		Vendor:        NewVendor(result.Vendor),
+func NewAssessThirdPartyOutput(result *probo.AssessThirdPartyResult) AssessThirdPartyOutput {
+	return AssessThirdPartyOutput{
+		ThirdParty:    NewThirdParty(result.ThirdParty),
 		Report:        result.Report,
-		Subprocessors: NewVendorSubprocessors(result.Subprocessors),
+		Subprocessors: NewThirdPartySubprocessors(result.Subprocessors),
 	}
 }

pkg/server/api/trust/v1/base_resolvers.go

@@ -97,13 +97,13 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 		}
 		return types.NewAudit(audit), nil
 
-	case coredata.VendorEntityType:
-		vendor, err := trustService.Vendors.Get(ctx, id)
+	case coredata.ThirdPartyEntityType:
+		thirdParty, err := trustService.ThirdParties.Get(ctx, id)
 		if err != nil {
-			r.logger.ErrorCtx(ctx, "cannot get vendor", log.Error(err))
+			r.logger.ErrorCtx(ctx, "cannot get thirdParty", log.Error(err))
 			return nil, gqlutils.Internal(ctx)
 		}
-		return types.NewSubprocessor(vendor), nil
+		return types.NewSubprocessor(thirdParty), nil
 
 	case coredata.TrustCenterEntityType:
 		trustCenter, err := trustService.TrustCenters.Get(ctx, id)

pkg/server/api/trust/v1/graphql/trust_center.graphql

@@ -163,73 +163,73 @@ type ComplianceFrameworkEdge
 }
 
 enum SubprocessorCategory
-  @goModel(model: "go.probo.inc/probo/pkg/coredata.VendorCategory") {
+  @goModel(model: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategory") {
   ANALYTICS
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryAnalytics")
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryAnalytics")
   CLOUD_MONITORING
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCloudMonitoring"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCloudMonitoring"
     )
   CLOUD_PROVIDER
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCloudProvider"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCloudProvider"
     )
   COLLABORATION
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCollaboration"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCollaboration"
     )
   CUSTOMER_SUPPORT
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryCustomerSupport"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryCustomerSupport"
     )
   DATA_STORAGE_AND_PROCESSING
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryDataStorageAndProcessing"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryDataStorageAndProcessing"
     )
   DOCUMENT_MANAGEMENT
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryDocumentManagement"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryDocumentManagement"
     )
   EMPLOYEE_MANAGEMENT
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEmployeeManagement"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryEmployeeManagement"
     )
   ENGINEERING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryEngineering")
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryEngineering")
   FINANCE
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryFinance")
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryFinance")
   IDENTITY_PROVIDER
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryIdentityProvider"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryIdentityProvider"
     )
-  IT @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryIT")
+  IT @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryIT")
   MARKETING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryMarketing")
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryMarketing")
   OFFICE_OPERATIONS
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryOfficeOperations"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryOfficeOperations"
     )
-  OTHER @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryOther")
+  OTHER @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryOther")
   PASSWORD_MANAGEMENT
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryPasswordManagement"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryPasswordManagement"
     )
   PRODUCT_AND_DESIGN
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryProductAndDesign"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryProductAndDesign"
     )
   PROFESSIONAL_SERVICES
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryProfessionalServices"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryProfessionalServices"
     )
   RECRUITING
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategoryRecruiting")
-  SALES @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySales")
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryRecruiting")
+  SALES @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategorySales")
   SECURITY
-    @goEnum(value: "go.probo.inc/probo/pkg/coredata.VendorCategorySecurity")
+    @goEnum(value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategorySecurity")
   VERSION_CONTROL
     @goEnum(
-      value: "go.probo.inc/probo/pkg/coredata.VendorCategoryVersionControl"
+      value: "go.probo.inc/probo/pkg/coredata.ThirdPartyCategoryVersionControl"
     )
 }
 

pkg/server/api/trust/v1/trust_center_resolvers.go

@@ -598,7 +598,7 @@ func (r *subprocessorConnectionResolver) TotalCount(ctx context.Context, obj *ty
 
 	switch obj.Resolver.(type) {
 	case *trustCenterResolver:
-		count, err := trustService.Vendors.CountForTrustCenterId(ctx, obj.ParentID)
+		count, err := trustService.ThirdParties.CountForTrustCenterId(ctx, obj.ParentID)
 		if err != nil {
 			r.logger.ErrorCtx(ctx, "cannot count subprocessors", log.Error(err))
 			return 0, gqlutils.Internal(ctx)
@@ -717,19 +717,19 @@ func (r *trustCenterResolver) Audits(ctx context.Context, obj *types.TrustCenter
 func (r *trustCenterResolver) Subprocessors(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.SubprocessorConnection, error) {
 	trustService := r.TrustService(ctx, obj.ID.TenantID())
 
