rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename vendors to third parties

Browse Source 
Renames the user-facing 'vendor' concept to 'third party' across the
entire codebase. The shared common_third_parties reference table is
unchanged.

Migration. Renames the vendor_category enum, the vendors and
vendor_<entity> tables (contacts, services, compliance_reports,
business_associate_agreements, data_privacy_agreements,
risk_assessments) and their vendor_id columns, the asset_vendors /
data_vendors / processing_activity_vendors junction tables,
generated_documents.vendors_document_id, the webhook_event_type
'vendor:<verb>' values, and the snapshots_type 'VENDORS' value.

Backend. Renames coredata models and SQL queries, probo services,
GraphQL / MCP API surface, console / trust / webhook resolvers and
types, the CLI (prb vendor* -> prb third-party*; pkg/cmd/vendormgmt
-> pkg/cmd/thirdpartymgmt), the document generator, vetting agent
prompts, and the common-third-parties-import command.

Frontend, packages, n8n, e2e. Renames apps/console pages, components,
hooks, routes, dialogs, and tabs; the shared @probo/vendors package
(now @probo/third-parties); the @probo/ui Vendors atoms (now
ThirdParties, VendorLogo -> ThirdPartyLogo); the n8n community node
actions/vendor folder (now actions/thirdParty); and the e2e Go test
suite (console and MCP). Filesystem and URL paths use kebab-case
(third-parties), GraphQL fields and TypeScript identifiers use
camelCase (thirdParty / thirdParties), Go types use PascalCase
(ThirdParty), and human-facing text uses 'third party' with a space.

Co-authored-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-05-13 16:15:33 +02:00
parent 9eed0d71c8
commit eecbe4c46c
281 changed files with 8491 additions and 8425 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/vetting/prompts/compliance.txt
View File

@@ -1,9 +1,9 @@
<role>
You are a compliance assessor specialized in identifying certifications and compliance frameworks from vendor trust and compliance pages.
You are a compliance assessor specialized in identifying certifications and compliance frameworks from third party trust and compliance pages.
</role>
<task>
Given a trust center or compliance page URL, identify the certifications, audit programs, and compliance frameworks the vendor publishes. For each certification, distinguish between independently verified evidence, in-progress audits, marketing claims, and unverified framework alignment. Report only what you find.
Given a trust center or compliance page URL, identify the certifications, audit programs, and compliance frameworks the third party publishes. For each certification, distinguish between independently verified evidence, in-progress audits, marketing claims, and unverified framework alignment. Report only what you find.
</task>
<assessment>
@@ -27,11 +27,11 @@ If the trust page links to sub-pages (e.g. separate pages per certification), fo
For each certification, assign one of the following statuses:
- **current**: The certification is clearly active. Evidence includes a certification logo paired with an audit date or validity period, a downloadable or requestable audit report, a certificate number, or an explicit statement like "SOC 2 Type II certified (last audit: March 2025)".
- **in_progress**: The vendor explicitly states the certification is upcoming or in progress. Evidence includes phrases like "currently pursuing ISO 27001", "SOC 2 audit underway", or a roadmap page listing the certification as planned.
- **in_progress**: The third party explicitly states the certification is upcoming or in progress. Evidence includes phrases like "currently pursuing ISO 27001", "SOC 2 audit underway", or a roadmap page listing the certification as planned.
- **claimed_unverified**: The certification is mentioned on a marketing page but lacks supporting proof. For example, a SOC 2 badge on the homepage with no audit date, no certificate number, no downloadable report, and no details page. A logo alone is not proof.
- **not_specified**: The certification is referenced but its current status is unclear. For example, the vendor states "we follow ISO 27001 standards" without claiming actual certification.
- **not_specified**: The certification is referenced but its current status is unclear. For example, the third party states "we follow ISO 27001 standards" without claiming actual certification.
Distinguish self-asserted claims from independently verified certifications. A vendor that says "we align with NIST CSF" is describing framework alignment, not a certification — list those under `other_frameworks`, not `certifications`.
Distinguish self-asserted claims from independently verified certifications. A third party that says "we align with NIST CSF" is describing framework alignment, not a certification — list those under `other_frameworks`, not `certifications`.
</rating_criteria>
<output>