Rename vendors to third parties

Renames the user-facing 'vendor' concept to 'third party' across the entire codebase. The shared common_third_parties reference table is unchanged. Migration. Renames the vendor_category enum, the vendors and vendor_<entity> tables (contacts, services, compliance_reports, business_associate_agreements, data_privacy_agreements, risk_assessments) and their vendor_id columns, the asset_vendors / data_vendors / processing_activity_vendors junction tables, generated_documents.vendors_document_id, the webhook_event_type 'vendor:<verb>' values, and the snapshots_type 'VENDORS' value. Backend. Renames coredata models and SQL queries, probo services, GraphQL / MCP API surface, console / trust / webhook resolvers and types, the CLI (prb vendor* -> prb third-party*; pkg/cmd/vendormgmt -> pkg/cmd/thirdpartymgmt), the document generator, vetting agent prompts, and the common-third-parties-import command. Frontend, packages, n8n, e2e. Renames apps/console pages, components, hooks, routes, dialogs, and tabs; the shared @probo/vendors package (now @probo/third-parties); the @probo/ui Vendors atoms (now ThirdParties, VendorLogo -> ThirdPartyLogo); the n8n community node actions/vendor folder (now actions/thirdParty); and the e2e Go test suite (console and MCP). Filesystem and URL paths use kebab-case (third-parties), GraphQL fields and TypeScript identifiers use camelCase (thirdParty / thirdParties), Go types use PascalCase (ThirdParty), and human-facing text uses 'third party' with a space. Co-authored-by: Bryan Frimin <bryan@getprobo.com> Signed-off-by: Bryan Frimin <bryan@getprobo.com> Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-05-13 16:15:33 +02:00
parent 9eed0d71c8
commit eecbe4c46c
281 changed files with 8491 additions and 8425 deletions
--- a/pkg/coredata/asset_third_party.go
+++ b/pkg/coredata/asset_third_party.go
@@ -25,41 +25,41 @@ import (
 )

 type (
-	AssetVendor struct {
-		AssetID   gid.GID      `db:"asset_id"`
-		VendorID  gid.GID      `db:"vendor_id"`
-		TenantID  gid.TenantID `db:"tenant_id"`
-		CreatedAt time.Time    `db:"created_at"`
+	AssetThirdParty struct {
+		AssetID      gid.GID      `db:"asset_id"`
+		ThirdPartyID gid.GID      `db:"third_party_id"`
+		TenantID     gid.TenantID `db:"tenant_id"`
+		CreatedAt    time.Time    `db:"created_at"`
 	}

-	AssetVendors []*AssetVendor
+	AssetThirdParties []*AssetThirdParty
 )

-func (av AssetVendors) Merge(
+func (av AssetThirdParties) Merge(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	assetID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
+WITH third_party_ids AS (
 	SELECT
-		unnest(@vendor_ids::text[]) AS vendor_id,
+		unnest(@third_party_ids::text[]) AS third_party_id,
 		@tenant_id AS tenant_id,
 		@asset_id AS asset_id,
 		@organization_id AS organization_id,
 		@created_at::timestamptz AS created_at
 )
-MERGE INTO asset_vendors AS tgt
-USING vendor_ids AS src
+MERGE INTO asset_third_parties AS tgt
+USING third_party_ids AS src
 ON tgt.tenant_id = src.tenant_id
 	AND tgt.asset_id = src.asset_id
-	AND tgt.vendor_id = src.vendor_id
+	AND tgt.third_party_id = src.third_party_id
 WHEN NOT MATCHED
-	THEN INSERT (tenant_id, asset_id, vendor_id, organization_id, created_at)
-		VALUES (src.tenant_id, src.asset_id, src.vendor_id, src.organization_id, src.created_at)
+	THEN INSERT (tenant_id, asset_id, third_party_id, organization_id, created_at)
+		VALUES (src.tenant_id, src.asset_id, src.third_party_id, src.organization_id, src.created_at)
 	WHEN NOT MATCHED BY SOURCE
 		AND tgt.tenant_id = @tenant_id AND tgt.asset_id = @asset_id
 		THEN DELETE
@@ -70,37 +70,37 @@ WHEN NOT MATCHED
 		"asset_id":        assetID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot merge asset vendors: %w", err)
+		return fmt.Errorf("cannot merge asset thirdParties: %w", err)
 	}

 	return nil
 }

-func (av AssetVendors) Insert(
+func (av AssetThirdParties) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 	assetID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
-	SELECT unnest(@vendor_ids::text[]) AS vendor_id
+WITH third_party_ids AS (
+	SELECT unnest(@third_party_ids::text[]) AS third_party_id
 )
-INSERT INTO asset_vendors (tenant_id, asset_id, vendor_id, organization_id, created_at)
+INSERT INTO asset_third_parties (tenant_id, asset_id, third_party_id, organization_id, created_at)
 SELECT
 	@tenant_id AS tenant_id,
 	@asset_id AS asset_id,
-	vendor_id,
+	third_party_id,
 	@organization_id AS organization_id,
 	@created_at AS created_at
-FROM vendor_ids
+FROM third_party_ids
 `

 	args := pgx.StrictNamedArgs{
@@ -108,12 +108,12 @@ FROM vendor_ids
 		"asset_id":        assetID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert asset vendors: %w", err)
+		return fmt.Errorf("cannot insert asset thirdParties: %w", err)
 	}

 	return nil
--- a/pkg/coredata/audit_log_resource_type.go
+++ b/pkg/coredata/audit_log_resource_type.go
@@ -29,12 +29,12 @@ func ResourceTypeName(entityType uint16) string {
 		return "Evidence"
 	case ConnectorEntityType:
 		return "Connector"
-	case VendorRiskAssessmentEntityType:
-		return "VendorRiskAssessment"
-	case VendorEntityType:
-		return "Vendor"
-	case VendorComplianceReportEntityType:
-		return "VendorComplianceReport"
+	case ThirdPartyRiskAssessmentEntityType:
+		return "ThirdPartyRiskAssessment"
+	case ThirdPartyEntityType:
+		return "ThirdParty"
+	case ThirdPartyComplianceReportEntityType:
+		return "ThirdPartyComplianceReport"
 	case DocumentEntityType:
 		return "Document"
 	case IdentityEntityType:
@@ -59,20 +59,20 @@ func ResourceTypeName(entityType uint16) string {
 		return "TrustCenter"
 	case TrustCenterAccessEntityType:
 		return "TrustCenterAccess"
-	case VendorBusinessAssociateAgreementEntityType:
-		return "VendorBusinessAssociateAgreement"
+	case ThirdPartyBusinessAssociateAgreementEntityType:
+		return "ThirdPartyBusinessAssociateAgreement"
 	case FileEntityType:
 		return "File"
-	case VendorContactEntityType:
-		return "VendorContact"
-	case VendorDataPrivacyAgreementEntityType:
-		return "VendorDataPrivacyAgreement"
+	case ThirdPartyContactEntityType:
+		return "ThirdPartyContact"
+	case ThirdPartyDataPrivacyAgreementEntityType:
+		return "ThirdPartyDataPrivacyAgreement"
 	case FindingEntityType:
 		return "Finding"
 	case ObligationEntityType:
 		return "Obligation"
-	case VendorServiceEntityType:
-		return "VendorService"
+	case ThirdPartyServiceEntityType:
+		return "ThirdPartyService"
 	case ProcessingActivityEntityType:
 		return "ProcessingActivity"
 	case TrustCenterReferenceEntityType:
--- a/pkg/coredata/common_third_party.go
+++ b/pkg/coredata/common_third_party.go
@@ -28,26 +28,26 @@ import (

 type (
 	CommonThirdParty struct {
-		ID                            gid.GID        `db:"id"`
-		Name                          string         `db:"name"`
-		Category                      VendorCategory `db:"category"`
-		HeadquarterAddress            *string        `db:"headquarter_address"`
-		LegalName                     *string        `db:"legal_name"`
-		WebsiteURL                    *string        `db:"website_url"`
-		PrivacyPolicyURL              *string        `db:"privacy_policy_url"`
-		ServiceLevelAgreementURL      *string        `db:"service_level_agreement_url"`
-		ServiceSoftwareAgreementURL   *string        `db:"service_software_agreement_url"`
-		DataProcessingAgreementURL    *string        `db:"data_processing_agreement_url"`
-		BusinessAssociateAgreementURL *string        `db:"business_associate_agreement_url"`
-		SubprocessorsListURL          *string        `db:"subprocessors_list_url"`
-		Certifications                []string       `db:"certifications"`
-		StatusPageURL                 *string        `db:"status_page_url"`
-		TermsOfServiceURL             *string        `db:"terms_of_service_url"`
-		SecurityPageURL               *string        `db:"security_page_url"`
-		TrustPageURL                  *string        `db:"trust_page_url"`
-		LogoFileID                    *gid.GID       `db:"logo_file_id"`
-		CreatedAt                     time.Time      `db:"created_at"`
-		UpdatedAt                     time.Time      `db:"updated_at"`
+		ID                            gid.GID            `db:"id"`
+		Name                          string             `db:"name"`
+		Category                      ThirdPartyCategory `db:"category"`
+		HeadquarterAddress            *string            `db:"headquarter_address"`
+		LegalName                     *string            `db:"legal_name"`
+		WebsiteURL                    *string            `db:"website_url"`
+		PrivacyPolicyURL              *string            `db:"privacy_policy_url"`
+		ServiceLevelAgreementURL      *string            `db:"service_level_agreement_url"`
+		ServiceSoftwareAgreementURL   *string            `db:"service_software_agreement_url"`
+		DataProcessingAgreementURL    *string            `db:"data_processing_agreement_url"`
+		BusinessAssociateAgreementURL *string            `db:"business_associate_agreement_url"`
+		SubprocessorsListURL          *string            `db:"subprocessors_list_url"`
+		Certifications                []string           `db:"certifications"`
+		StatusPageURL                 *string            `db:"status_page_url"`
+		TermsOfServiceURL             *string            `db:"terms_of_service_url"`
+		SecurityPageURL               *string            `db:"security_page_url"`
+		TrustPageURL                  *string            `db:"trust_page_url"`
+		LogoFileID                    *gid.GID           `db:"logo_file_id"`
+		CreatedAt                     time.Time          `db:"created_at"`
+		UpdatedAt                     time.Time          `db:"updated_at"`
 	}

 	CommonThirdParties []*CommonThirdParty
--- a/pkg/coredata/datum_third_party.go
+++ b/pkg/coredata/datum_third_party.go
@@ -25,40 +25,40 @@ import (
 )

 type (
-	DatumVendor struct {
-		DatumID   gid.GID   `db:"datum_id"`
-		VendorID  gid.GID   `db:"vendor_id"`
-		CreatedAt time.Time `db:"created_at"`
+	DatumThirdParty struct {
+		DatumID      gid.GID   `db:"datum_id"`
+		ThirdPartyID gid.GID   `db:"third_party_id"`
+		CreatedAt    time.Time `db:"created_at"`
 	}

-	DatumVendors []*DatumVendor
+	DatumThirdParties []*DatumThirdParty
 )

-func (dv DatumVendors) Merge(
+func (dv DatumThirdParties) Merge(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	datumID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
+WITH third_party_ids AS (
 	SELECT
-		unnest(@vendor_ids::text[]) AS vendor_id,
+		unnest(@third_party_ids::text[]) AS third_party_id,
 		@tenant_id AS tenant_id,
 		@datum_id AS datum_id,
 		@organization_id AS organization_id,
 		@created_at::timestamptz AS created_at
 )
-MERGE INTO data_vendors AS tgt
-USING vendor_ids AS src
+MERGE INTO data_third_parties AS tgt
+USING third_party_ids AS src
 ON tgt.tenant_id = src.tenant_id
 	AND tgt.datum_id = src.datum_id
-	AND tgt.vendor_id = src.vendor_id
+	AND tgt.third_party_id = src.third_party_id
 WHEN NOT MATCHED THEN
-	INSERT (tenant_id, datum_id, vendor_id, organization_id, created_at)
-	VALUES (src.tenant_id, src.datum_id, src.vendor_id, src.organization_id, src.created_at)
+	INSERT (tenant_id, datum_id, third_party_id, organization_id, created_at)
+	VALUES (src.tenant_id, src.datum_id, src.third_party_id, src.organization_id, src.created_at)
 WHEN NOT MATCHED BY SOURCE
 	AND tgt.tenant_id = @tenant_id AND tgt.datum_id = @datum_id
 	THEN DELETE
@@ -69,37 +69,37 @@ WHEN NOT MATCHED BY SOURCE
 		"datum_id":        datumID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot merge data vendors: %w", err)
+		return fmt.Errorf("cannot merge data thirdParties: %w", err)
 	}

 	return nil
 }

-func (dv DatumVendors) Insert(
+func (dv DatumThirdParties) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 	datumID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
-	SELECT unnest(@vendor_ids::text[]) AS vendor_id
+WITH third_party_ids AS (
+	SELECT unnest(@third_party_ids::text[]) AS third_party_id
 )
-INSERT INTO data_vendors (tenant_id, datum_id, vendor_id, organization_id, created_at)
+INSERT INTO data_third_parties (tenant_id, datum_id, third_party_id, organization_id, created_at)
 SELECT
 	@tenant_id::text AS tenant_id,
 	@datum_id::text AS datum_id,
-	vendor_id,
+	third_party_id,
 	@organization_id::text AS organization_id,
 	@created_at::timestamptz AS created_at
-FROM vendor_ids
+FROM third_party_ids
 `

 	args := pgx.StrictNamedArgs{
@@ -107,12 +107,12 @@ FROM vendor_ids
 		"datum_id":        datumID,
 		"organization_id": organizationID,
 		"created_at":      time.Now(),
-		"vendor_ids":      vendorIDs,
+		"third_party_ids": thirdPartyIDs,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert data vendors: %w", err)
+		return fmt.Errorf("cannot insert data thirdParties: %w", err)
 	}

 	return nil
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -23,99 +23,99 @@ var (
 )