-	pageOrderBy := page.OrderBy[coredata.VendorOrderField]{
-		Field:     coredata.VendorOrderFieldName,
+	pageOrderBy := page.OrderBy[coredata.ThirdPartyOrderField]{
+		Field:     coredata.ThirdPartyOrderFieldName,
 		Direction: page.OrderDirectionAsc,
 	}
 	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
 
-	vendorPage, err := trustService.Vendors.ListForOrganizationId(ctx, obj.Organization.ID, cursor)
+	thirdPartyPage, err := trustService.ThirdParties.ListForOrganizationId(ctx, obj.Organization.ID, cursor)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list subprocessors", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
 	}
 
-	return types.NewSubprocessorConnection(vendorPage, r, obj.ID), nil
+	return types.NewSubprocessorConnection(thirdPartyPage, r, obj.ID), nil
 }
 
 // References is the resolver for the references field.

pkg/server/api/trust/v1/types/third_party.go

@@ -32,13 +32,13 @@ type (
 )
 
 func NewSubprocessorConnection(
-	p *page.Page[*coredata.Vendor, coredata.VendorOrderField],
+	p *page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField],
 	parentType any,
 	parentID gid.GID,
 ) *SubprocessorConnection {
 	edges := make([]*SubprocessorEdge, len(p.Data))
-	for i, vendor := range p.Data {
-		edges[i] = NewSubprocessorEdge(vendor, p.Cursor.OrderBy.Field)
+	for i, thirdParty := range p.Data {
+		edges[i] = NewSubprocessorEdge(thirdParty, p.Cursor.OrderBy.Field)
 	}
 
 	return &SubprocessorConnection{
@@ -50,7 +50,7 @@ func NewSubprocessorConnection(
 	}
 }
 
-func NewSubprocessor(v *coredata.Vendor) *Subprocessor {
+func NewSubprocessor(v *coredata.ThirdParty) *Subprocessor {
 	return &Subprocessor{
 		ID:               v.ID,
 		Name:             v.Name,
@@ -62,7 +62,7 @@ func NewSubprocessor(v *coredata.Vendor) *Subprocessor {
 	}
 }
 
-func NewSubprocessorEdge(v *coredata.Vendor, orderField coredata.VendorOrderField) *SubprocessorEdge {
+func NewSubprocessorEdge(v *coredata.ThirdParty, orderField coredata.ThirdPartyOrderField) *SubprocessorEdge {
 	return &SubprocessorEdge{
 		Node:   NewSubprocessor(v),
 		Cursor: v.CursorKey(orderField),

pkg/trust/compliance_page_service.go

@@ -66,7 +66,7 @@ type (
 		Frameworks    []compliancePageFramework
 		Documents     []compliancePageDocument
 		Audits        []compliancePageAudit
-		Vendors       []compliancePageVendor
+		ThirdParties  []compliancePageThirdParty
 		References    []compliancePageReference
 		ExternalLinks []compliancePageExternalLink
 	}
@@ -93,7 +93,7 @@ type (
 		ValidUntil string
 	}
 
-	compliancePageVendor struct {
+	compliancePageThirdParty struct {
 		Name      string
 		Category  string
 		Countries string
@@ -158,9 +158,9 @@ func (s *Service) RenderCompliancePageMarkdown(
 		return fmt.Errorf("cannot fetch audits: %w", err)
 	}
 
-	data.Vendors, err = s.fetchVendors(ctx, tenantSvc, org.ID)
+	data.ThirdParties, err = s.fetchThirdParties(ctx, tenantSvc, org.ID)
 	if err != nil {
-		return fmt.Errorf("cannot fetch vendors: %w", err)
+		return fmt.Errorf("cannot fetch thirdParties: %w", err)
 	}
 
 	data.References, err = s.fetchReferences(ctx, tenantSvc, trustCenterID)
@@ -429,8 +429,8 @@ func (s *Service) fetchAudits(ctx context.Context, tenantSvc *TenantService, org
 	return audits, nil
 }
 
-func (s *Service) fetchVendors(ctx context.Context, tenantSvc *TenantService, orgID gid.GID) ([]compliancePageVendor, error) {
-	var vendors []compliancePageVendor
+func (s *Service) fetchThirdParties(ctx context.Context, tenantSvc *TenantService, orgID gid.GID) ([]compliancePageThirdParty, error) {
+	var thirdParties []compliancePageThirdParty
 
 	var cursorKey *page.CursorKey
 	for {
@@ -438,15 +438,15 @@ func (s *Service) fetchVendors(ctx context.Context, tenantSvc *TenantService, or
 			page.MaxCursorSize,
 			cursorKey,
 			page.Head,
-			page.OrderBy[coredata.VendorOrderField]{
-				Field:     coredata.VendorOrderFieldName,
+			page.OrderBy[coredata.ThirdPartyOrderField]{
+				Field:     coredata.ThirdPartyOrderFieldName,
 				Direction: page.OrderDirectionAsc,
 			},
 		)
 
-		result, err := tenantSvc.Vendors.ListForOrganizationId(ctx, orgID, cursor)
+		result, err := tenantSvc.ThirdParties.ListForOrganizationId(ctx, orgID, cursor)
 		if err != nil {
-			return nil, fmt.Errorf("cannot list vendors: %w", err)
+			return nil, fmt.Errorf("cannot list thirdParties: %w", err)
 		}
 
 		for _, v := range result.Data {
@@ -455,9 +455,9 @@ func (s *Service) fetchVendors(ctx context.Context, tenantSvc *TenantService, or
 				countries = append(countries, c.String())
 			}
 
-			vendors = append(
-				vendors,
-				compliancePageVendor{
+			thirdParties = append(
+				thirdParties,
+				compliancePageThirdParty{
 					Name:      v.Name,
 					Category:  v.Category.String(),
 					Countries: strings.Join(countries, ", "),
@@ -471,11 +471,11 @@ func (s *Service) fetchVendors(ctx context.Context, tenantSvc *TenantService, or
 		}
 
 		last := result.Data[len(result.Data)-1]
-		ck := last.CursorKey(coredata.VendorOrderFieldName)
+		ck := last.CursorKey(coredata.ThirdPartyOrderFieldName)
 		cursorKey = &ck
 	}
 
-	return vendors, nil
+	return thirdParties, nil
 }
 
 func (s *Service) fetchReferences(ctx context.Context, tenantSvc *TenantService, trustCenterID gid.GID) ([]compliancePageReference, error) {

pkg/trust/service.go

@@ -65,7 +65,7 @@ type (
 		TrustCenters           *TrustCenterService
 		Documents              *DocumentService
 		Audits                 *AuditService
-		Vendors                *VendorService
+		ThirdParties           *ThirdPartyService
 		Frameworks             *FrameworkService
 		ComplianceFrameworks   *ComplianceFrameworkService
 		TrustCenterAccesses    *TrustCenterAccessService
@@ -124,7 +124,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.TrustCenters = &TrustCenterService{svc: tenantService}
 	tenantService.Documents = &DocumentService{svc: tenantService, html2pdfConverter: s.html2pdfConverter}
 	tenantService.Audits = &AuditService{svc: tenantService}
-	tenantService.Vendors = &VendorService{svc: tenantService}
+	tenantService.ThirdParties = &ThirdPartyService{svc: tenantService}
 	tenantService.Frameworks = &FrameworkService{svc: tenantService}
 	tenantService.ComplianceFrameworks = &ComplianceFrameworkService{svc: tenantService}
 	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService, iamSvc: s.iam, logger: s.logger}

pkg/trust/third_party_service.go

@@ -24,22 +24,22 @@ import (
 	"go.probo.inc/probo/pkg/page"
 )
 
-type VendorService struct {
+type ThirdPartyService struct {
 	svc *TenantService
 }
 