 const (
-	OrganizationEntityType                     uint16 = 0
-	FrameworkEntityType                        uint16 = 1
-	MeasureEntityType                          uint16 = 2
-	TaskEntityType                             uint16 = 3
-	EvidenceEntityType                         uint16 = 4
-	ConnectorEntityType                        uint16 = 5
-	VendorRiskAssessmentEntityType             uint16 = 6
-	VendorEntityType                           uint16 = 7
-	_                                          uint16 = 8 // PeopleEntityType - removed
-	VendorComplianceReportEntityType           uint16 = 9
-	DocumentEntityType                         uint16 = 10
-	IdentityEntityType                         uint16 = 11
-	SessionEntityType                          uint16 = 12
-	EmailEntityType                            uint16 = 13
-	ControlEntityType                          uint16 = 14
-	RiskEntityType                             uint16 = 15
-	DocumentVersionEntityType                  uint16 = 16
-	DocumentVersionSignatureEntityType         uint16 = 17
-	AssetEntityType                            uint16 = 18
-	DatumEntityType                            uint16 = 19
-	AuditEntityType                            uint16 = 20
-	ReportEntityType                           uint16 = 21
-	TrustCenterEntityType                      uint16 = 22
-	TrustCenterAccessEntityType                uint16 = 23
-	VendorBusinessAssociateAgreementEntityType uint16 = 24
-	FileEntityType                             uint16 = 25
-	VendorContactEntityType                    uint16 = 26
-	VendorDataPrivacyAgreementEntityType       uint16 = 27
-	_                                          uint16 = 28 // NonconformityEntityType - removed
-	ObligationEntityType                       uint16 = 29
-	VendorServiceEntityType                    uint16 = 30
-	_                                          uint16 = 31 // SnapshotEntityType - removed
-	_                                          uint16 = 32 // ContinualImprovementEntityType - removed
-	ProcessingActivityEntityType               uint16 = 33
-	ExportJobEntityType                        uint16 = 34
-	TrustCenterReferenceEntityType             uint16 = 35
-	TrustCenterDocumentAccessEntityType        uint16 = 36
-	CustomDomainEntityType                     uint16 = 37
-	InvitationEntityType                       uint16 = 38
-	MembershipEntityType                       uint16 = 39
-	SlackMessageEntityType                     uint16 = 40
-	TrustCenterFileEntityType                  uint16 = 41
-	SAMLConfigurationEntityType                uint16 = 42
-	PersonalAPIKeyEntityType                   uint16 = 43
-	_                                          uint16 = 44 // PersonalAPIKeyMembershipEntityType - removed
-	_                                          uint16 = 45 // MeetingEntityType - removed
-	DataProtectionImpactAssessmentEntityType   uint16 = 46
-	TransferImpactAssessmentEntityType         uint16 = 47
-	RightsRequestEntityType                    uint16 = 48
-	StatementOfApplicabilityEntityType         uint16 = 49
-	ApplicabilityStatementEntityType           uint16 = 50
-	MembershipProfileEntityType                uint16 = 51
-	SCIMConfigurationEntityType                uint16 = 52
-	SCIMEventEntityType                        uint16 = 53
-	TokenEntityType                            uint16 = 54
-	SCIMBridgeEntityType                       uint16 = 55
-	WebhookSubscriptionEntityType              uint16 = 56
-	WebhookDataEntityType                      uint16 = 57
-	WebhookEventEntityType                     uint16 = 58
-	ElectronicSignatureEntityType              uint16 = 59
-	ElectronicSignatureEventEntityType         uint16 = 60
-	EmailAttachmentEntityType                  uint16 = 61
-	ComplianceFrameworkEntityType              uint16 = 62
-	ComplianceExternalURLEntityType            uint16 = 63
-	MailingListEntityType                      uint16 = 64
-	MailingListSubscriberEntityType            uint16 = 65
-	MailingListUpdateEntityType                uint16 = 66
-	FindingEntityType                          uint16 = 67
-	AuditLogEntryEntityType                    uint16 = 68
-	DocumentVersionApprovalQuorumEntityType    uint16 = 69
-	DocumentVersionApprovalDecisionEntityType  uint16 = 70
-	AccessSourceEntityType                     uint16 = 71
-	AccessReviewCampaignEntityType             uint16 = 72
-	AccessEntryEntityType                      uint16 = 73
-	AccessEntryDecisionHistoryEntityType       uint16 = 74
-	CookieBannerEntityType                     uint16 = 75
-	CookieCategoryEntityType                   uint16 = 76
-	CookieConsentRecordEntityType              uint16 = 77
-	CookieBannerVersionEntityType              uint16 = 78
-	OAuth2ClientEntityType                     uint16 = 79
-	OAuth2ConsentEntityType                    uint16 = 80
-	OAuth2AccessTokenEntityType                uint16 = 81
-	OAuth2RefreshTokenEntityType               uint16 = 82
-	OAuth2AuthorizationCodeEntityType          uint16 = 83
-	OAuth2DeviceCodeEntityType                 uint16 = 84
-	_                                          uint16 = 85 // CookieEntityType - removed
-	CookieBannerTranslationEntityType          uint16 = 86
-	AgentRunEntityType                         uint16 = 87
-	_                                          uint16 = 88 // CookiePatternEntityType - removed
-	TrackerPatternEntityType                   uint16 = 89
-	DetectedTrackerEntityType                  uint16 = 90
-	TrackerResourceEntityType                  uint16 = 91
-	CommonThirdPartyEntityType                 uint16 = 92
+	OrganizationEntityType                         uint16 = 0
+	FrameworkEntityType                            uint16 = 1
+	MeasureEntityType                              uint16 = 2
+	TaskEntityType                                 uint16 = 3
+	EvidenceEntityType                             uint16 = 4
+	ConnectorEntityType                            uint16 = 5
+	ThirdPartyRiskAssessmentEntityType             uint16 = 6
+	ThirdPartyEntityType                           uint16 = 7
+	_                                              uint16 = 8 // PeopleEntityType - removed
+	ThirdPartyComplianceReportEntityType           uint16 = 9
+	DocumentEntityType                             uint16 = 10
+	IdentityEntityType                             uint16 = 11
+	SessionEntityType                              uint16 = 12
+	EmailEntityType                                uint16 = 13
+	ControlEntityType                              uint16 = 14
+	RiskEntityType                                 uint16 = 15
+	DocumentVersionEntityType                      uint16 = 16
+	DocumentVersionSignatureEntityType             uint16 = 17
+	AssetEntityType                                uint16 = 18
+	DatumEntityType                                uint16 = 19
+	AuditEntityType                                uint16 = 20
+	ReportEntityType                               uint16 = 21
+	TrustCenterEntityType                          uint16 = 22
+	TrustCenterAccessEntityType                    uint16 = 23
+	ThirdPartyBusinessAssociateAgreementEntityType uint16 = 24
+	FileEntityType                                 uint16 = 25
+	ThirdPartyContactEntityType                    uint16 = 26
+	ThirdPartyDataPrivacyAgreementEntityType       uint16 = 27
+	_                                              uint16 = 28 // NonconformityEntityType - removed
+	ObligationEntityType                           uint16 = 29
+	ThirdPartyServiceEntityType                    uint16 = 30
+	_                                              uint16 = 31 // SnapshotEntityType - removed
+	_                                              uint16 = 32 // ContinualImprovementEntityType - removed
+	ProcessingActivityEntityType                   uint16 = 33
+	ExportJobEntityType                            uint16 = 34
+	TrustCenterReferenceEntityType                 uint16 = 35
+	TrustCenterDocumentAccessEntityType            uint16 = 36
+	CustomDomainEntityType                         uint16 = 37
+	InvitationEntityType                           uint16 = 38
+	MembershipEntityType                           uint16 = 39
+	SlackMessageEntityType                         uint16 = 40
+	TrustCenterFileEntityType                      uint16 = 41
+	SAMLConfigurationEntityType                    uint16 = 42
+	PersonalAPIKeyEntityType                       uint16 = 43
+	_                                              uint16 = 44 // PersonalAPIKeyMembershipEntityType - removed
+	_                                              uint16 = 45 // MeetingEntityType - removed
+	DataProtectionImpactAssessmentEntityType       uint16 = 46
+	TransferImpactAssessmentEntityType             uint16 = 47
+	RightsRequestEntityType                        uint16 = 48
+	StatementOfApplicabilityEntityType             uint16 = 49
+	ApplicabilityStatementEntityType               uint16 = 50
+	MembershipProfileEntityType                    uint16 = 51
+	SCIMConfigurationEntityType                    uint16 = 52
+	SCIMEventEntityType                            uint16 = 53
+	TokenEntityType                                uint16 = 54
+	SCIMBridgeEntityType                           uint16 = 55
+	WebhookSubscriptionEntityType                  uint16 = 56
+	WebhookDataEntityType                          uint16 = 57
+	WebhookEventEntityType                         uint16 = 58
+	ElectronicSignatureEntityType                  uint16 = 59
+	ElectronicSignatureEventEntityType             uint16 = 60
+	EmailAttachmentEntityType                      uint16 = 61
+	ComplianceFrameworkEntityType                  uint16 = 62
+	ComplianceExternalURLEntityType                uint16 = 63
+	MailingListEntityType                          uint16 = 64
+	MailingListSubscriberEntityType                uint16 = 65
+	MailingListUpdateEntityType                    uint16 = 66
+	FindingEntityType                              uint16 = 67
+	AuditLogEntryEntityType                        uint16 = 68
+	DocumentVersionApprovalQuorumEntityType        uint16 = 69
+	DocumentVersionApprovalDecisionEntityType      uint16 = 70
+	AccessSourceEntityType                         uint16 = 71
+	AccessReviewCampaignEntityType                 uint16 = 72
+	AccessEntryEntityType                          uint16 = 73
+	AccessEntryDecisionHistoryEntityType           uint16 = 74
+	CookieBannerEntityType                         uint16 = 75
+	CookieCategoryEntityType                       uint16 = 76
+	CookieConsentRecordEntityType                  uint16 = 77
+	CookieBannerVersionEntityType                  uint16 = 78
+	OAuth2ClientEntityType                         uint16 = 79
+	OAuth2ConsentEntityType                        uint16 = 80
+	OAuth2AccessTokenEntityType                    uint16 = 81
+	OAuth2RefreshTokenEntityType                   uint16 = 82
+	OAuth2AuthorizationCodeEntityType              uint16 = 83
+	OAuth2DeviceCodeEntityType                     uint16 = 84
+	_                                              uint16 = 85 // CookieEntityType - removed
+	CookieBannerTranslationEntityType              uint16 = 86
+	AgentRunEntityType                             uint16 = 87
+	_                                              uint16 = 88 // CookiePatternEntityType - removed
+	TrackerPatternEntityType                       uint16 = 89
+	DetectedTrackerEntityType                      uint16 = 90
+	TrackerResourceEntityType                      uint16 = 91
+	CommonThirdPartyEntityType                     uint16 = 92
 )

 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -132,12 +132,12 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &Evidence{ID: id}, true
 	case ConnectorEntityType:
 		return &Connector{ID: id}, true
-	case VendorRiskAssessmentEntityType:
-		return &VendorRiskAssessment{ID: id}, true
-	case VendorEntityType:
-		return &Vendor{ID: id}, true
-	case VendorComplianceReportEntityType:
-		return &VendorComplianceReport{ID: id}, true
+	case ThirdPartyRiskAssessmentEntityType:
+		return &ThirdPartyRiskAssessment{ID: id}, true
+	case ThirdPartyEntityType:
+		return &ThirdParty{ID: id}, true
+	case ThirdPartyComplianceReportEntityType:
+		return &ThirdPartyComplianceReport{ID: id}, true
 	case DocumentEntityType:
 		return &Document{ID: id}, true
 	case IdentityEntityType:
@@ -166,20 +166,20 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &TrustCenter{ID: id}, true
 	case TrustCenterAccessEntityType:
 		return &TrustCenterAccess{ID: id}, true
-	case VendorBusinessAssociateAgreementEntityType:
-		return &VendorBusinessAssociateAgreement{ID: id}, true
+	case ThirdPartyBusinessAssociateAgreementEntityType:
+		return &ThirdPartyBusinessAssociateAgreement{ID: id}, true
 	case FileEntityType:
 		return &File{ID: id}, true
-	case VendorContactEntityType:
-		return &VendorContact{ID: id}, true
-	case VendorDataPrivacyAgreementEntityType:
-		return &VendorDataPrivacyAgreement{ID: id}, true
+	case ThirdPartyContactEntityType:
+		return &ThirdPartyContact{ID: id}, true
+	case ThirdPartyDataPrivacyAgreementEntityType:
+		return &ThirdPartyDataPrivacyAgreement{ID: id}, true
 	case FindingEntityType:
 		return &Finding{ID: id}, true
 	case ObligationEntityType:
 		return &Obligation{ID: id}, true
-	case VendorServiceEntityType:
-		return &VendorService{ID: id}, true
+	case ThirdPartyServiceEntityType:
+		return &ThirdPartyService{ID: id}, true
 	case ProcessingActivityEntityType:
 		return &ProcessingActivity{ID: id}, true
 	case ExportJobEntityType:
--- a/pkg/coredata/migrations/20260513T100000Z.sql
+++ b/pkg/coredata/migrations/20260513T100000Z.sql
@@ -0,0 +1,60 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+-- Rename vendor concept to third party everywhere in the schema.
+
+-- Rename the vendor_category enum.
+
+ALTER TYPE vendor_category RENAME TO third_party_category;
+
+-- Rename the main vendor tables.
+
+ALTER TABLE vendors RENAME TO third_parties;
+ALTER TABLE vendor_contacts RENAME TO third_party_contacts;
+ALTER TABLE vendor_services RENAME TO third_party_services;
+ALTER TABLE vendor_compliance_reports RENAME TO third_party_compliance_reports;
+ALTER TABLE vendor_business_associate_agreements RENAME TO third_party_business_associate_agreements;
+ALTER TABLE vendor_data_privacy_agreements RENAME TO third_party_data_privacy_agreements;
+ALTER TABLE vendor_risk_assessments RENAME TO third_party_risk_assessments;
+
+-- Rename the junction tables.
+
+ALTER TABLE asset_vendors RENAME TO asset_third_parties;
+ALTER TABLE data_vendors RENAME TO data_third_parties;
+ALTER TABLE processing_activity_vendors RENAME TO processing_activity_third_parties;
+
+-- Rename vendor_id columns on child tables.
+
+ALTER TABLE third_party_contacts RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_services RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_compliance_reports RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_business_associate_agreements RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_data_privacy_agreements RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE third_party_risk_assessments RENAME COLUMN vendor_id TO third_party_id;
+
+-- Rename vendor_id columns on junction tables.
+
+ALTER TABLE asset_third_parties RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE data_third_parties RENAME COLUMN vendor_id TO third_party_id;
+ALTER TABLE processing_activity_third_parties RENAME COLUMN vendor_id TO third_party_id;
+
+-- Rename generated_documents.vendors_document_id.
+
+ALTER TABLE generated_documents RENAME COLUMN vendors_document_id TO third_parties_document_id;
+
+-- Rename webhook event type enum values.
+
+ALTER TYPE webhook_event_type RENAME VALUE 'vendor:created' TO 'third-party:created';
+ALTER TYPE webhook_event_type RENAME VALUE 'vendor:updated' TO 'third-party:updated';
+ALTER TYPE webhook_event_type RENAME VALUE 'vendor:deleted' TO 'third-party:deleted';
--- a/pkg/coredata/processing_activity_third_party.go
+++ b/pkg/coredata/processing_activity_third_party.go
@@ -25,42 +25,42 @@ import (
 )

 type (
-	ProcessingActivityVendor struct {
+	ProcessingActivityThirdParty struct {
 		ProcessingActivityID gid.GID      `db:"processing_activity_id"`
-		VendorID             gid.GID      `db:"vendor_id"`
+		ThirdPartyID         gid.GID      `db:"third_party_id"`
 		TenantID             gid.TenantID `db:"tenant_id"`
 		SnapshotID           *gid.GID     `db:"snapshot_id"`
 		CreatedAt            time.Time    `db:"created_at"`
 	}

-	ProcessingActivityVendors []*ProcessingActivityVendor
+	ProcessingActivityThirdParties []*ProcessingActivityThirdParty
 )

-func (pav ProcessingActivityVendors) Merge(
+func (pav ProcessingActivityThirdParties) Merge(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	processingActivityID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
+WITH third_party_ids AS (
 	SELECT
-		unnest(@vendor_ids::text[]) AS vendor_id,
+		unnest(@third_party_ids::text[]) AS third_party_id,
 		@tenant_id AS tenant_id,
 		@processing_activity_id AS processing_activity_id,
 		@organization_id AS organization_id,
 		@created_at::timestamptz AS created_at
 )
-MERGE INTO processing_activity_vendors AS tgt
-USING vendor_ids AS src
+MERGE INTO processing_activity_third_parties AS tgt
+USING third_party_ids AS src
 ON tgt.tenant_id = src.tenant_id
 	AND tgt.processing_activity_id = src.processing_activity_id
-	AND tgt.vendor_id = src.vendor_id
+	AND tgt.third_party_id = src.third_party_id
 WHEN NOT MATCHED
-	THEN INSERT (tenant_id, processing_activity_id, vendor_id, organization_id, created_at)
-		VALUES (src.tenant_id, src.processing_activity_id, src.vendor_id, src.organization_id, src.created_at)
+	THEN INSERT (tenant_id, processing_activity_id, third_party_id, organization_id, created_at)
+		VALUES (src.tenant_id, src.processing_activity_id, src.third_party_id, src.organization_id, src.created_at)
 	WHEN NOT MATCHED BY SOURCE
 		AND tgt.tenant_id = @tenant_id AND tgt.processing_activity_id = @processing_activity_id
 		THEN DELETE
@@ -71,37 +71,37 @@ WHEN NOT MATCHED
 		"processing_activity_id": processingActivityID,
 		"organization_id":        organizationID,
 		"created_at":             time.Now(),
-		"vendor_ids":             vendorIDs,
+		"third_party_ids":        thirdPartyIDs,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot merge processing activity vendors: %w", err)
+		return fmt.Errorf("cannot merge processing activity thirdParties: %w", err)
 	}

 	return nil
 }

-func (pav ProcessingActivityVendors) Insert(
+func (pav ProcessingActivityThirdParties) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 	processingActivityID gid.GID,
 	organizationID gid.GID,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
-WITH vendor_ids AS (
-	SELECT unnest(@vendor_ids::text[]) AS vendor_id
+WITH third_party_ids AS (
+	SELECT unnest(@third_party_ids::text[]) AS third_party_id
 )
-INSERT INTO processing_activity_vendors (tenant_id, processing_activity_id, vendor_id, organization_id, created_at)
+INSERT INTO processing_activity_third_parties (tenant_id, processing_activity_id, third_party_id, organization_id, created_at)
 SELECT
 	@tenant_id AS tenant_id,
 	@processing_activity_id AS processing_activity_id,
-	vendor_id,
+	third_party_id,
 	@organization_id AS organization_id,
 	@created_at AS created_at
-FROM vendor_ids
+FROM third_party_ids
 `

 	args := pgx.StrictNamedArgs{
@@ -109,12 +109,12 @@ FROM vendor_ids
 		"processing_activity_id": processingActivityID,
 		"organization_id":        organizationID,
 		"created_at":             time.Now(),
-		"vendor_ids":             vendorIDs,
+		"third_party_ids":        thirdPartyIDs,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert processing activity vendors: %w", err)
+		return fmt.Errorf("cannot insert processing activity thirdParties: %w", err)
 	}

 	return nil
--- a/pkg/coredata/third_party.go
+++ b/pkg/coredata/third_party.go
@@ -27,7 +27,7 @@ import (
 	"go.probo.inc/probo/pkg/page"
 )