-func (s VendorService) Get(
+func (s ThirdPartyService) Get(
 	ctx context.Context,
-	vendorID gid.GID,
-) (*coredata.Vendor, error) {
-	vendor := &coredata.Vendor{}
+	thirdPartyID gid.GID,
+) (*coredata.ThirdParty, error) {
+	thirdParty := &coredata.ThirdParty{}
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := vendor.LoadByID(ctx, conn, s.svc.scope, vendorID)
+			err := thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyID)
 			if err != nil {
-				return fmt.Errorf("cannot load vendor: %w", err)
+				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
 
 			return nil
@@ -50,25 +50,25 @@ func (s VendorService) Get(
 		return nil, err
 	}
 
-	return vendor, nil
+	return thirdParty, nil
 }
 
-func (s VendorService) ListForOrganizationId(
+func (s ThirdPartyService) ListForOrganizationId(
 	ctx context.Context,
 	organizationID gid.GID,
-	cursor *page.Cursor[coredata.VendorOrderField],
-) (*page.Page[*coredata.Vendor, coredata.VendorOrderField], error) {
-	var vendors coredata.Vendors
+	cursor *page.Cursor[coredata.ThirdPartyOrderField],
+) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
+	var thirdParties coredata.ThirdParties
 
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			showOnTrustCenter := true
-			filter := coredata.NewVendorFilter(&showOnTrustCenter)
+			filter := coredata.NewThirdPartyFilter(&showOnTrustCenter)
 
-			err := vendors.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor, filter)
+			err := thirdParties.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor, filter)
 			if err != nil {
-				return fmt.Errorf("cannot load vendors: %w", err)
+				return fmt.Errorf("cannot load thirdParties: %w", err)
 			}
 
 			return nil
@@ -79,10 +79,10 @@ func (s VendorService) ListForOrganizationId(
 		return nil, err
 	}
 
-	return page.NewPage(vendors, cursor), nil
+	return page.NewPage(thirdParties, cursor), nil
 }
 
-func (s VendorService) CountForTrustCenterId(
+func (s ThirdPartyService) CountForTrustCenterId(
 	ctx context.Context,
 	trustCenterID gid.GID,
 ) (int, error) {
@@ -96,12 +96,12 @@ func (s VendorService) CountForTrustCenterId(
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}
 
-			vendors := &coredata.Vendors{}
+			thirdParties := &coredata.ThirdParties{}
 			showOnTrustCenter := true
-			filter := coredata.NewVendorFilter(&showOnTrustCenter)
-			count, err = vendors.CountByOrganizationID(ctx, conn, s.svc.scope, trustCenter.OrganizationID, filter)
+			filter := coredata.NewThirdPartyFilter(&showOnTrustCenter)
+			count, err = thirdParties.CountByOrganizationID(ctx, conn, s.svc.scope, trustCenter.OrganizationID, filter)
 			if err != nil {
-				return fmt.Errorf("cannot count vendors: %w", err)
+				return fmt.Errorf("cannot count thirdParties: %w", err)
 			}
 
 			return nil

pkg/vetting/assessment.go

@@ -30,7 +30,7 @@ import (
 
 const (
 	// DefaultMaxTokens is the fallback max-tokens budget used when the
-	// vendor-assessor agent config does not specify a value. Sized to
+	// third-party-assessor agent config does not specify a value. Sized to
 	// leave headroom above the orchestrator's thinking budget on
 	// Anthropic models.
 	DefaultMaxTokens = 16384
@@ -40,15 +40,15 @@ const (
 	AssessmentTimeout = 20 * time.Minute
 
 	// extractionTimeout is the dedicated budget for the final
-	// vendor_info_extractor turn. It runs outside the orchestrator's
+	// third_party_info_extractor turn. It runs outside the orchestrator's
 	// budget so a slow orchestrator can't starve the extractor.
 	extractionTimeout = 5 * time.Minute
 )
 
-// vendorCategoryEnum is the canonical list of allowed values for
-// VendorInfo.Category. It is duplicated into the jsonschema struct tag
+// thirdPartyCategoryEnum is the canonical list of allowed values for
+// ThirdPartyInfo.Category. It is duplicated into the jsonschema struct tag
 // because Go struct tags must be compile-time string literals.
-var vendorCategoryEnum = []string{
+var thirdPartyCategoryEnum = []string{
 	"ANALYTICS", "ACCOUNTING", "CLOUD_MONITORING", "CLOUD_PROVIDER",
 	"COLLABORATION", "CONSULTING", "CUSTOMER_SUPPORT",
 	"DATA_STORAGE_AND_PROCESSING", "DOCUMENT_MANAGEMENT",
@@ -58,9 +58,9 @@ var vendorCategoryEnum = []string{
 	"RECRUITING", "SALES", "SECURITY", "STAFFING", "VERSION_CONTROL",
 }
 