-func (v Vendor) GetGeneratedDocumentID(
+func (v ThirdParty) GetGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Querier,
 	organizationID gid.GID,
@@ -38,7 +38,7 @@ func (v Vendor) GetGeneratedDocumentID(
 		ctx,
 		`
 SELECT
-	vendors_document_id
+	third_parties_document_id
 FROM
 	generated_documents
 WHERE
@@ -50,13 +50,13 @@ WHERE
 		return nil, nil
 	}
 	if err != nil {
-		return nil, fmt.Errorf("cannot get vendor list document ID: %w", err)
+		return nil, fmt.Errorf("cannot get thirdParty list document ID: %w", err)
 	}

 	return documentID, nil
 }

-func (v Vendor) UpsertGeneratedDocumentID(
+func (v ThirdParty) UpsertGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Tx,
 	organizationID gid.GID,
@@ -71,37 +71,37 @@ func (v Vendor) UpsertGeneratedDocumentID(
 INSERT INTO generated_documents (
 	organization_id,
 	tenant_id,
-	vendors_document_id,
+	third_parties_document_id,
 	created_at,
 	updated_at
 ) VALUES (
 	@organization_id,
 	@tenant_id,
-	@vendors_document_id,
+	@third_parties_document_id,
 	@created_at,
 	@updated_at
 )
 ON CONFLICT (organization_id) DO UPDATE
 SET
-	vendors_document_id = @vendors_document_id,
+	third_parties_document_id = @third_parties_document_id,
 	updated_at = @updated_at
 `,
 		pgx.NamedArgs{
-			"organization_id":     organizationID,
-			"tenant_id":           tenantID,
-			"vendors_document_id": documentID,
-			"created_at":          now,
-			"updated_at":          now,
+			"organization_id":           organizationID,
+			"tenant_id":                 tenantID,
+			"third_parties_document_id": documentID,
+			"created_at":                now,
+			"updated_at":                now,
 		},
 	)
 	if err != nil {
-		return fmt.Errorf("cannot upsert vendor list document ID: %w", err)
+		return fmt.Errorf("cannot upsert thirdParty list document ID: %w", err)
 	}

 	return nil
 }

-func (v Vendor) ClearGeneratedDocumentID(
+func (v ThirdParty) ClearGeneratedDocumentID(
 	ctx context.Context,
 	conn pg.Tx,
 	documentIDs []gid.GID,
@@ -117,10 +117,10 @@ func (v Vendor) ClearGeneratedDocumentID(
 UPDATE
 	generated_documents
 SET
-	vendors_document_id = NULL,
+	third_parties_document_id = NULL,
 	updated_at = @now
 WHERE
-	vendors_document_id = ANY(@ids)
+	third_parties_document_id = ANY(@ids)
 `,
 		pgx.NamedArgs{
 			"ids": ids,
@@ -128,76 +128,76 @@ WHERE
 		},
 	)
 	if err != nil {
-		return fmt.Errorf("cannot clear vendor list document references: %w", err)
+		return fmt.Errorf("cannot clear thirdParty list document references: %w", err)
 	}

 	return nil
 }

 type (
-	Vendor struct {
-		ID                            gid.GID        `db:"id"`
-		TenantID                      gid.TenantID   `db:"tenant_id"`
-		OrganizationID                gid.GID        `db:"organization_id"`
-		Name                          string         `db:"name"`
-		Description                   *string        `db:"description"`
-		Category                      VendorCategory `db:"category"`
-		HeadquarterAddress            *string        `db:"headquarter_address"`
-		LegalName                     *string        `db:"legal_name"`
-		WebsiteURL                    *string        `db:"website_url"`
-		PrivacyPolicyURL              *string        `db:"privacy_policy_url"`
-		ServiceLevelAgreementURL      *string        `db:"service_level_agreement_url"`
-		DataProcessingAgreementURL    *string        `db:"data_processing_agreement_url"`
-		BusinessAssociateAgreementURL *string        `db:"business_associate_agreement_url"`
-		SubprocessorsListURL          *string        `db:"subprocessors_list_url"`
-		Certifications                []string       `db:"certifications"`
-		Countries                     CountryCodes   `db:"countries"`
-		BusinessOwnerID               *gid.GID       `db:"business_owner_profile_id"`
-		SecurityOwnerID               *gid.GID       `db:"security_owner_profile_id"`
-		StatusPageURL                 *string        `db:"status_page_url"`
-		TermsOfServiceURL             *string        `db:"terms_of_service_url"`
-		SecurityPageURL               *string        `db:"security_page_url"`
-		TrustPageURL                  *string        `db:"trust_page_url"`
-		ShowOnTrustCenter             bool           `db:"show_on_trust_center"`
-		CreatedAt                     time.Time      `db:"created_at"`
-		UpdatedAt                     time.Time      `db:"updated_at"`
+	ThirdParty struct {
+		ID                            gid.GID            `db:"id"`
+		TenantID                      gid.TenantID       `db:"tenant_id"`
+		OrganizationID                gid.GID            `db:"organization_id"`
+		Name                          string             `db:"name"`
+		Description                   *string            `db:"description"`
+		Category                      ThirdPartyCategory `db:"category"`
+		HeadquarterAddress            *string            `db:"headquarter_address"`
+		LegalName                     *string            `db:"legal_name"`
+		WebsiteURL                    *string            `db:"website_url"`
+		PrivacyPolicyURL              *string            `db:"privacy_policy_url"`
+		ServiceLevelAgreementURL      *string            `db:"service_level_agreement_url"`
+		DataProcessingAgreementURL    *string            `db:"data_processing_agreement_url"`
+		BusinessAssociateAgreementURL *string            `db:"business_associate_agreement_url"`
+		SubprocessorsListURL          *string            `db:"subprocessors_list_url"`
+		Certifications                []string           `db:"certifications"`
+		Countries                     CountryCodes       `db:"countries"`
+		BusinessOwnerID               *gid.GID           `db:"business_owner_profile_id"`
+		SecurityOwnerID               *gid.GID           `db:"security_owner_profile_id"`
+		StatusPageURL                 *string            `db:"status_page_url"`
+		TermsOfServiceURL             *string            `db:"terms_of_service_url"`
+		SecurityPageURL               *string            `db:"security_page_url"`
+		TrustPageURL                  *string            `db:"trust_page_url"`
+		ShowOnTrustCenter             bool               `db:"show_on_trust_center"`
+		CreatedAt                     time.Time          `db:"created_at"`
+		UpdatedAt                     time.Time          `db:"updated_at"`
 	}

-	Vendors []*Vendor
+	ThirdParties []*ThirdParty
 )

-func (v Vendor) CursorKey(orderBy VendorOrderField) page.CursorKey {
+func (v ThirdParty) CursorKey(orderBy ThirdPartyOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorOrderFieldCreatedAt:
+	case ThirdPartyOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
-	case VendorOrderFieldUpdatedAt:
+	case ThirdPartyOrderFieldUpdatedAt:
 		return page.NewCursorKey(v.ID, v.UpdatedAt)
-	case VendorOrderFieldName:
+	case ThirdPartyOrderFieldName:
 		return page.NewCursorKey(v.ID, v.Name)
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (v *Vendor) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendors WHERE id = $1 LIMIT 1;`
+func (v *ThirdParty) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_parties WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, v.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

-func (v *Vendor) LoadByID(
+func (v *ThirdParty) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
@@ -227,43 +227,43 @@ SELECT
    created_at,
    updated_at
 FROM
-    vendors
+    third_parties
 WHERE
    %s
-    AND id = @vendor_id
+    AND id = @third_party_id
 LIMIT 1;
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor: %w", err)
+		return fmt.Errorf("cannot query thirdParty: %w", err)
 	}
 	defer rows.Close()

-	vendor, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[Vendor])
+	thirdParty, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdParty])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}

-		return fmt.Errorf("cannot collect vendor: %w", err)
+		return fmt.Errorf("cannot collect thirdParty: %w", err)
 	}

-	*v = vendor
+	*v = thirdParty

 	return nil
 }

-func (v *Vendors) LoadByIDs(
+func (v *ThirdParties) LoadByIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
 	q := `
 SELECT
@@ -293,40 +293,40 @@ SELECT
    created_at,
    updated_at
 FROM
-    vendors
+    third_parties
 WHERE
    %s
-    AND id = ANY(@vendor_ids)
+    AND id = ANY(@third_party_ids)
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_ids": vendorIDs}
+	args := pgx.StrictNamedArgs{"third_party_ids": thirdPartyIDs}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*v = vendors
+	*v = thirdParties

 	return nil
 }

-func (v Vendor) Insert(
+func (v ThirdParty) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-    vendors (
+    third_parties (
        tenant_id,
        id,
        organization_id,
@@ -355,7 +355,7 @@ INSERT INTO
    )
 VALUES (
    @tenant_id,
-    @vendor_id,
+    @third_party_id,
    @organization_id,
    @name,
    @description,
@@ -384,7 +384,7 @@ VALUES (

 	args := pgx.StrictNamedArgs{
 		"tenant_id":                        scope.GetTenantID(),
-		"vendor_id":                        v.ID,
+		"third_party_id":                   v.ID,
 		"organization_id":                  v.OrganizationID,
 		"name":                             v.Name,
 		"description":                      v.Description,
@@ -413,36 +413,36 @@ VALUES (
 	return err
 }

-func (v Vendor) Delete(
+func (v ThirdParty) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
-DELETE FROM vendors WHERE %s AND id = @vendor_id
+DELETE FROM third_parties WHERE %s AND id = @third_party_id
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_id": v.ID}
+	args := pgx.StrictNamedArgs{"third_party_id": v.ID}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
 	return err
 }

-func (v *Vendors) CountByOrganizationID(
+func (v *ThirdParties) CountByOrganizationID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	organizationID gid.GID,
-	filter *VendorFilter,
+	filter *ThirdPartyFilter,
 ) (int, error) {
 	q := `
 SELECT
    COUNT(id)
 FROM
-    vendors
+    third_parties
 WHERE
    %s
    AND organization_id = @organization_id
@@ -461,13 +461,13 @@ WHERE
 	var count int
 	err := row.Scan(&count)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count vendors: %w", err)
+		return 0, fmt.Errorf("cannot count thirdParties: %w", err)
 	}

 	return count, nil
 }

-func (v *Vendors) LoadAllByOrganizationID(
+func (v *ThirdParties) LoadAllByOrganizationID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -501,7 +501,7 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendors
+	third_parties
 WHERE
 	%s
 	AND organization_id = @organization_id
@@ -515,26 +515,26 @@ ORDER BY name ASC

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*v = vendors
+	*v = thirdParties

 	return nil
 }

-func (v *Vendors) LoadByOrganizationID(
+func (v *ThirdParties) LoadByOrganizationID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	organizationID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
-	filter *VendorFilter,
+	cursor *page.Cursor[ThirdPartyOrderField],
+	filter *ThirdPartyFilter,
 ) error {
 	q := `
 SELECT
@@ -564,7 +564,7 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendors
+	third_parties
 WHERE
 	%s
 	AND organization_id = @organization_id
@@ -581,26 +581,26 @@ WHERE

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*v = vendors
+	*v = thirdParties

 	return nil
 }

-func (v *Vendor) Update(
+func (v *ThirdParty) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
-UPDATE vendors
+UPDATE third_parties
 SET
 	name = @name,
 	description = @description,
@@ -624,12 +624,12 @@ SET
 	show_on_trust_center = @show_on_trust_center,
 	updated_at = @updated_at
 WHERE %s
-    AND id = @vendor_id
+    AND id = @third_party_id
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_id":                        v.ID,
+		"third_party_id":                   v.ID,
 		"updated_at":                       time.Now(),
 		"name":                             v.Name,
 		"description":                      v.Description,
@@ -659,7 +659,7 @@ WHERE %s
 	return err
 }

-func (v Vendor) ExpireNonExpiredRiskAssessments(
+func (v ThirdParty) ExpireNonExpiredRiskAssessments(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -667,21 +667,21 @@ func (v Vendor) ExpireNonExpiredRiskAssessments(
 	now := time.Now()

 	q := `
-	UPDATE vendor_risk_assessments
+	UPDATE third_party_risk_assessments
 	SET
 		expires_at = @now,
 		updated_at = @now
 	WHERE
 		%s
-		AND vendor_id = @vendor_id
+		AND third_party_id = @third_party_id
 		AND expires_at > @now
 	`

 	q = fmt.Sprintf(q, scope.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_id": v.ID,
-		"now":       now,
+		"third_party_id": v.ID,
+		"now":            now,
 	}
 	maps.Copy(args, scope.SQLArguments())

@@ -693,7 +693,7 @@ func (v Vendor) ExpireNonExpiredRiskAssessments(
 	return nil
 }

-func (v *Vendors) CountByAssetID(
+func (v *ThirdParties) CountByAssetID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -704,9 +704,9 @@ WITH vend AS (
 	SELECT
 		v.id
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		asset_vendors av ON v.id = av.vendor_id
+		asset_third_parties av ON v.id = av.third_party_id
 	WHERE
 		av.asset_id = @asset_id
 )
@@ -726,18 +726,18 @@ WHERE %s
 	var count int
 	err := row.Scan(&count)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count vendors: %w", err)
+		return 0, fmt.Errorf("cannot count thirdParties: %w", err)
 	}

 	return count, nil
 }

-func (v *Vendors) LoadByAssetID(
+func (v *ThirdParties) LoadByAssetID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	assetID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
+	cursor *page.Cursor[ThirdPartyOrderField],
 ) error {
 	q := `
 WITH vend AS (
@@ -768,9 +768,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		asset_vendors av ON v.id = av.vendor_id
+		asset_third_parties av ON v.id = av.third_party_id
 	WHERE
 		av.asset_id = @asset_id
 )
@@ -813,20 +813,20 @@ WHERE %s

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*v = vendors
+	*v = thirdParties

 	return nil
 }

-func (v *Vendors) CountByDatumID(
+func (v *ThirdParties) CountByDatumID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -837,9 +837,9 @@ WITH vend AS (
 	SELECT
 		v.id
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		data_vendors dv ON v.id = dv.vendor_id
+		data_third_parties dv ON v.id = dv.third_party_id
 	WHERE
 		dv.datum_id = @datum_id
 )
@@ -859,13 +859,13 @@ WHERE %s
 	var count int
 	err := row.Scan(&count)
 	if err != nil {
-		return 0, fmt.Errorf("cannot count vendors: %w", err)
+		return 0, fmt.Errorf("cannot count thirdParties: %w", err)
 	}

 	return count, nil
 }

-func (vs *Vendors) LoadAllByDatumID(
+func (vs *ThirdParties) LoadAllByDatumID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -900,9 +900,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		data_vendors dv ON v.id = dv.vendor_id
+		data_third_parties dv ON v.id = dv.third_party_id
 	WHERE
 		dv.datum_id = @datum_id
 )
@@ -944,25 +944,25 @@ ORDER BY name ASC

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*vs = vendors
+	*vs = thirdParties

 	return nil
 }

-func (vs *Vendors) LoadByDatumID(
+func (vs *ThirdParties) LoadByDatumID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	datumID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
+	cursor *page.Cursor[ThirdPartyOrderField],
 ) error {
 	q := `
 WITH vend AS (
@@ -993,9 +993,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		data_vendors dv ON v.id = dv.vendor_id
+		data_third_parties dv ON v.id = dv.third_party_id
 	WHERE
 		dv.datum_id = @datum_id
 )
@@ -1038,25 +1038,25 @@ WHERE %s

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*vs = vendors
+	*vs = thirdParties

 	return nil
 }

-func (v *Vendors) LoadByProcessingActivityID(
+func (v *ThirdParties) LoadByProcessingActivityID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 	processingActivityID gid.GID,
-	cursor *page.Cursor[VendorOrderField],
+	cursor *page.Cursor[ThirdPartyOrderField],
 ) error {
 	q := `
 WITH vend AS (
@@ -1087,9 +1087,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		processing_activity_vendors pav ON v.id = pav.vendor_id
+		processing_activity_third_parties pav ON v.id = pav.third_party_id
 	WHERE
 		pav.processing_activity_id = @processing_activity_id
 )
@@ -1132,20 +1132,20 @@ WHERE %s