-// vendorTypeEnum is the canonical list of allowed values for
-// VendorInfo.VendorType.
-var vendorTypeEnum = []string{
+// thirdPartyTypeEnum is the canonical list of allowed values for
+// ThirdPartyInfo.ThirdPartyType.
+var thirdPartyTypeEnum = []string{
 	"SAAS", "INFRASTRUCTURE", "PROFESSIONAL_SERVICES", "STAFFING", "OTHER",
 }
 
@@ -95,22 +95,22 @@ type (
 		Notes    string `json:"notes"`
 	}
 
-	VendorInfo struct {
-		Name                          string         `json:"name" jsonschema:"Vendor display name as shown on the website"`
-		Description                   string         `json:"description" jsonschema:"One-sentence description of what the vendor does"`
-		Category                      string         `json:"category" jsonschema:"Vendor category; one of vendorCategoryEnum"`
-		VendorType                    string         `json:"vendor_type" jsonschema:"Vendor type; one of vendorTypeEnum"`
-		HeadquarterAddress            string         `json:"headquarter_address" jsonschema:"Vendor headquarters address (city, country) if mentioned"`
+	ThirdPartyInfo struct {
+		Name                          string         `json:"name" jsonschema:"Third party display name as shown on the website"`
+		Description                   string         `json:"description" jsonschema:"One-sentence description of what the third party does"`
+		Category                      string         `json:"category" jsonschema:"Third party category; one of thirdPartyCategoryEnum"`
+		ThirdPartyType                string         `json:"third_party_type" jsonschema:"Third party type; one of thirdPartyTypeEnum"`
+		HeadquarterAddress            string         `json:"headquarter_address" jsonschema:"Third party headquarters address (city, country) if mentioned"`
 		LegalName                     string         `json:"legal_name" jsonschema:"Legal entity name if different from display name (e.g. 'Datadog, Inc.')"`
-		PrivacyPolicyURL              string         `json:"privacy_policy_url" jsonschema:"URL to the vendor's privacy policy page"`
+		PrivacyPolicyURL              string         `json:"privacy_policy_url" jsonschema:"URL to the third_party's privacy policy page"`
 		ServiceLevelAgreementURL      string         `json:"service_level_agreement_url" jsonschema:"URL to the SLA page"`
 		DataProcessingAgreementURL    string         `json:"data_processing_agreement_url" jsonschema:"URL to the DPA page"`
 		BusinessAssociateAgreementURL string         `json:"business_associate_agreement_url" jsonschema:"URL to the BAA page if HIPAA-eligible"`
 		SubprocessorsListURL          string         `json:"subprocessors_list_url" jsonschema:"URL to the public subprocessors list"`
-		SecurityPageURL               string         `json:"security_page_url" jsonschema:"URL to the vendor's security page"`
+		SecurityPageURL               string         `json:"security_page_url" jsonschema:"URL to the third_party's security page"`
 		TrustPageURL                  string         `json:"trust_page_url" jsonschema:"URL to the trust center"`
 		TermsOfServiceURL             string         `json:"terms_of_service_url" jsonschema:"URL to the terms of service"`
-		StatusPageURL                 string         `json:"status_page_url" jsonschema:"URL to the vendor's status / uptime page"`
+		StatusPageURL                 string         `json:"status_page_url" jsonschema:"URL to the third_party's status / uptime page"`
 		BugBountyURL                  string         `json:"bug_bounty_url" jsonschema:"URL to the bug bounty or responsible disclosure program"`
 		IncidentResponseURL           string         `json:"incident_response_url" jsonschema:"URL to incident response or post-mortem documentation"`
 		DataLocations                 []string       `json:"data_locations" jsonschema:"Countries or regions where data is processed or stored (e.g. 'United States', 'EU', 'Germany')"`
@@ -119,19 +119,19 @@ type (
 