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*v = vendors
+	*v = thirdParties

 	return nil
 }

-func (v *Vendors) LoadAllByProcessingActivities(
+func (v *ThirdParties) LoadAllByProcessingActivities(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -1162,12 +1162,12 @@ WITH filtered_processing_activities AS (
 		AND pa.organization_id = @organization_id
 		AND pa.snapshot_id IS NULL
 ),
-filtered_vendors AS (
+filtered_third_parties AS (
 	SELECT
 		v.id,
 		v.name
 	FROM
-		vendors v
+		third_parties v
 	WHERE
 		v.tenant_id = @tenant_id
 		AND v.snapshot_id IS NULL
@@ -1176,9 +1176,9 @@ SELECT
 	pav.processing_activity_id,
 	fv.name
 FROM
-	processing_activity_vendors pav
+	processing_activity_third_parties pav
 INNER JOIN
-	filtered_vendors fv ON fv.id = pav.vendor_id
+	filtered_third_parties fv ON fv.id = pav.third_party_id
 INNER JOIN
 	filtered_processing_activities fpa ON fpa.id = pav.processing_activity_id
 WHERE
@@ -1194,24 +1194,24 @@ ORDER BY

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return nil, fmt.Errorf("cannot query vendors: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParties: %w", err)
 	}
 	defer rows.Close()

-	vendorMap := make(map[gid.GID][]string)
+	thirdPartyMap := make(map[gid.GID][]string)
 	for rows.Next() {
 		var processingActivityID gid.GID
-		var vendorName string
-		if err := rows.Scan(&processingActivityID, &vendorName); err != nil {
-			return nil, fmt.Errorf("cannot scan vendor: %w", err)
+		var thirdPartyName string
+		if err := rows.Scan(&processingActivityID, &thirdPartyName); err != nil {
+			return nil, fmt.Errorf("cannot scan thirdParty: %w", err)
 		}
-		vendorMap[processingActivityID] = append(vendorMap[processingActivityID], vendorName)
+		thirdPartyMap[processingActivityID] = append(thirdPartyMap[processingActivityID], thirdPartyName)
 	}

-	return vendorMap, nil
+	return thirdPartyMap, nil
 }

-func (vs *Vendors) LoadAllByAssetID(
+func (vs *ThirdParties) LoadAllByAssetID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -1246,9 +1246,9 @@ WITH vend AS (
 		v.created_at,
 		v.updated_at
 	FROM
-		vendors v
+		third_parties v
 	INNER JOIN
-		asset_vendors av ON v.id = av.vendor_id
+		asset_third_parties av ON v.id = av.third_party_id
 	WHERE
 		av.asset_id = @asset_id
 )
@@ -1290,15 +1290,15 @@ ORDER BY name ASC

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendors: %w", err)
+		return fmt.Errorf("cannot query thirdParties: %w", err)
 	}

-	vendors, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Vendor])
+	thirdParties, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdParty])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendors: %w", err)
+		return fmt.Errorf("cannot collect thirdParties: %w", err)
 	}

-	*vs = vendors
+	*vs = thirdParties

 	return nil
 }
--- a/pkg/coredata/third_party_business_associate_agreement.go
+++ b/pkg/coredata/third_party_business_associate_agreement.go
@@ -29,10 +29,10 @@ import (
 )

 type (
-	VendorBusinessAssociateAgreement struct {
+	ThirdPartyBusinessAssociateAgreement struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		ValidFrom      *time.Time `db:"valid_from"`
 		ValidUntil     *time.Time `db:"valid_until"`
 		FileID         gid.GID    `db:"file_id"`
@@ -40,87 +40,87 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}

-	VendorBusinessAssociateAgreements []*VendorBusinessAssociateAgreement
+	ThirdPartyBusinessAssociateAgreements []*ThirdPartyBusinessAssociateAgreement
 )

-func (v VendorBusinessAssociateAgreement) CursorKey(orderBy VendorBusinessAssociateAgreementOrderField) page.CursorKey {
+func (v ThirdPartyBusinessAssociateAgreement) CursorKey(orderBy ThirdPartyBusinessAssociateAgreementOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorBusinessAssociateAgreementOrderFieldValidFrom:
+	case ThirdPartyBusinessAssociateAgreementOrderFieldValidFrom:
 		return page.NewCursorKey(v.ID, v.ValidFrom)
-	case VendorBusinessAssociateAgreementOrderFieldCreatedAt:
+	case ThirdPartyBusinessAssociateAgreementOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (vbaa *VendorBusinessAssociateAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_business_associate_agreements WHERE id = $1 LIMIT 1;`
+func (vbaa *ThirdPartyBusinessAssociateAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_business_associate_agreements WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vbaa.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor business associate agreement authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty business associate agreement authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

-func (vbaa *VendorBusinessAssociateAgreement) LoadByVendorID(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 LIMIT 1;
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.NamedArgs{"vendor_id": vendorID}
+	args := pgx.NamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty business associate agreement: %w", err)
 	}

-	vendorBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorBusinessAssociateAgreement])
+	thirdPartyBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyBusinessAssociateAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty business associate agreement: %w", err)
 	}

-	*vbaa = vendorBusinessAssociateAgreement
+	*vbaa = thirdPartyBusinessAssociateAgreement

 	return nil
 }

-func (vbaas *VendorBusinessAssociateAgreements) LoadByVendorIDs(
+func (vbaas *ThirdPartyBusinessAssociateAgreements) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vbaas = VendorBusinessAssociateAgreements{}
+	if len(thirdPartyIDs) == 0 {
+		*vbaas = ThirdPartyBusinessAssociateAgreements{}
 		return nil
 	}

@@ -128,38 +128,38 @@ func (vbaas *VendorBusinessAssociateAgreements) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}

-	args := pgx.NamedArgs{"vendor_ids": ids}
+	args := pgx.NamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor business associate agreements: %w", err)
+		return fmt.Errorf("cannot query thirdParty business associate agreements: %w", err)
 	}

-	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorBusinessAssociateAgreement])
+	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyBusinessAssociateAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor business associate agreements: %w", err)
+		return fmt.Errorf("cannot collect thirdParty business associate agreements: %w", err)
 	}

 	*vbaas = agreements
@@ -167,24 +167,24 @@ WHERE
 	return nil
 }

-func (vbaa *VendorBusinessAssociateAgreement) LoadByID(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorBusinessAssociateAgreementID gid.GID,
+	thirdPartyBusinessAssociateAgreementID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
 	AND id = @id
@@ -193,32 +193,32 @@ LIMIT 1;

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.NamedArgs{"id": vendorBusinessAssociateAgreementID}
+	args := pgx.NamedArgs{"id": thirdPartyBusinessAssociateAgreementID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty business associate agreement: %w", err)
 	}

-	vendorBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorBusinessAssociateAgreement])
+	thirdPartyBusinessAssociateAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyBusinessAssociateAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty business associate agreement: %w", err)
 	}

-	*vbaa = vendorBusinessAssociateAgreement
+	*vbaa = thirdPartyBusinessAssociateAgreement

 	return nil
 }

-func (vbaa *VendorBusinessAssociateAgreement) Update(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 SET
 	valid_from = @valid_from,
 	valid_until = @valid_until,
@@ -243,24 +243,24 @@ WHERE

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot update thirdParty business associate agreement: %w", err)
 	}

 	return nil
 }

-func (vbaa *VendorBusinessAssociateAgreement) Upsert(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) Upsert(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_business_associate_agreements (
+	third_party_business_associate_agreements (
 		id,
 		tenant_id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		valid_from,
 		valid_until,
 		file_id,
@@ -271,14 +271,14 @@ VALUES (
 	@id,
 	@tenant_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@valid_from,
 	@valid_until,
 	@file_id,
 	@created_at,
 	@updated_at
 )
-ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
+ON CONFLICT (organization_id, third_party_id) DO UPDATE SET
 	id = EXCLUDED.id,
 	valid_from = EXCLUDED.valid_from,
 	valid_until = EXCLUDED.valid_until,
@@ -288,7 +288,7 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	args := pgx.StrictNamedArgs{
 		"id":              vbaa.ID,
 		"tenant_id":       scope.GetTenantID(),
-		"vendor_id":       vbaa.VendorID,
+		"third_party_id":  vbaa.ThirdPartyID,
 		"organization_id": vbaa.OrganizationID,
 		"valid_from":      vbaa.ValidFrom,
 		"valid_until":     vbaa.ValidUntil,
@@ -301,16 +301,16 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	if err != nil {
 		var pgErr *pgconn.PgError
 		if errors.As(err, &pgErr) {
-			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_business_associate_agreements_source_id_snapshot_id_key" {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "third_party_business_associate_agreements_source_id_snapshot_id_key" {
 				return ErrResourceAlreadyExists
 			}
 		}
-		return fmt.Errorf("cannot upsert vendor business associate agreement: %w", err)
+		return fmt.Errorf("cannot upsert thirdParty business associate agreement: %w", err)
 	}
 	return nil
 }

-func (vbaa *VendorBusinessAssociateAgreement) Delete(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
@@ -318,7 +318,7 @@ func (vbaa *VendorBusinessAssociateAgreement) Delete(
 	q := `
 DELETE
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
 	AND id = @id
@@ -334,25 +334,25 @@ WHERE
 	return err
 }

-func (vbaa *VendorBusinessAssociateAgreement) DeleteByVendorID(
+func (vbaa *ThirdPartyBusinessAssociateAgreement) DeleteByThirdPartyID(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 DELETE
 FROM
-	vendor_business_associate_agreements
+	third_party_business_associate_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
--- a/pkg/coredata/third_party_business_associate_agreement_order_field.go
+++ b/pkg/coredata/third_party_business_associate_agreement_order_field.go
@@ -15,27 +15,27 @@
 package coredata

 type (
-	VendorBusinessAssociateAgreementOrderField string
+	ThirdPartyBusinessAssociateAgreementOrderField string
 )

 const (
-	VendorBusinessAssociateAgreementOrderFieldValidFrom VendorBusinessAssociateAgreementOrderField = "VALID_FROM"
-	VendorBusinessAssociateAgreementOrderFieldCreatedAt VendorBusinessAssociateAgreementOrderField = "CREATED_AT"
+	ThirdPartyBusinessAssociateAgreementOrderFieldValidFrom ThirdPartyBusinessAssociateAgreementOrderField = "VALID_FROM"
+	ThirdPartyBusinessAssociateAgreementOrderFieldCreatedAt ThirdPartyBusinessAssociateAgreementOrderField = "CREATED_AT"
 )

-func (p VendorBusinessAssociateAgreementOrderField) Column() string {
+func (p ThirdPartyBusinessAssociateAgreementOrderField) Column() string {
 	return string(p)
 }

-func (p VendorBusinessAssociateAgreementOrderField) String() string {
+func (p ThirdPartyBusinessAssociateAgreementOrderField) String() string {
 	return string(p)
 }

-func (p VendorBusinessAssociateAgreementOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyBusinessAssociateAgreementOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *VendorBusinessAssociateAgreementOrderField) UnmarshalText(text []byte) error {
-	*p = VendorBusinessAssociateAgreementOrderField(text)
+func (p *ThirdPartyBusinessAssociateAgreementOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyBusinessAssociateAgreementOrderField(text)
 	return nil
 }
--- a/pkg/coredata/third_party_category.go
+++ b/pkg/coredata/third_party_category.go
@@ -0,0 +1,255 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"encoding/json"
+	"fmt"
+)
+
+type ThirdPartyCategory string
+
+const (
+	ThirdPartyCategoryAnalytics                ThirdPartyCategory = "ANALYTICS"
+	ThirdPartyCategoryCloudMonitoring          ThirdPartyCategory = "CLOUD_MONITORING"
+	ThirdPartyCategoryCloudProvider            ThirdPartyCategory = "CLOUD_PROVIDER"
+	ThirdPartyCategoryCollaboration            ThirdPartyCategory = "COLLABORATION"
+	ThirdPartyCategoryCustomerSupport          ThirdPartyCategory = "CUSTOMER_SUPPORT"
+	ThirdPartyCategoryDataStorageAndProcessing ThirdPartyCategory = "DATA_STORAGE_AND_PROCESSING"
+	ThirdPartyCategoryDocumentManagement       ThirdPartyCategory = "DOCUMENT_MANAGEMENT"
+	ThirdPartyCategoryEmployeeManagement       ThirdPartyCategory = "EMPLOYEE_MANAGEMENT"
+	ThirdPartyCategoryEngineering              ThirdPartyCategory = "ENGINEERING"
+	ThirdPartyCategoryFinance                  ThirdPartyCategory = "FINANCE"
+	ThirdPartyCategoryIdentityProvider         ThirdPartyCategory = "IDENTITY_PROVIDER"
+	ThirdPartyCategoryIT                       ThirdPartyCategory = "IT"
+	ThirdPartyCategoryMarketing                ThirdPartyCategory = "MARKETING"
+	ThirdPartyCategoryOfficeOperations         ThirdPartyCategory = "OFFICE_OPERATIONS"
+	ThirdPartyCategoryOther                    ThirdPartyCategory = "OTHER"
+	ThirdPartyCategoryPasswordManagement       ThirdPartyCategory = "PASSWORD_MANAGEMENT"
+	ThirdPartyCategoryProductAndDesign         ThirdPartyCategory = "PRODUCT_AND_DESIGN"
+	ThirdPartyCategoryProfessionalServices     ThirdPartyCategory = "PROFESSIONAL_SERVICES"
+	ThirdPartyCategoryRecruiting               ThirdPartyCategory = "RECRUITING"
+	ThirdPartyCategorySales                    ThirdPartyCategory = "SALES"
+	ThirdPartyCategorySecurity                 ThirdPartyCategory = "SECURITY"
+	ThirdPartyCategoryVersionControl           ThirdPartyCategory = "VERSION_CONTROL"
+)
+
+func ThirdPartyCategories() []ThirdPartyCategory {
+	return []ThirdPartyCategory{
+		ThirdPartyCategoryAnalytics,
+		ThirdPartyCategoryCloudMonitoring,
+		ThirdPartyCategoryCloudProvider,
+		ThirdPartyCategoryCollaboration,
+		ThirdPartyCategoryCustomerSupport,
+		ThirdPartyCategoryDataStorageAndProcessing,
+		ThirdPartyCategoryDocumentManagement,
+		ThirdPartyCategoryEmployeeManagement,
+		ThirdPartyCategoryEngineering,
+		ThirdPartyCategoryFinance,
+		ThirdPartyCategoryIdentityProvider,
+		ThirdPartyCategoryIT,
+		ThirdPartyCategoryMarketing,
+		ThirdPartyCategoryOfficeOperations,
+		ThirdPartyCategoryOther,
+		ThirdPartyCategoryPasswordManagement,
+		ThirdPartyCategoryProductAndDesign,
+		ThirdPartyCategoryProfessionalServices,
+		ThirdPartyCategoryRecruiting,
+		ThirdPartyCategorySales,
+		ThirdPartyCategorySecurity,
+		ThirdPartyCategoryVersionControl,
+	}
+}
+
+func (i ThirdPartyCategory) String() string {
+	return string(i)
+}
+
+func (i *ThirdPartyCategory) Scan(value any) error {
+	switch v := value.(type) {
+	case string:
+		switch v {
+		case "ANALYTICS":
+			*i = ThirdPartyCategoryAnalytics
+		case "CLOUD_MONITORING":
+			*i = ThirdPartyCategoryCloudMonitoring
+		case "CLOUD_PROVIDER":
+			*i = ThirdPartyCategoryCloudProvider
+		case "COLLABORATION":
+			*i = ThirdPartyCategoryCollaboration
+		case "CUSTOMER_SUPPORT":
+			*i = ThirdPartyCategoryCustomerSupport
+		case "DATA_STORAGE_AND_PROCESSING":
+			*i = ThirdPartyCategoryDataStorageAndProcessing
+		case "DOCUMENT_MANAGEMENT":
+			*i = ThirdPartyCategoryDocumentManagement
+		case "EMPLOYEE_MANAGEMENT":
+			*i = ThirdPartyCategoryEmployeeManagement
+		case "ENGINEERING":
+			*i = ThirdPartyCategoryEngineering
+		case "FINANCE":
+			*i = ThirdPartyCategoryFinance
+		case "IDENTITY_PROVIDER":
+			*i = ThirdPartyCategoryIdentityProvider
+		case "IT":
+			*i = ThirdPartyCategoryIT
+		case "MARKETING":
+			*i = ThirdPartyCategoryMarketing
+		case "OFFICE_OPERATIONS":
+			*i = ThirdPartyCategoryOfficeOperations
+		case "OTHER":
+			*i = ThirdPartyCategoryOther
+		case "PASSWORD_MANAGEMENT":
+			*i = ThirdPartyCategoryPasswordManagement
+		case "PRODUCT_AND_DESIGN":
+			*i = ThirdPartyCategoryProductAndDesign
+		case "PROFESSIONAL_SERVICES":
+			*i = ThirdPartyCategoryProfessionalServices
+		case "RECRUITING":
+			*i = ThirdPartyCategoryRecruiting
+		case "SALES":
+			*i = ThirdPartyCategorySales
+		case "SECURITY":
+			*i = ThirdPartyCategorySecurity
+		case "VERSION_CONTROL":
+			*i = ThirdPartyCategoryVersionControl
+		default:
+			return fmt.Errorf("invalid ThirdPartyCategory value: %q", v)
+		}
+	default:
+		return fmt.Errorf("unsupported type for ThirdPartyCategory: %T", value)
+	}
+	return nil
+}
+
+func (i ThirdPartyCategory) Value() (driver.Value, error) {
+	return i.String(), nil
+}
+
+func (i ThirdPartyCategory) MarshalJSON() ([]byte, error) {
+	return json.Marshal(i.String())
+}
+
+func (i *ThirdPartyCategory) UnmarshalJSON(data []byte) error {
+	var s string
+	if err := json.Unmarshal(data, &s); err != nil {
+		return err
+	}
+
+	switch s {
+	case "ANALYTICS":
+		*i = ThirdPartyCategoryAnalytics
+	case "CLOUD_MONITORING":
+		*i = ThirdPartyCategoryCloudMonitoring
+	case "CLOUD_PROVIDER":
+		*i = ThirdPartyCategoryCloudProvider
+	case "COLLABORATION":
+		*i = ThirdPartyCategoryCollaboration
+	case "CUSTOMER_SUPPORT":
+		*i = ThirdPartyCategoryCustomerSupport
+	case "DATA_STORAGE_AND_PROCESSING":
+		*i = ThirdPartyCategoryDataStorageAndProcessing
+	case "DOCUMENT_MANAGEMENT":
+		*i = ThirdPartyCategoryDocumentManagement
+	case "EMPLOYEE_MANAGEMENT":
+		*i = ThirdPartyCategoryEmployeeManagement
+	case "ENGINEERING":
+		*i = ThirdPartyCategoryEngineering
+	case "FINANCE":
+		*i = ThirdPartyCategoryFinance
+	case "IDENTITY_PROVIDER":
+		*i = ThirdPartyCategoryIdentityProvider
+	case "IT":
+		*i = ThirdPartyCategoryIT
+	case "MARKETING":
+		*i = ThirdPartyCategoryMarketing
+	case "OFFICE_OPERATIONS":
+		*i = ThirdPartyCategoryOfficeOperations
+	case "OTHER":
+		*i = ThirdPartyCategoryOther
+	case "PASSWORD_MANAGEMENT":
+		*i = ThirdPartyCategoryPasswordManagement
+	case "PRODUCT_AND_DESIGN":
+		*i = ThirdPartyCategoryProductAndDesign
+	case "PROFESSIONAL_SERVICES":
+		*i = ThirdPartyCategoryProfessionalServices
+	case "RECRUITING":
+		*i = ThirdPartyCategoryRecruiting
+	case "SALES":
+		*i = ThirdPartyCategorySales
+	case "SECURITY":
+		*i = ThirdPartyCategorySecurity
+	case "VERSION_CONTROL":
+		*i = ThirdPartyCategoryVersionControl
+	default:
+		return fmt.Errorf("invalid ThirdPartyCategory value: %q", s)
+	}
+	return nil
+}
+
+func (i *ThirdPartyCategory) UnmarshalText(text []byte) error {
+	s := string(text)
+
+	switch s {
+	case "ANALYTICS":
+		*i = ThirdPartyCategoryAnalytics
+	case "CLOUD_MONITORING":
+		*i = ThirdPartyCategoryCloudMonitoring
+	case "CLOUD_PROVIDER":
+		*i = ThirdPartyCategoryCloudProvider
+	case "COLLABORATION":
+		*i = ThirdPartyCategoryCollaboration
+	case "CUSTOMER_SUPPORT":
+		*i = ThirdPartyCategoryCustomerSupport
+	case "DATA_STORAGE_AND_PROCESSING":
+		*i = ThirdPartyCategoryDataStorageAndProcessing
+	case "DOCUMENT_MANAGEMENT":
+		*i = ThirdPartyCategoryDocumentManagement
+	case "EMPLOYEE_MANAGEMENT":
+		*i = ThirdPartyCategoryEmployeeManagement
+	case "ENGINEERING":
+		*i = ThirdPartyCategoryEngineering
+	case "FINANCE":
+		*i = ThirdPartyCategoryFinance
+	case "IDENTITY_PROVIDER":
+		*i = ThirdPartyCategoryIdentityProvider
+	case "IT":
+		*i = ThirdPartyCategoryIT
+	case "MARKETING":
+		*i = ThirdPartyCategoryMarketing
+	case "OFFICE_OPERATIONS":
+		*i = ThirdPartyCategoryOfficeOperations
+	case "OTHER":
+		*i = ThirdPartyCategoryOther
+	case "PASSWORD_MANAGEMENT":
+		*i = ThirdPartyCategoryPasswordManagement
+	case "PRODUCT_AND_DESIGN":
+		*i = ThirdPartyCategoryProductAndDesign
+	case "PROFESSIONAL_SERVICES":
+		*i = ThirdPartyCategoryProfessionalServices
+	case "RECRUITING":
+		*i = ThirdPartyCategoryRecruiting
+	case "SALES":
+		*i = ThirdPartyCategorySales
+	case "SECURITY":
+		*i = ThirdPartyCategorySecurity
+	case "VERSION_CONTROL":
+		*i = ThirdPartyCategoryVersionControl
+	default:
+		return fmt.Errorf("invalid ThirdPartyCategory value: %q", s)
+	}
+	return nil
+}
--- a/pkg/coredata/third_party_compliance_report.go
+++ b/pkg/coredata/third_party_compliance_report.go
@@ -28,10 +28,10 @@ import (
 )

 type (
-	VendorComplianceReport struct {
+	ThirdPartyComplianceReport struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		ReportDate     time.Time  `db:"report_date"`
 		ValidUntil     *time.Time `db:"valid_until"`
 		ReportName     string     `db:"report_name"`
@@ -40,46 +40,46 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}

-	VendorComplianceReports []*VendorComplianceReport
+	ThirdPartyComplianceReports []*ThirdPartyComplianceReport
 )

-func (c VendorComplianceReport) CursorKey(orderBy VendorComplianceReportOrderField) page.CursorKey {
+func (c ThirdPartyComplianceReport) CursorKey(orderBy ThirdPartyComplianceReportOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorComplianceReportOrderFieldReportDate:
+	case ThirdPartyComplianceReportOrderFieldReportDate:
 		return page.NewCursorKey(c.ID, c.ReportDate)
-	case VendorComplianceReportOrderFieldCreatedAt:
+	case ThirdPartyComplianceReportOrderFieldCreatedAt:
 		return page.NewCursorKey(c.ID, c.CreatedAt)
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (v *VendorComplianceReport) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_compliance_reports WHERE id = $1 LIMIT 1;`
+func (v *ThirdPartyComplianceReport) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_compliance_reports WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, v.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor compliance report authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty compliance report authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

-func (vcs *VendorComplianceReports) LoadForVendorID(
+func (vcs *ThirdPartyComplianceReports) LoadForThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorComplianceReportOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyComplianceReportOrderField],
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	report_date,
 	valid_until,
 	report_name,
@@ -87,43 +87,43 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 	AND %s
 `

 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())

-	args := pgx.NamedArgs{"vendor_id": vendorID}
+	args := pgx.NamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot query thirdParty compliance reports: %w", err)
 	}

-	vendorComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorComplianceReport])
+	thirdPartyComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyComplianceReport])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot collect thirdParty compliance reports: %w", err)
 	}

-	*vcs = vendorComplianceReports
+	*vcs = thirdPartyComplianceReports

 	return nil
 }

-func (vcs *VendorComplianceReports) LoadByVendorIDs(
+func (vcs *ThirdPartyComplianceReports) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vcs = VendorComplianceReports{}
+	if len(thirdPartyIDs) == 0 {
+		*vcs = ThirdPartyComplianceReports{}
 		return nil
 	}

@@ -131,7 +131,7 @@ func (vcs *VendorComplianceReports) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	report_date,
 	valid_until,
 	report_name,
@@ -139,51 +139,51 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 ORDER BY
-	vendor_id, report_date DESC
+	third_party_id, report_date DESC
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}

-	args := pgx.NamedArgs{"vendor_ids": ids}
+	args := pgx.NamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot query thirdParty compliance reports: %w", err)
 	}

-	vendorComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorComplianceReport])
+	thirdPartyComplianceReports, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyComplianceReport])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor compliance reports: %w", err)
+		return fmt.Errorf("cannot collect thirdParty compliance reports: %w", err)
 	}

-	*vcs = vendorComplianceReports
+	*vcs = thirdPartyComplianceReports

 	return nil
 }

-func (vcr *VendorComplianceReport) LoadByID(
+func (vcr *ThirdPartyComplianceReport) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorComplianceReportID gid.GID,
+	thirdPartyComplianceReportID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	report_date,
 	valid_until,
 	report_name,
@@ -191,7 +191,7 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
 	AND id = @id
@@ -200,36 +200,36 @@ LIMIT 1;

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.NamedArgs{"id": vendorComplianceReportID}
+	args := pgx.NamedArgs{"id": thirdPartyComplianceReportID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor compliance report: %w", err)
+		return fmt.Errorf("cannot query thirdParty compliance report: %w", err)
 	}

-	vendorComplianceReport, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorComplianceReport])
+	thirdPartyComplianceReport, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyComplianceReport])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor compliance report: %w", err)
+		return fmt.Errorf("cannot collect thirdParty compliance report: %w", err)
 	}

-	*vcr = vendorComplianceReport
+	*vcr = thirdPartyComplianceReport

 	return nil
 }

-func (vcr *VendorComplianceReport) Insert(
+func (vcr *ThirdPartyComplianceReport) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_compliance_reports (
+	third_party_compliance_reports (
 		id,
 		organization_id,
 		tenant_id,
-		vendor_id,
+		third_party_id,
 		report_date,
 		valid_until,
 		report_name,
@@ -241,7 +241,7 @@ VALUES (
 	@id,
 	@organization_id,
 	@tenant_id,
-	@vendor_id,
+	@third_party_id,
 	@report_date,
 	@valid_until,
 	@report_name,
@@ -254,7 +254,7 @@ VALUES (
 		"id":              vcr.ID,
 		"organization_id": vcr.OrganizationID,
 		"tenant_id":       scope.GetTenantID(),
-		"vendor_id":       vcr.VendorID,
+		"third_party_id":  vcr.ThirdPartyID,
 		"report_date":     vcr.ReportDate,
 		"valid_until":     vcr.ValidUntil,
 		"report_name":     vcr.ReportName,
@@ -267,7 +267,7 @@ VALUES (
 	return err
 }

-func (vcr *VendorComplianceReport) Delete(
+func (vcr *ThirdPartyComplianceReport) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
@@ -275,7 +275,7 @@ func (vcr *VendorComplianceReport) Delete(
 	q := `
 DELETE
 FROM
-	vendor_compliance_reports
+	third_party_compliance_reports
 WHERE
 	%s
 	AND id = @id
@@ -292,13 +292,13 @@ RETURNING report_file_id
 	err := conn.QueryRow(ctx, q, args).Scan(&vcrFileId)

 	if err != nil {
-		return fmt.Errorf("cannot delete vendor compliance report: %w", err)
+		return fmt.Errorf("cannot delete thirdParty compliance report: %w", err)
 	}

 	if vcrFileId != nil {
 		file := &File{ID: *vcrFileId}
 		if err = file.SoftDelete(ctx, conn, scope); err != nil {
-			return fmt.Errorf("cannot soft delete vendor compliance file: %w", err)
+			return fmt.Errorf("cannot soft delete thirdParty compliance file: %w", err)
 		}
 	}
 	return nil
--- a/pkg/coredata/third_party_compliance_report_order_field.go
+++ b/pkg/coredata/third_party_compliance_report_order_field.go
@@ -15,27 +15,27 @@
 package coredata

 type (
-	VendorDataPrivacyAgreementOrderField string
+	ThirdPartyComplianceReportOrderField string
 )

 const (
-	VendorDataPrivacyAgreementOrderFieldValidFrom VendorDataPrivacyAgreementOrderField = "VALID_FROM"
-	VendorDataPrivacyAgreementOrderFieldCreatedAt VendorDataPrivacyAgreementOrderField = "CREATED_AT"
+	ThirdPartyComplianceReportOrderFieldReportDate ThirdPartyComplianceReportOrderField = "REPORT_DATE"
+	ThirdPartyComplianceReportOrderFieldCreatedAt  ThirdPartyComplianceReportOrderField = "CREATED_AT"
 )

-func (p VendorDataPrivacyAgreementOrderField) Column() string {
+func (p ThirdPartyComplianceReportOrderField) Column() string {
 	return string(p)
 }

-func (p VendorDataPrivacyAgreementOrderField) String() string {
+func (p ThirdPartyComplianceReportOrderField) String() string {
 	return string(p)
 }

-func (p VendorDataPrivacyAgreementOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyComplianceReportOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *VendorDataPrivacyAgreementOrderField) UnmarshalText(text []byte) error {
-	*p = VendorDataPrivacyAgreementOrderField(text)
+func (p *ThirdPartyComplianceReportOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyComplianceReportOrderField(text)
 	return nil
 }
--- a/pkg/coredata/third_party_contact.go
+++ b/pkg/coredata/third_party_contact.go
@@ -29,10 +29,10 @@ import (
 )

 type (
-	VendorContact struct {
+	ThirdPartyContact struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		FullName       *string    `db:"full_name"`
 		Email          *mail.Addr `db:"email"`
 		Phone          *string    `db:"phone"`
@@ -41,47 +41,47 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}

-	VendorContacts []*VendorContact
+	ThirdPartyContacts []*ThirdPartyContact
 )

-func (vc VendorContact) CursorKey(orderBy VendorContactOrderField) page.CursorKey {
+func (vc ThirdPartyContact) CursorKey(orderBy ThirdPartyContactOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorContactOrderFieldCreatedAt:
+	case ThirdPartyContactOrderFieldCreatedAt:
 		return page.CursorKey{ID: vc.ID, Value: vc.CreatedAt}
-	case VendorContactOrderFieldFullName:
+	case ThirdPartyContactOrderFieldFullName:
 		return page.CursorKey{ID: vc.ID, Value: vc.FullName}
-	case VendorContactOrderFieldEmail:
+	case ThirdPartyContactOrderFieldEmail:
 		return page.CursorKey{ID: vc.ID, Value: vc.Email}
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (vc *VendorContact) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_contacts WHERE id = $1 LIMIT 1;`
+func (vc *ThirdPartyContact) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_contacts WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vc.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor contact authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty contact authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

-func (vc *VendorContact) LoadByID(
+func (vc *ThirdPartyContact) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorContactID gid.GID,
+	thirdPartyContactID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	full_name,
 	email,
 	phone,
@@ -89,50 +89,50 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND id = @vendor_contact_id
+	AND id = @third_party_contact_id
 LIMIT 1;
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_contact_id": vendorContactID}
+	args := pgx.StrictNamedArgs{"third_party_contact_id": thirdPartyContactID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor contact: %w", err)
+		return fmt.Errorf("cannot query thirdParty contact: %w", err)
 	}
 	defer rows.Close()

-	vendorContact, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorContact])
+	thirdPartyContact, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyContact])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}

-		return fmt.Errorf("cannot collect vendor contact: %w", err)
+		return fmt.Errorf("cannot collect thirdParty contact: %w", err)
 	}

-	*vc = vendorContact
+	*vc = thirdPartyContact

 	return nil
 }

-func (vc *VendorContacts) LoadByVendorID(
+func (vc *ThirdPartyContacts) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorContactOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyContactOrderField],
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	full_name,
 	email,
 	phone,
@@ -140,45 +140,45 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 	AND %s
 `
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_id": vendorID,
+		"third_party_id": thirdPartyID,
 	}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor contacts: %w", err)
+		return fmt.Errorf("cannot query thirdParty contacts: %w", err)
 	}
 	defer rows.Close()