 		// Privacy classification (ISO 27701).
 		PrivacyRole         string `json:"privacy_role" jsonschema:"Privacy role under ISO 27701: CONTROLLER, PROCESSOR, SUBPROCESSOR, NONE"`
-		ProcessesPII        bool   `json:"processes_pii" jsonschema:"Whether the vendor processes personal data"`
+		ProcessesPII        bool   `json:"processes_pii" jsonschema:"Whether the third_party processes personal data"`
 		CrossBorderTransfer bool   `json:"cross_border_transfer" jsonschema:"Whether cross-border data transfers occur"`
 
 		// Privacy risk fields.
 		DPAStatus         string `json:"dpa_status" jsonschema:"DPA accessibility: AVAILABLE, AVAILABLE_ON_REQUEST, NOT_FOUND, BEHIND_LOGIN"`
-		DSARCapability    string `json:"dsar_capability" jsonschema:"Brief summary of how the vendor handles Data Subject Access Requests"`
+		DSARCapability    string `json:"dsar_capability" jsonschema:"Brief summary of how the third_party handles Data Subject Access Requests"`
 		DataMinimization  string `json:"data_minimization" jsonschema:"Brief summary of data minimization practices"`
 		PurposeLimitation string `json:"purpose_limitation" jsonschema:"Brief summary of purpose limitation commitments"`
 		RetentionPolicy   string `json:"retention_policy" jsonschema:"Brief summary of data retention policy"`
 		DeletionPolicy    string `json:"deletion_policy" jsonschema:"Brief summary of data deletion policy"`
 
 		// AI classification (ISO 42001).
-		InvolvesAI bool     `json:"involves_ai" jsonschema:"Whether the vendor uses AI/ML in their product or service"`
+		InvolvesAI bool     `json:"involves_ai" jsonschema:"Whether the third_party uses AI/ML in their product or service"`
 		AIUseCases []string `json:"ai_use_cases" jsonschema:"Array of AI use case descriptions (e.g. 'content generation', 'fraud detection')"`
 
 		// AI risk fields.
@@ -165,7 +165,7 @@ type (
 
 	Result struct {
 		Document string
-		Info     VendorInfo
+		Info     ThirdPartyInfo
 	}
 )
 
@@ -191,10 +191,10 @@ func (a *Assessor) Assess(ctx context.Context, websiteURL string, procedure stri
 	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), AssessmentTimeout)
 	defer cancel()
 
-	vendorBrowser := browser.NewBrowser(ctx, a.cfg.ChromeAddr)
-	defer vendorBrowser.Close()
+	thirdPartyBrowser := browser.NewBrowser(ctx, a.cfg.ChromeAddr)
+	defer thirdPartyBrowser.Close()
 
-	vendorBrowser.SetAllowedDomain(u.Hostname())
+	thirdPartyBrowser.SetAllowedDomain(u.Hostname())
 
 	// Create an unrestricted browser for web search agents that need to
 	// follow links to external sites (news, reviews, etc.).
@@ -207,7 +207,7 @@ func (a *Assessor) Assess(ctx context.Context, websiteURL string, procedure stri
 		a.cfg.MaxTokens,
 		procedure,
 		a.cfg.Logger,
-		vendorBrowser,
+		thirdPartyBrowser,
 		researchBrowser,
 		a.cfg.SearchEndpoint,
 		reporter,
@@ -226,20 +226,20 @@ func (a *Assessor) Assess(ctx context.Context, websiteURL string, procedure stri
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot assess vendor: %w", err)
+		return nil, fmt.Errorf("cannot assess thirdParty: %w", err)
 	}
 
 	document := result.FinalMessage().Text()
 
-	reportProgress(ctx, reporter, "extract_vendor_info", agent.ProgressEventStepStarted)
+	reportProgress(ctx, reporter, "extract_third_party_info", agent.ProgressEventStepStarted)
 
-	info, err := a.extractVendorInfo(ctx, document)
+	info, err := a.extractThirdPartyInfo(ctx, document)
 	if err != nil {
-		reportProgress(ctx, reporter, "extract_vendor_info", agent.ProgressEventStepFailed)
-		return nil, fmt.Errorf("cannot extract vendor info: %w", err)
+		reportProgress(ctx, reporter, "extract_third_party_info", agent.ProgressEventStepFailed)
+		return nil, fmt.Errorf("cannot extract thirdParty info: %w", err)
 	}
 
-	reportProgress(ctx, reporter, "extract_vendor_info", agent.ProgressEventStepCompleted)
+	reportProgress(ctx, reporter, "extract_third_party_info", agent.ProgressEventStepCompleted)
 
 	return &Result{
 		Document: document,
@@ -247,10 +247,10 @@ func (a *Assessor) Assess(ctx context.Context, websiteURL string, procedure stri
 	}, nil
 }
 
-func (a *Assessor) extractVendorInfo(ctx context.Context, document string) (*VendorInfo, error) {
-	outputType, err := vendorInfoOutputType()
+func (a *Assessor) extractThirdPartyInfo(ctx context.Context, document string) (*ThirdPartyInfo, error) {
+	outputType, err := thirdPartyInfoOutputType()
 	if err != nil {
-		return nil, fmt.Errorf("cannot build vendor info output type: %w", err)
+		return nil, fmt.Errorf("cannot build thirdParty info output type: %w", err)
 	}
 
 	// Run the extractor on its own timeout so a slow orchestrator
@@ -264,7 +264,7 @@ func (a *Assessor) extractVendorInfo(ctx context.Context, document string) (*Ven
 	defer cancel()
 
 	extractor := agent.New(
-		"vendor_info_extractor",
+		"third_party_info_extractor",
 		a.cfg.Client,
 		agent.WithInstructions(extractionPrompt),
 		agent.WithModel(a.cfg.Model),
@@ -283,53 +283,53 @@ func (a *Assessor) extractVendorInfo(ctx context.Context, document string) (*Ven
 		},
 	)
 	if err != nil {
-		return nil, fmt.Errorf("cannot extract vendor info: %w", err)
+		return nil, fmt.Errorf("cannot extract thirdParty info: %w", err)
 	}
 
-	var info VendorInfo
+	var info ThirdPartyInfo
 	if err := json.Unmarshal([]byte(result.FinalMessage().Text()), &info); err != nil {
-		return nil, fmt.Errorf("cannot parse vendor info output: %w", err)
+		return nil, fmt.Errorf("cannot parse thirdParty info output: %w", err)
 	}
 
 	return &info, nil
 }
 
-// vendorInfoOutputType builds the VendorInfo structured output type and
+// thirdPartyInfoOutputType builds the ThirdPartyInfo structured output type and
 // decorates its JSON Schema with explicit enum constraints on fields
 // whose allowed values live in package-level slices. jsonschema-go only
 // reads struct tags as free-form descriptions, so the enum list cannot
 // be encoded in the tag itself.
-func vendorInfoOutputType() (*agent.OutputType, error) {
-	outputType, err := agent.NewOutputType[VendorInfo]("vendor_info")
+func thirdPartyInfoOutputType() (*agent.OutputType, error) {
+	outputType, err := agent.NewOutputType[ThirdPartyInfo]("third_party_info")
 	if err != nil {
-		return nil, fmt.Errorf("cannot create vendor info output type: %w", err)
+		return nil, fmt.Errorf("cannot create thirdParty info output type: %w", err)
 	}
 
 	var schema map[string]any
 	if err := json.Unmarshal(outputType.Schema, &schema); err != nil {
-		return nil, fmt.Errorf("cannot unmarshal vendor info schema: %w", err)
+		return nil, fmt.Errorf("cannot unmarshal thirdParty info schema: %w", err)
 	}
 
 	properties, ok := schema["properties"].(map[string]any)
 	if !ok {
-		return nil, fmt.Errorf("vendor info schema has no properties")
+		return nil, fmt.Errorf("thirdParty info schema has no properties")
 	}
 
 	enums := map[string][]string{
-		"category":    vendorCategoryEnum,
-		"vendor_type": vendorTypeEnum,
+		"category":         thirdPartyCategoryEnum,
+		"third_party_type": thirdPartyTypeEnum,
 	}
 	for field, values := range enums {
 		prop, ok := properties[field].(map[string]any)
 		if !ok {
-			return nil, fmt.Errorf("vendor info schema has no %q property", field)
+			return nil, fmt.Errorf("thirdParty info schema has no %q property", field)
 		}
 		prop["enum"] = values
 	}
 
 	decorated, err := json.Marshal(schema)
 	if err != nil {
-		return nil, fmt.Errorf("cannot marshal decorated vendor info schema: %w", err)
+		return nil, fmt.Errorf("cannot marshal decorated thirdParty info schema: %w", err)
 	}
 	outputType.Schema = decorated