-	vendorContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorContact])
+	thirdPartyContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyContact])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor contacts: %w", err)
+		return fmt.Errorf("cannot collect thirdParty contacts: %w", err)
 	}

-	*vc = vendorContacts
+	*vc = thirdPartyContacts

 	return nil
 }

-func (vc *VendorContacts) LoadByVendorIDs(
+func (vc *ThirdPartyContacts) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vc = VendorContacts{}
+	if len(thirdPartyIDs) == 0 {
+		*vc = ThirdPartyContacts{}
 		return nil
 	}

@@ -186,7 +186,7 @@ func (vc *VendorContacts) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	full_name,
 	email,
 	phone,
@@ -194,52 +194,52 @@ SELECT
 	created_at,
 	updated_at
 FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 ORDER BY
-	vendor_id, full_name ASC
+	third_party_id, full_name ASC
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())

-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}

-	args := pgx.StrictNamedArgs{"vendor_ids": ids}
+	args := pgx.StrictNamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor contacts: %w", err)
+		return fmt.Errorf("cannot query thirdParty contacts: %w", err)
 	}
 	defer rows.Close()

-	vendorContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorContact])
+	thirdPartyContacts, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyContact])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor contacts: %w", err)
+		return fmt.Errorf("cannot collect thirdParty contacts: %w", err)
 	}

-	*vc = vendorContacts
+	*vc = thirdPartyContacts

 	return nil
 }

-func (vc VendorContact) Insert(
+func (vc ThirdPartyContact) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_contacts (
+	third_party_contacts (
 		tenant_id,
 		id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		full_name,
 		email,
 		phone,
@@ -249,9 +249,9 @@ INSERT INTO
 	)
 VALUES (
 	@tenant_id,
-	@vendor_contact_id,
+	@third_party_contact_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@full_name,
 	@email,
 	@phone,
@@ -262,34 +262,34 @@ VALUES (
 `

 	args := pgx.StrictNamedArgs{
-		"tenant_id":         scope.GetTenantID(),
-		"vendor_contact_id": vc.ID,
-		"organization_id":   vc.OrganizationID,
-		"vendor_id":         vc.VendorID,
-		"full_name":         vc.FullName,
-		"email":             vc.Email,
-		"phone":             vc.Phone,
-		"role":              vc.Role,
-		"created_at":        vc.CreatedAt,
-		"updated_at":        vc.UpdatedAt,
+		"tenant_id":              scope.GetTenantID(),
+		"third_party_contact_id": vc.ID,
+		"organization_id":        vc.OrganizationID,
+		"third_party_id":         vc.ThirdPartyID,
+		"full_name":              vc.FullName,
+		"email":                  vc.Email,
+		"phone":                  vc.Phone,
+		"role":                   vc.Role,
+		"created_at":             vc.CreatedAt,
+		"updated_at":             vc.UpdatedAt,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert vendor contact: %w", err)
+		return fmt.Errorf("cannot insert thirdParty contact: %w", err)
 	}

 	return nil
 }

-func (vc VendorContact) Update(
+func (vc ThirdPartyContact) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_contacts
+	third_party_contacts
 SET
 	full_name = @full_name,
 	email = @email,
@@ -298,52 +298,52 @@ SET
 	updated_at = @updated_at
 WHERE
 	%s
-	AND id = @vendor_contact_id
+	AND id = @third_party_contact_id
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_contact_id": vc.ID,
-		"full_name":         vc.FullName,
-		"email":             vc.Email,
-		"phone":             vc.Phone,
-		"role":              vc.Role,
-		"updated_at":        vc.UpdatedAt,
+		"third_party_contact_id": vc.ID,
+		"full_name":              vc.FullName,
+		"email":                  vc.Email,
+		"phone":                  vc.Phone,
+		"role":                   vc.Role,
+		"updated_at":             vc.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor contact: %w", err)
+		return fmt.Errorf("cannot update thirdParty contact: %w", err)
 	}

 	return nil
 }

-func (vc VendorContact) Delete(
+func (vc ThirdPartyContact) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 DELETE FROM
-	vendor_contacts
+	third_party_contacts
 WHERE
 	%s
-	AND id = @vendor_contact_id
+	AND id = @third_party_contact_id
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_contact_id": vc.ID}
+	args := pgx.StrictNamedArgs{"third_party_contact_id": vc.ID}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot delete vendor contact: %w", err)
+		return fmt.Errorf("cannot delete thirdParty contact: %w", err)
 	}

 	return nil
--- a/pkg/coredata/third_party_contact_order_field.go
+++ b/pkg/coredata/third_party_contact_order_field.go
@@ -15,28 +15,28 @@
 package coredata

 type (
-	VendorContactOrderField string
+	ThirdPartyContactOrderField string
 )

 const (
-	VendorContactOrderFieldCreatedAt VendorContactOrderField = "CREATED_AT"
-	VendorContactOrderFieldFullName  VendorContactOrderField = "FULL_NAME"
-	VendorContactOrderFieldEmail     VendorContactOrderField = "EMAIL"
+	ThirdPartyContactOrderFieldCreatedAt ThirdPartyContactOrderField = "CREATED_AT"
+	ThirdPartyContactOrderFieldFullName  ThirdPartyContactOrderField = "FULL_NAME"
+	ThirdPartyContactOrderFieldEmail     ThirdPartyContactOrderField = "EMAIL"
 )

-func (p VendorContactOrderField) Column() string {
+func (p ThirdPartyContactOrderField) Column() string {
 	return string(p)
 }

-func (p VendorContactOrderField) String() string {
+func (p ThirdPartyContactOrderField) String() string {
 	return string(p)
 }

-func (p VendorContactOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyContactOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *VendorContactOrderField) UnmarshalText(text []byte) error {
-	*p = VendorContactOrderField(text)
+func (p *ThirdPartyContactOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyContactOrderField(text)
 	return nil
 }
--- a/pkg/coredata/third_party_data_privacy_agreement.go
+++ b/pkg/coredata/third_party_data_privacy_agreement.go
@@ -29,10 +29,10 @@ import (
 )

 type (
-	VendorDataPrivacyAgreement struct {
+	ThirdPartyDataPrivacyAgreement struct {
 		ID             gid.GID    `db:"id"`
 		OrganizationID gid.GID    `db:"organization_id"`
-		VendorID       gid.GID    `db:"vendor_id"`
+		ThirdPartyID   gid.GID    `db:"third_party_id"`
 		ValidFrom      *time.Time `db:"valid_from"`
 		ValidUntil     *time.Time `db:"valid_until"`
 		FileID         gid.GID    `db:"file_id"`
@@ -40,87 +40,87 @@ type (
 		UpdatedAt      time.Time  `db:"updated_at"`
 	}

-	VendorDataPrivacyAgreements []*VendorDataPrivacyAgreement
+	ThirdPartyDataPrivacyAgreements []*ThirdPartyDataPrivacyAgreement
 )

-func (v VendorDataPrivacyAgreement) CursorKey(orderBy VendorDataPrivacyAgreementOrderField) page.CursorKey {
+func (v ThirdPartyDataPrivacyAgreement) CursorKey(orderBy ThirdPartyDataPrivacyAgreementOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorDataPrivacyAgreementOrderFieldValidFrom:
+	case ThirdPartyDataPrivacyAgreementOrderFieldValidFrom:
 		return page.NewCursorKey(v.ID, v.ValidFrom)
-	case VendorDataPrivacyAgreementOrderFieldCreatedAt:
+	case ThirdPartyDataPrivacyAgreementOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (vdpa *VendorDataPrivacyAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_data_privacy_agreements WHERE id = $1 LIMIT 1;`
+func (vdpa *ThirdPartyDataPrivacyAgreement) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_data_privacy_agreements WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vdpa.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor data privacy agreement authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty data privacy agreement authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

-func (vdpa *VendorDataPrivacyAgreement) LoadByVendorID(
+func (vdpa *ThirdPartyDataPrivacyAgreement) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 LIMIT 1;
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.NamedArgs{"vendor_id": vendorID}
+	args := pgx.NamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty data privacy agreement: %w", err)
 	}

-	vendorDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorDataPrivacyAgreement])
+	thirdPartyDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyDataPrivacyAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty data privacy agreement: %w", err)
 	}

-	*vdpa = vendorDataPrivacyAgreement
+	*vdpa = thirdPartyDataPrivacyAgreement

 	return nil
 }

-func (vdpas *VendorDataPrivacyAgreements) LoadByVendorIDs(
+func (vdpas *ThirdPartyDataPrivacyAgreements) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vdpas = VendorDataPrivacyAgreements{}
+	if len(thirdPartyIDs) == 0 {
+		*vdpas = ThirdPartyDataPrivacyAgreements{}
 		return nil
 	}

@@ -128,38 +128,38 @@ func (vdpas *VendorDataPrivacyAgreements) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}

-	args := pgx.NamedArgs{"vendor_ids": ids}
+	args := pgx.NamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor data privacy agreements: %w", err)
+		return fmt.Errorf("cannot query thirdParty data privacy agreements: %w", err)
 	}

-	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorDataPrivacyAgreement])
+	agreements, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyDataPrivacyAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor data privacy agreements: %w", err)
+		return fmt.Errorf("cannot collect thirdParty data privacy agreements: %w", err)
 	}

 	*vdpas = agreements
@@ -167,24 +167,24 @@ WHERE
 	return nil
 }

-func (vdpa *VendorDataPrivacyAgreement) LoadByID(
+func (vdpa *ThirdPartyDataPrivacyAgreement) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorDataPrivacyAgreementID gid.GID,
+	thirdPartyDataPrivacyAgreementID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	valid_from,
 	valid_until,
 	file_id,
 	created_at,
 	updated_at
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
 	AND id = @id
@@ -193,32 +193,32 @@ LIMIT 1;

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.NamedArgs{"id": vendorDataPrivacyAgreementID}
+	args := pgx.NamedArgs{"id": thirdPartyDataPrivacyAgreementID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot query thirdParty data privacy agreement: %w", err)
 	}

-	vendorDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorDataPrivacyAgreement])
+	thirdPartyDataPrivacyAgreement, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyDataPrivacyAgreement])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot collect thirdParty data privacy agreement: %w", err)
 	}

-	*vdpa = vendorDataPrivacyAgreement
+	*vdpa = thirdPartyDataPrivacyAgreement

 	return nil
 }

-func (vdpa *VendorDataPrivacyAgreement) Update(
+func (vdpa *ThirdPartyDataPrivacyAgreement) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 SET
 	valid_from = @valid_from,
 	valid_until = @valid_until,
@@ -243,24 +243,24 @@ WHERE

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot update thirdParty data privacy agreement: %w", err)
 	}

 	return nil
 }

-func (vdpa *VendorDataPrivacyAgreement) Upsert(
+func (vdpa *ThirdPartyDataPrivacyAgreement) Upsert(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_data_privacy_agreements (
+	third_party_data_privacy_agreements (
 		id,
 		tenant_id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		valid_from,
 		valid_until,
 		file_id,
@@ -271,14 +271,14 @@ VALUES (
 	@id,
 	@tenant_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@valid_from,
 	@valid_until,
 	@file_id,
 	@created_at,
 	@updated_at
 )
-ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
+ON CONFLICT (organization_id, third_party_id) DO UPDATE SET
 	id = EXCLUDED.id,
 	valid_from = EXCLUDED.valid_from,
 	valid_until = EXCLUDED.valid_until,
@@ -288,7 +288,7 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	args := pgx.StrictNamedArgs{
 		"id":              vdpa.ID,
 		"tenant_id":       scope.GetTenantID(),
-		"vendor_id":       vdpa.VendorID,
+		"third_party_id":  vdpa.ThirdPartyID,
 		"organization_id": vdpa.OrganizationID,
 		"valid_from":      vdpa.ValidFrom,
 		"valid_until":     vdpa.ValidUntil,
@@ -301,16 +301,16 @@ ON CONFLICT (organization_id, vendor_id) DO UPDATE SET
 	if err != nil {
 		var pgErr *pgconn.PgError
 		if errors.As(err, &pgErr) {
-			if pgErr.Code == "23505" && pgErr.ConstraintName == "vendor_data_privacy_agreements_source_id_snapshot_id_key" {
+			if pgErr.Code == "23505" && pgErr.ConstraintName == "third_party_data_privacy_agreements_source_id_snapshot_id_key" {
 				return ErrResourceAlreadyExists
 			}
 		}
-		return fmt.Errorf("cannot upsert vendor data privacy agreement: %w", err)
+		return fmt.Errorf("cannot upsert thirdParty data privacy agreement: %w", err)
 	}
 	return nil
 }

-func (vdpa *VendorDataPrivacyAgreement) Delete(
+func (vdpa *ThirdPartyDataPrivacyAgreement) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
@@ -318,7 +318,7 @@ func (vdpa *VendorDataPrivacyAgreement) Delete(
 	q := `
 DELETE
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
 	AND id = @id
@@ -334,24 +334,24 @@ WHERE
 	return err
 }

-func (vdpa *VendorDataPrivacyAgreement) DeleteByVendorID(
+func (vdpa *ThirdPartyDataPrivacyAgreement) DeleteByThirdPartyID(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 DELETE
 FROM
-	vendor_data_privacy_agreements
+	third_party_data_privacy_agreements
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
--- a/pkg/coredata/third_party_data_privacy_agreement_order_field.go
+++ b/pkg/coredata/third_party_data_privacy_agreement_order_field.go
@@ -0,0 +1,41 @@
+// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	ThirdPartyDataPrivacyAgreementOrderField string
+)
+
+const (
+	ThirdPartyDataPrivacyAgreementOrderFieldValidFrom ThirdPartyDataPrivacyAgreementOrderField = "VALID_FROM"
+	ThirdPartyDataPrivacyAgreementOrderFieldCreatedAt ThirdPartyDataPrivacyAgreementOrderField = "CREATED_AT"
+)
+
+func (p ThirdPartyDataPrivacyAgreementOrderField) Column() string {
+	return string(p)
+}
+
+func (p ThirdPartyDataPrivacyAgreementOrderField) String() string {
+	return string(p)
+}
+
+func (p ThirdPartyDataPrivacyAgreementOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *ThirdPartyDataPrivacyAgreementOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyDataPrivacyAgreementOrderField(text)
+	return nil
+}
--- a/pkg/coredata/third_party_filter.go
+++ b/pkg/coredata/third_party_filter.go
@@ -19,18 +19,18 @@ import (
 )

 type (
-	VendorFilter struct {
+	ThirdPartyFilter struct {
 		showOnTrustCenter *bool
 	}
 )

-func NewVendorFilter(showOnTrustCenter *bool) *VendorFilter {
-	return &VendorFilter{
+func NewThirdPartyFilter(showOnTrustCenter *bool) *ThirdPartyFilter {
+	return &ThirdPartyFilter{
 		showOnTrustCenter: showOnTrustCenter,
 	}
 }

-func (f *VendorFilter) SQLArguments() pgx.StrictNamedArgs {
+func (f *ThirdPartyFilter) SQLArguments() pgx.StrictNamedArgs {
 	args := pgx.StrictNamedArgs{}

 	if f.showOnTrustCenter != nil {
@@ -42,7 +42,7 @@ func (f *VendorFilter) SQLArguments() pgx.StrictNamedArgs {
 	return args
 }

-func (f *VendorFilter) SQLFragment() string {
+func (f *ThirdPartyFilter) SQLFragment() string {
 	return `
 (
 	CASE
--- a/pkg/coredata/third_party_order_field.go
+++ b/pkg/coredata/third_party_order_field.go
@@ -15,28 +15,28 @@
 package coredata

 type (
-	VendorOrderField string
+	ThirdPartyOrderField string
 )

 const (
-	VendorOrderFieldCreatedAt VendorOrderField = "CREATED_AT"
-	VendorOrderFieldUpdatedAt VendorOrderField = "UPDATED_AT"
-	VendorOrderFieldName      VendorOrderField = "NAME"
+	ThirdPartyOrderFieldCreatedAt ThirdPartyOrderField = "CREATED_AT"
+	ThirdPartyOrderFieldUpdatedAt ThirdPartyOrderField = "UPDATED_AT"
+	ThirdPartyOrderFieldName      ThirdPartyOrderField = "NAME"
 )

-func (p VendorOrderField) Column() string {
+func (p ThirdPartyOrderField) Column() string {
 	return string(p)
 }

-func (p VendorOrderField) String() string {
+func (p ThirdPartyOrderField) String() string {
 	return string(p)
 }

-func (p VendorOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *VendorOrderField) UnmarshalText(text []byte) error {
-	*p = VendorOrderField(text)
+func (p *ThirdPartyOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyOrderField(text)
 	return nil
 }
--- a/pkg/coredata/third_party_risk_assessment.go
+++ b/pkg/coredata/third_party_risk_assessment.go
@@ -28,11 +28,11 @@ import (
 )

 type (
-	// RiskAssessment represents a point-in-time risk assessment for a vendor
-	VendorRiskAssessment struct {
+	// RiskAssessment represents a point-in-time risk assessment for a thirdParty
+	ThirdPartyRiskAssessment struct {
 		ID              gid.GID         `db:"id"`
 		OrganizationID  gid.GID         `db:"organization_id"`
-		VendorID        gid.GID         `db:"vendor_id"`
+		ThirdPartyID    gid.GID         `db:"third_party_id"`
 		ExpiresAt       time.Time       `db:"expires_at"`
 		DataSensitivity DataSensitivity `db:"data_sensitivity"`
 		BusinessImpact  BusinessImpact  `db:"business_impact"`
@@ -41,47 +41,47 @@ type (
 		UpdatedAt       time.Time       `db:"updated_at"`
 	}

-	VendorRiskAssessments []*VendorRiskAssessment
+	ThirdPartyRiskAssessments []*ThirdPartyRiskAssessment
 )

-func (v VendorRiskAssessment) CursorKey(orderBy VendorRiskAssessmentOrderField) page.CursorKey {
+func (v ThirdPartyRiskAssessment) CursorKey(orderBy ThirdPartyRiskAssessmentOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorRiskAssessmentOrderFieldCreatedAt:
+	case ThirdPartyRiskAssessmentOrderFieldCreatedAt:
 		return page.NewCursorKey(v.ID, v.CreatedAt)
-	case VendorRiskAssessmentOrderFieldExpiresAt:
+	case ThirdPartyRiskAssessmentOrderFieldExpiresAt:
 		return page.NewCursorKey(v.ID, v.ExpiresAt)
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (v *VendorRiskAssessment) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_risk_assessments WHERE id = $1 LIMIT 1;`
+func (v *ThirdPartyRiskAssessment) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_risk_assessments WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, v.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor risk assessment authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty risk assessment authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

 // Insert adds a new risk assessment to the database
-func (r VendorRiskAssessment) Insert(
+func (r ThirdPartyRiskAssessment) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-    vendor_risk_assessments (
+    third_party_risk_assessments (
        tenant_id,
        id,
        organization_id,
-        vendor_id,
+        third_party_id,
        expires_at,
        data_sensitivity,
        business_impact,
@@ -93,7 +93,7 @@ VALUES (
    @tenant_id,
    @id,
    @organization_id,
-    @vendor_id,
+    @third_party_id,
    @expires_at,
    @data_sensitivity,
    @business_impact,
@@ -107,7 +107,7 @@ VALUES (
 		"tenant_id":        scope.GetTenantID(),
 		"id":               r.ID,
 		"organization_id":  r.OrganizationID,
-		"vendor_id":        r.VendorID,
+		"third_party_id":   r.ThirdPartyID,
 		"expires_at":       r.ExpiresAt,
 		"data_sensitivity": r.DataSensitivity,
 		"business_impact":  r.BusinessImpact,
@@ -120,7 +120,7 @@ VALUES (
 }

 // LoadByID loads a risk assessment by its ID
-func (r *VendorRiskAssessment) LoadByID(
+func (r *ThirdPartyRiskAssessment) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
@@ -130,7 +130,7 @@ func (r *VendorRiskAssessment) LoadByID(
 SELECT
    id,
    organization_id,
-    vendor_id,
+    third_party_id,
    expires_at,
    data_sensitivity,
    business_impact,
@@ -138,7 +138,7 @@ SELECT
    created_at,
    updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
    %s
    AND id = @id
@@ -156,7 +156,7 @@ LIMIT 1;
 	}
 	defer rows.Close()

-	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
+	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessment: %w", err)
 	}
@@ -166,18 +166,18 @@ LIMIT 1;
 	return nil
 }

-// LoadLatestByVendorID loads the most recent risk assessment for a vendor
-func (r *VendorRiskAssessment) LoadLatestByVendorID(
+// LoadLatestByThirdPartyID loads the most recent risk assessment for a thirdParty
+func (r *ThirdPartyRiskAssessment) LoadLatestByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
+	thirdPartyID gid.GID,
 ) error {
 	q := `
 SELECT
    id,
    organization_id,
-    vendor_id,
+    third_party_id,
    expires_at,
    data_sensitivity,
    business_impact,
@@ -185,10 +185,10 @@ SELECT
    created_at,
    updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
    %s
-    AND vendor_id = @vendor_id
+    AND third_party_id = @third_party_id
    AND snapshot_id IS NULL
 ORDER BY
    created_at DESC
@@ -197,7 +197,7 @@ LIMIT 1;

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
@@ -206,7 +206,7 @@ LIMIT 1;
 	}
 	defer rows.Close()

-	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorRiskAssessment])
+	assessment, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessment: %w", err)
 	}
@@ -216,19 +216,19 @@ LIMIT 1;
 	return nil
 }

-// LoadByVendorID loads all risk assessments for a vendor, ordered by assessment date
-func (r *VendorRiskAssessments) LoadByVendorID(
+// LoadByThirdPartyID loads all risk assessments for a thirdParty, ordered by assessment date
+func (r *ThirdPartyRiskAssessments) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorRiskAssessmentOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyRiskAssessmentOrderField],
 ) error {
 	q := `
 SELECT
    id,
    organization_id,
-    vendor_id,
+    third_party_id,
    expires_at,
    data_sensitivity,
    business_impact,
@@ -236,17 +236,17 @@ SELECT
    created_at,
    updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
    %s
-    AND vendor_id = @vendor_id
+    AND third_party_id = @third_party_id
    AND snapshot_id IS NULL
 	AND %s
 `

 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_id": vendorID}
+	args := pgx.StrictNamedArgs{"third_party_id": thirdPartyID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())

@@ -255,7 +255,7 @@ WHERE
 		return fmt.Errorf("cannot query risk assessments: %w", err)
 	}

-	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorRiskAssessment])
+	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessments: %w", err)
 	}
@@ -265,14 +265,14 @@ WHERE
 	return nil
 }

-func (r *VendorRiskAssessments) LoadByVendorIDs(
+func (r *ThirdPartyRiskAssessments) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*r = VendorRiskAssessments{}
+	if len(thirdPartyIDs) == 0 {
+		*r = ThirdPartyRiskAssessments{}
 		return nil
 	}

@@ -280,7 +280,7 @@ func (r *VendorRiskAssessments) LoadByVendorIDs(
 SELECT
    id,
    organization_id,
-    vendor_id,
+    third_party_id,
    expires_at,
    data_sensitivity,
    business_impact,
@@ -288,23 +288,23 @@ SELECT
    created_at,
    updated_at
 FROM
-    vendor_risk_assessments
+    third_party_risk_assessments
 WHERE
    %s
-    AND vendor_id = ANY(@vendor_ids)
+    AND third_party_id = ANY(@third_party_ids)
    AND snapshot_id IS NULL
 ORDER BY
-    vendor_id, created_at DESC
+    third_party_id, created_at DESC
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}

-	args := pgx.StrictNamedArgs{"vendor_ids": ids}
+	args := pgx.StrictNamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
@@ -312,7 +312,7 @@ ORDER BY
 		return fmt.Errorf("cannot query risk assessments: %w", err)
 	}

-	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorRiskAssessment])
+	assessments, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyRiskAssessment])
 	if err != nil {
 		return fmt.Errorf("cannot collect risk assessments: %w", err)
 	}
--- a/pkg/coredata/third_party_risk_assessment_order_field.go
+++ b/pkg/coredata/third_party_risk_assessment_order_field.go
@@ -15,27 +15,27 @@
 package coredata

 type (
-	VendorComplianceReportOrderField string
+	ThirdPartyRiskAssessmentOrderField string
 )

 const (
-	VendorComplianceReportOrderFieldReportDate VendorComplianceReportOrderField = "REPORT_DATE"
-	VendorComplianceReportOrderFieldCreatedAt  VendorComplianceReportOrderField = "CREATED_AT"
+	ThirdPartyRiskAssessmentOrderFieldCreatedAt ThirdPartyRiskAssessmentOrderField = "CREATED_AT"
+	ThirdPartyRiskAssessmentOrderFieldExpiresAt ThirdPartyRiskAssessmentOrderField = "EXPIRES_AT"
 )

-func (p VendorComplianceReportOrderField) Column() string {
+func (p ThirdPartyRiskAssessmentOrderField) Column() string {
 	return string(p)
 }

-func (p VendorComplianceReportOrderField) String() string {
+func (p ThirdPartyRiskAssessmentOrderField) String() string {
 	return string(p)
 }

-func (p VendorComplianceReportOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyRiskAssessmentOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *VendorComplianceReportOrderField) UnmarshalText(text []byte) error {
-	*p = VendorComplianceReportOrderField(text)
+func (p *ThirdPartyRiskAssessmentOrderField) UnmarshalText(text []byte) error {
+	*p = ThirdPartyRiskAssessmentOrderField(text)
 	return nil
 }
--- a/pkg/coredata/third_party_service.go
+++ b/pkg/coredata/third_party_service.go
@@ -28,148 +28,148 @@ import (
 )

 type (
-	VendorService struct {
+	ThirdPartyService struct {
 		ID             gid.GID   `db:"id"`
 		OrganizationID gid.GID   `db:"organization_id"`
-		VendorID       gid.GID   `db:"vendor_id"`
+		ThirdPartyID   gid.GID   `db:"third_party_id"`
 		Name           string    `db:"name"`
 		Description    *string   `db:"description"`
 		CreatedAt      time.Time `db:"created_at"`
 		UpdatedAt      time.Time `db:"updated_at"`
 	}

-	VendorServices []*VendorService
+	ThirdPartyServices []*ThirdPartyService
 )

-func (vs VendorService) CursorKey(orderBy VendorServiceOrderField) page.CursorKey {
+func (vs ThirdPartyService) CursorKey(orderBy ThirdPartyServiceOrderField) page.CursorKey {
 	switch orderBy {
-	case VendorServiceOrderFieldCreatedAt:
+	case ThirdPartyServiceOrderFieldCreatedAt:
 		return page.CursorKey{ID: vs.ID, Value: vs.CreatedAt}
-	case VendorServiceOrderFieldName:
+	case ThirdPartyServiceOrderFieldName:
 		return page.CursorKey{ID: vs.ID, Value: vs.Name}
 	}

 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }

-func (vs *VendorService) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
-	q := `SELECT organization_id FROM vendor_services WHERE id = $1 LIMIT 1;`
+func (vs *ThirdPartyService) AuthorizationAttributes(ctx context.Context, conn pg.Querier) (map[string]string, error) {
+	q := `SELECT organization_id FROM third_party_services WHERE id = $1 LIMIT 1;`

 	var organizationID gid.GID
 	if err := conn.QueryRow(ctx, q, vs.ID).Scan(&organizationID); err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrResourceNotFound
 		}
-		return nil, fmt.Errorf("cannot query vendor service authorization attributes: %w", err)
+		return nil, fmt.Errorf("cannot query thirdParty service authorization attributes: %w", err)
 	}

 	return map[string]string{"organization_id": organizationID.String()}, nil
 }

-func (vs *VendorService) LoadByID(
+func (vs *ThirdPartyService) LoadByID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorServiceID gid.GID,
+	thirdPartyServiceID gid.GID,
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	name,
 	description,
 	created_at,
 	updated_at
 FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND id = @vendor_service_id
+	AND id = @third_party_service_id
 LIMIT 1;
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_service_id": vendorServiceID}
+	args := pgx.StrictNamedArgs{"third_party_service_id": thirdPartyServiceID}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor service: %w", err)
+		return fmt.Errorf("cannot query thirdParty service: %w", err)
 	}
 	defer rows.Close()

-	vendorService, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[VendorService])
+	thirdPartyService, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ThirdPartyService])
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return ErrResourceNotFound
 		}

-		return fmt.Errorf("cannot collect vendor service: %w", err)
+		return fmt.Errorf("cannot collect thirdParty service: %w", err)
 	}

-	*vs = vendorService
+	*vs = thirdPartyService

 	return nil
 }

-func (vs *VendorServices) LoadByVendorID(
+func (vs *ThirdPartyServices) LoadByThirdPartyID(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorID gid.GID,
-	cursor *page.Cursor[VendorServiceOrderField],
+	thirdPartyID gid.GID,
+	cursor *page.Cursor[ThirdPartyServiceOrderField],
 ) error {
 	q := `
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	name,
 	description,
 	created_at,
 	updated_at
 FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND vendor_id = @vendor_id
+	AND third_party_id = @third_party_id
 	AND snapshot_id IS NULL
 	AND %s
 `
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_id": vendorID,
+		"third_party_id": thirdPartyID,
 	}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor services: %w", err)
+		return fmt.Errorf("cannot query thirdParty services: %w", err)
 	}
 	defer rows.Close()

-	vendorServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorService])
+	thirdPartyServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyService])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor services: %w", err)
+		return fmt.Errorf("cannot collect thirdParty services: %w", err)
 	}

-	*vs = vendorServices
+	*vs = thirdPartyServices

 	return nil
 }

-func (vs *VendorServices) LoadByVendorIDs(
+func (vs *ThirdPartyServices) LoadByThirdPartyIDs(
 	ctx context.Context,
 	conn pg.Querier,
 	scope Scoper,
-	vendorIDs []gid.GID,
+	thirdPartyIDs []gid.GID,
 ) error {
-	if len(vendorIDs) == 0 {
-		*vs = VendorServices{}
+	if len(thirdPartyIDs) == 0 {
+		*vs = ThirdPartyServices{}
 		return nil
 	}

@@ -177,58 +177,58 @@ func (vs *VendorServices) LoadByVendorIDs(
 SELECT
 	id,
 	organization_id,
-	vendor_id,
+	third_party_id,
 	name,
 	description,
 	created_at,
 	updated_at
 FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND vendor_id = ANY(@vendor_ids)
+	AND third_party_id = ANY(@third_party_ids)
 	AND snapshot_id IS NULL
 ORDER BY
-	vendor_id, name ASC
+	third_party_id, name ASC
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())

-	ids := make([]string, len(vendorIDs))
-	for i, id := range vendorIDs {
+	ids := make([]string, len(thirdPartyIDs))
+	for i, id := range thirdPartyIDs {
 		ids[i] = id.String()
 	}

-	args := pgx.StrictNamedArgs{"vendor_ids": ids}
+	args := pgx.StrictNamedArgs{"third_party_ids": ids}
 	maps.Copy(args, scope.SQLArguments())

 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query vendor services: %w", err)
+		return fmt.Errorf("cannot query thirdParty services: %w", err)
 	}
 	defer rows.Close()

-	vendorServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[VendorService])
+	thirdPartyServices, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ThirdPartyService])
 	if err != nil {
-		return fmt.Errorf("cannot collect vendor services: %w", err)
+		return fmt.Errorf("cannot collect thirdParty services: %w", err)
 	}

-	*vs = vendorServices
+	*vs = thirdPartyServices

 	return nil
 }

-func (vs VendorService) Insert(
+func (vs ThirdPartyService) Insert(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 INSERT INTO
-	vendor_services (
+	third_party_services (
 		tenant_id,
 		id,
 		organization_id,
-		vendor_id,
+		third_party_id,
 		name,
 		description,
 		created_at,
@@ -236,9 +236,9 @@ INSERT INTO
 	)
 VALUES (
 	@tenant_id,
-	@vendor_service_id,
+	@third_party_service_id,
 	@organization_id,
-	@vendor_id,
+	@third_party_id,
 	@name,
 	@description,
 	@created_at,
@@ -247,82 +247,82 @@ VALUES (
 `

 	args := pgx.StrictNamedArgs{
-		"tenant_id":         scope.GetTenantID(),
-		"vendor_service_id": vs.ID,
-		"organization_id":   vs.OrganizationID,
-		"vendor_id":         vs.VendorID,
-		"name":              vs.Name,
-		"description":       vs.Description,
-		"created_at":        vs.CreatedAt,
-		"updated_at":        vs.UpdatedAt,
+		"tenant_id":              scope.GetTenantID(),
+		"third_party_service_id": vs.ID,
+		"organization_id":        vs.OrganizationID,
+		"third_party_id":         vs.ThirdPartyID,
+		"name":                   vs.Name,
+		"description":            vs.Description,
+		"created_at":             vs.CreatedAt,
+		"updated_at":             vs.UpdatedAt,
 	}

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot insert vendor service: %w", err)
+		return fmt.Errorf("cannot insert thirdParty service: %w", err)
 	}

 	return nil
 }

-func (vs VendorService) Update(
+func (vs ThirdPartyService) Update(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 UPDATE
-	vendor_services
+	third_party_services
 SET
 	name = @name,
 	description = @description,
 	updated_at = @updated_at
 WHERE
 	%s
-	AND id = @vendor_service_id
+	AND id = @third_party_service_id
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

 	args := pgx.StrictNamedArgs{
-		"vendor_service_id": vs.ID,
-		"name":              vs.Name,
-		"description":       vs.Description,
-		"updated_at":        vs.UpdatedAt,
+		"third_party_service_id": vs.ID,
+		"name":                   vs.Name,
+		"description":            vs.Description,
+		"updated_at":             vs.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot update vendor service: %w", err)
+		return fmt.Errorf("cannot update thirdParty service: %w", err)
 	}

 	return nil
 }

-func (vs VendorService) Delete(
+func (vs ThirdPartyService) Delete(
 	ctx context.Context,
 	conn pg.Tx,
 	scope Scoper,
 ) error {
 	q := `
 DELETE FROM
-	vendor_services
+	third_party_services
 WHERE
 	%s
-	AND id = @vendor_service_id
+	AND id = @third_party_service_id
 	AND snapshot_id IS NULL
 `

 	q = fmt.Sprintf(q, scope.SQLFragment())

-	args := pgx.StrictNamedArgs{"vendor_service_id": vs.ID}
+	args := pgx.StrictNamedArgs{"third_party_service_id": vs.ID}
 	maps.Copy(args, scope.SQLArguments())

 	_, err := conn.Exec(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot delete vendor service: %w", err)
+		return fmt.Errorf("cannot delete thirdParty service: %w", err)
 	}

 	return nil
--- a/pkg/coredata/third_party_service_order_field.go
+++ b/pkg/coredata/third_party_service_order_field.go
@@ -19,33 +19,33 @@ import (
 )

 type (
-	VendorServiceOrderField string
+	ThirdPartyServiceOrderField string
 )

 const (
-	VendorServiceOrderFieldCreatedAt VendorServiceOrderField = "CREATED_AT"
-	VendorServiceOrderFieldName      VendorServiceOrderField = "NAME"
+	ThirdPartyServiceOrderFieldCreatedAt ThirdPartyServiceOrderField = "CREATED_AT"
+	ThirdPartyServiceOrderFieldName      ThirdPartyServiceOrderField = "NAME"
 )

-func (p VendorServiceOrderField) Column() string {
+func (p ThirdPartyServiceOrderField) Column() string {
 	return string(p)
 }

-func (p VendorServiceOrderField) String() string {
+func (p ThirdPartyServiceOrderField) String() string {
 	return string(p)
 }

-func (p VendorServiceOrderField) MarshalText() ([]byte, error) {
+func (p ThirdPartyServiceOrderField) MarshalText() ([]byte, error) {
 	return []byte(p.String()), nil
 }

-func (p *VendorServiceOrderField) UnmarshalText(text []byte) error {
+func (p *ThirdPartyServiceOrderField) UnmarshalText(text []byte) error {
 	val := string(text)
 	switch val {
-	case string(VendorServiceOrderFieldCreatedAt),
-		string(VendorServiceOrderFieldName):
-		*p = VendorServiceOrderField(val)
+	case string(ThirdPartyServiceOrderFieldCreatedAt),
+		string(ThirdPartyServiceOrderFieldName):
+		*p = ThirdPartyServiceOrderField(val)
 		return nil
 	}
-	return fmt.Errorf("invalid VendorServiceOrderField value: %q", val)
+	return fmt.Errorf("invalid ThirdPartyServiceOrderField value: %q", val)
 }
--- a/pkg/coredata/vendor_category.go
+++ b/pkg/coredata/vendor_category.go
@@ -1,255 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package coredata
-
-import (
-	"database/sql/driver"
-	"encoding/json"
-	"fmt"
-)
-
-type VendorCategory string
-
-const (
-	VendorCategoryAnalytics                VendorCategory = "ANALYTICS"
-	VendorCategoryCloudMonitoring          VendorCategory = "CLOUD_MONITORING"
-	VendorCategoryCloudProvider            VendorCategory = "CLOUD_PROVIDER"
-	VendorCategoryCollaboration            VendorCategory = "COLLABORATION"
-	VendorCategoryCustomerSupport          VendorCategory = "CUSTOMER_SUPPORT"
-	VendorCategoryDataStorageAndProcessing VendorCategory = "DATA_STORAGE_AND_PROCESSING"
-	VendorCategoryDocumentManagement       VendorCategory = "DOCUMENT_MANAGEMENT"
-	VendorCategoryEmployeeManagement       VendorCategory = "EMPLOYEE_MANAGEMENT"
-	VendorCategoryEngineering              VendorCategory = "ENGINEERING"
-	VendorCategoryFinance                  VendorCategory = "FINANCE"
-	VendorCategoryIdentityProvider         VendorCategory = "IDENTITY_PROVIDER"
-	VendorCategoryIT                       VendorCategory = "IT"
-	VendorCategoryMarketing                VendorCategory = "MARKETING"
-	VendorCategoryOfficeOperations         VendorCategory = "OFFICE_OPERATIONS"
-	VendorCategoryOther                    VendorCategory = "OTHER"
-	VendorCategoryPasswordManagement       VendorCategory = "PASSWORD_MANAGEMENT"
-	VendorCategoryProductAndDesign         VendorCategory = "PRODUCT_AND_DESIGN"
-	VendorCategoryProfessionalServices     VendorCategory = "PROFESSIONAL_SERVICES"
-	VendorCategoryRecruiting               VendorCategory = "RECRUITING"
-	VendorCategorySales                    VendorCategory = "SALES"
-	VendorCategorySecurity                 VendorCategory = "SECURITY"
-	VendorCategoryVersionControl           VendorCategory = "VERSION_CONTROL"
-)
-
-func VendorCategories() []VendorCategory {
-	return []VendorCategory{
-		VendorCategoryAnalytics,
-		VendorCategoryCloudMonitoring,
-		VendorCategoryCloudProvider,
-		VendorCategoryCollaboration,
-		VendorCategoryCustomerSupport,
-		VendorCategoryDataStorageAndProcessing,
-		VendorCategoryDocumentManagement,
-		VendorCategoryEmployeeManagement,
-		VendorCategoryEngineering,
-		VendorCategoryFinance,
-		VendorCategoryIdentityProvider,
-		VendorCategoryIT,
-		VendorCategoryMarketing,
-		VendorCategoryOfficeOperations,
-		VendorCategoryOther,
-		VendorCategoryPasswordManagement,
-		VendorCategoryProductAndDesign,
-		VendorCategoryProfessionalServices,
-		VendorCategoryRecruiting,
-		VendorCategorySales,
-		VendorCategorySecurity,
-		VendorCategoryVersionControl,
-	}
-}
-
-func (i VendorCategory) String() string {
-	return string(i)
-}
-
-func (i *VendorCategory) Scan(value any) error {
-	switch v := value.(type) {
-	case string:
-		switch v {
-		case "ANALYTICS":
-			*i = VendorCategoryAnalytics
-		case "CLOUD_MONITORING":
-			*i = VendorCategoryCloudMonitoring
-		case "CLOUD_PROVIDER":
-			*i = VendorCategoryCloudProvider
-		case "COLLABORATION":
-			*i = VendorCategoryCollaboration
-		case "CUSTOMER_SUPPORT":
-			*i = VendorCategoryCustomerSupport
-		case "DATA_STORAGE_AND_PROCESSING":
-			*i = VendorCategoryDataStorageAndProcessing
-		case "DOCUMENT_MANAGEMENT":
-			*i = VendorCategoryDocumentManagement
-		case "EMPLOYEE_MANAGEMENT":
-			*i = VendorCategoryEmployeeManagement
-		case "ENGINEERING":
-			*i = VendorCategoryEngineering
-		case "FINANCE":
-			*i = VendorCategoryFinance
-		case "IDENTITY_PROVIDER":
-			*i = VendorCategoryIdentityProvider
-		case "IT":
-			*i = VendorCategoryIT
-		case "MARKETING":
-			*i = VendorCategoryMarketing
-		case "OFFICE_OPERATIONS":
-			*i = VendorCategoryOfficeOperations
-		case "OTHER":
-			*i = VendorCategoryOther
-		case "PASSWORD_MANAGEMENT":
-			*i = VendorCategoryPasswordManagement
-		case "PRODUCT_AND_DESIGN":
-			*i = VendorCategoryProductAndDesign
-		case "PROFESSIONAL_SERVICES":
-			*i = VendorCategoryProfessionalServices
-		case "RECRUITING":
-			*i = VendorCategoryRecruiting
-		case "SALES":
-			*i = VendorCategorySales
-		case "SECURITY":
-			*i = VendorCategorySecurity
-		case "VERSION_CONTROL":
-			*i = VendorCategoryVersionControl
-		default:
-			return fmt.Errorf("invalid VendorCategory value: %q", v)
-		}
-	default:
-		return fmt.Errorf("unsupported type for VendorCategory: %T", value)
-	}
-	return nil
-}
-
-func (i VendorCategory) Value() (driver.Value, error) {
-	return i.String(), nil
-}
-
-func (i VendorCategory) MarshalJSON() ([]byte, error) {
-	return json.Marshal(i.String())
-}
-
-func (i *VendorCategory) UnmarshalJSON(data []byte) error {
-	var s string
-	if err := json.Unmarshal(data, &s); err != nil {
-		return err
-	}
-
-	switch s {
-	case "ANALYTICS":
-		*i = VendorCategoryAnalytics
-	case "CLOUD_MONITORING":
-		*i = VendorCategoryCloudMonitoring
-	case "CLOUD_PROVIDER":
-		*i = VendorCategoryCloudProvider
-	case "COLLABORATION":
-		*i = VendorCategoryCollaboration
-	case "CUSTOMER_SUPPORT":
-		*i = VendorCategoryCustomerSupport
-	case "DATA_STORAGE_AND_PROCESSING":
-		*i = VendorCategoryDataStorageAndProcessing
-	case "DOCUMENT_MANAGEMENT":
-		*i = VendorCategoryDocumentManagement
-	case "EMPLOYEE_MANAGEMENT":
-		*i = VendorCategoryEmployeeManagement
-	case "ENGINEERING":
-		*i = VendorCategoryEngineering
-	case "FINANCE":
-		*i = VendorCategoryFinance
-	case "IDENTITY_PROVIDER":
-		*i = VendorCategoryIdentityProvider
-	case "IT":
-		*i = VendorCategoryIT
-	case "MARKETING":
-		*i = VendorCategoryMarketing
-	case "OFFICE_OPERATIONS":
-		*i = VendorCategoryOfficeOperations
-	case "OTHER":
-		*i = VendorCategoryOther
-	case "PASSWORD_MANAGEMENT":
-		*i = VendorCategoryPasswordManagement
-	case "PRODUCT_AND_DESIGN":
-		*i = VendorCategoryProductAndDesign
-	case "PROFESSIONAL_SERVICES":
-		*i = VendorCategoryProfessionalServices
-	case "RECRUITING":
-		*i = VendorCategoryRecruiting
-	case "SALES":
-		*i = VendorCategorySales
-	case "SECURITY":
-		*i = VendorCategorySecurity
-	case "VERSION_CONTROL":
-		*i = VendorCategoryVersionControl
-	default:
-		return fmt.Errorf("invalid VendorCategory value: %q", s)
-	}
-	return nil
-}
-
-func (i *VendorCategory) UnmarshalText(text []byte) error {
-	s := string(text)
-
-	switch s {
-	case "ANALYTICS":
-		*i = VendorCategoryAnalytics
-	case "CLOUD_MONITORING":
-		*i = VendorCategoryCloudMonitoring
-	case "CLOUD_PROVIDER":
-		*i = VendorCategoryCloudProvider
-	case "COLLABORATION":
-		*i = VendorCategoryCollaboration
-	case "CUSTOMER_SUPPORT":
-		*i = VendorCategoryCustomerSupport
-	case "DATA_STORAGE_AND_PROCESSING":
-		*i = VendorCategoryDataStorageAndProcessing
-	case "DOCUMENT_MANAGEMENT":
-		*i = VendorCategoryDocumentManagement
-	case "EMPLOYEE_MANAGEMENT":
-		*i = VendorCategoryEmployeeManagement
-	case "ENGINEERING":
-		*i = VendorCategoryEngineering
-	case "FINANCE":
-		*i = VendorCategoryFinance
-	case "IDENTITY_PROVIDER":
-		*i = VendorCategoryIdentityProvider
-	case "IT":
-		*i = VendorCategoryIT
-	case "MARKETING":
-		*i = VendorCategoryMarketing
-	case "OFFICE_OPERATIONS":
-		*i = VendorCategoryOfficeOperations
-	case "OTHER":
-		*i = VendorCategoryOther
-	case "PASSWORD_MANAGEMENT":
-		*i = VendorCategoryPasswordManagement
-	case "PRODUCT_AND_DESIGN":
-		*i = VendorCategoryProductAndDesign
-	case "PROFESSIONAL_SERVICES":
-		*i = VendorCategoryProfessionalServices
-	case "RECRUITING":
-		*i = VendorCategoryRecruiting
-	case "SALES":
-		*i = VendorCategorySales
-	case "SECURITY":
-		*i = VendorCategorySecurity
-	case "VERSION_CONTROL":
-		*i = VendorCategoryVersionControl
-	default:
-		return fmt.Errorf("invalid VendorCategory value: %q", s)
-	}
-	return nil
-}
--- a/pkg/coredata/vendor_risk_assessment_order_field.go
+++ b/pkg/coredata/vendor_risk_assessment_order_field.go
@@ -1,41 +0,0 @@
-// Copyright (c) 2025-2026 Probo Inc <hello@getprobo.com>.
-//
-// Permission to use, copy, modify, and/or distribute this software for any
-// purpose with or without fee is hereby granted, provided that the above
-// copyright notice and this permission notice appear in all copies.
-//
-// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
-// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-// PERFORMANCE OF THIS SOFTWARE.
-
-package coredata
-
-type (
-	VendorRiskAssessmentOrderField string
-)
-
-const (
-	VendorRiskAssessmentOrderFieldCreatedAt VendorRiskAssessmentOrderField = "CREATED_AT"
-	VendorRiskAssessmentOrderFieldExpiresAt VendorRiskAssessmentOrderField = "EXPIRES_AT"
-)
-
-func (p VendorRiskAssessmentOrderField) Column() string {
-	return string(p)
-}
-
-func (p VendorRiskAssessmentOrderField) String() string {
-	return string(p)
-}
-
-func (p VendorRiskAssessmentOrderField) MarshalText() ([]byte, error) {
-	return []byte(p.String()), nil
-}
-
-func (p *VendorRiskAssessmentOrderField) UnmarshalText(text []byte) error {
-	*p = VendorRiskAssessmentOrderField(text)
-	return nil
-}
--- a/pkg/coredata/webhook_event_type.go
+++ b/pkg/coredata/webhook_event_type.go
@@ -23,9 +23,9 @@ import (
 type WebhookEventType string

 const (
-	WebhookEventTypeVendorCreated     WebhookEventType = "vendor:created"
-	WebhookEventTypeVendorUpdated     WebhookEventType = "vendor:updated"
-	WebhookEventTypeVendorDeleted     WebhookEventType = "vendor:deleted"
+	WebhookEventTypeThirdPartyCreated WebhookEventType = "third-party:created"
+	WebhookEventTypeThirdPartyUpdated WebhookEventType = "third-party:updated"
+	WebhookEventTypeThirdPartyDeleted WebhookEventType = "third-party:deleted"
 	WebhookEventTypeUserCreated       WebhookEventType = "user:created"
 	WebhookEventTypeUserUpdated       WebhookEventType = "user:updated"
 	WebhookEventTypeUserDeleted       WebhookEventType = "user:deleted"
@@ -40,7 +40,7 @@ func (w WebhookEventType) String() string {

 func (w WebhookEventType) IsValid() bool {
 	switch w {
-	case WebhookEventTypeVendorCreated, WebhookEventTypeVendorUpdated, WebhookEventTypeVendorDeleted,
+	case WebhookEventTypeThirdPartyCreated, WebhookEventTypeThirdPartyUpdated, WebhookEventTypeThirdPartyDeleted,
 		WebhookEventTypeUserCreated, WebhookEventTypeUserUpdated, WebhookEventTypeUserDeleted,
 		WebhookEventTypeObligationCreated, WebhookEventTypeObligationUpdated, WebhookEventTypeObligationDeleted:
 		return true