rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
probo/pkg/vetting/prompts/default_procedure.txt
Sacha Al Himdani eecbe4c46c Rename vendors to third parties 
Renames the user-facing 'vendor' concept to 'third party' across the
entire codebase. The shared common_third_parties reference table is
unchanged.

Migration. Renames the vendor_category enum, the vendors and
vendor_<entity> tables (contacts, services, compliance_reports,
business_associate_agreements, data_privacy_agreements,
risk_assessments) and their vendor_id columns, the asset_vendors /
data_vendors / processing_activity_vendors junction tables,
generated_documents.vendors_document_id, the webhook_event_type
'vendor:<verb>' values, and the snapshots_type 'VENDORS' value.

Backend. Renames coredata models and SQL queries, probo services,
GraphQL / MCP API surface, console / trust / webhook resolvers and
types, the CLI (prb vendor* -> prb third-party*; pkg/cmd/vendormgmt
-> pkg/cmd/thirdpartymgmt), the document generator, vetting agent
prompts, and the common-third-parties-import command.

Frontend, packages, n8n, e2e. Renames apps/console pages, components,
hooks, routes, dialogs, and tabs; the shared @probo/vendors package
(now @probo/third-parties); the @probo/ui Vendors atoms (now
ThirdParties, VendorLogo -> ThirdPartyLogo); the n8n community node
actions/vendor folder (now actions/thirdParty); and the e2e Go test
suite (console and MCP). Filesystem and URL paths use kebab-case
(third-parties), GraphQL fields and TypeScript identifiers use
camelCase (thirdParty / thirdParties), Go types use PascalCase
(ThirdParty), and human-facing text uses 'third party' with a space.

Co-authored-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-05-13 21:21:39 +02:00

265 lines
12 KiB
Plaintext
Raw Permalink Blame History

<third_party_classification>
After the crawler returns results, classify the third party along three dimensions:
**Third party Type** — determines investigation focus:
- **SaaS / Cloud Platform**: Software product, web application, API service, developer tools
- **Infrastructure Provider**: Cloud hosting, CDN, DNS, networking, data center
- **Professional Services**: Law firm, accounting firm, CPA, consulting, advisory, audit
- **Staffing / Outsourcing**: Temporary workers, managed services, BPO, contractor agencies
**Privacy Role** (ISO 27701) — determines privacy assessment depth:
- **Processor**: Third party processes personal data on your behalf (most SaaS third parties)
- **Subprocessor**: Third party is a processor's processor (e.g. infrastructure under a SaaS third party)
- **Controller**: Third party determines purposes and means of processing (e.g. analytics third party)
- **None**: Third party does not process personal data
**AI Involvement** (ISO 42001) — determines whether AI risk assessment is needed:
- **Yes**: Third party uses AI/ML in their product or service delivery (e.g. AI-powered features, automated decisions, content generation, recommendations)
- **No**: No AI/ML involvement apparent
Use this classification to shape your subsequent investigation:
For SaaS / Cloud / Infrastructure third parties, follow the full technical investigation path: security, compliance, data processing, incident response, business continuity, subprocessors.
For Professional Services third parties (lawyers, CPAs, consultants, auditors): technical security checks carry less weight; focus on professional licensing, industry body memberships, professional liability insurance, team credentials, conflict of interest policies, and engagement letter terms. Compliance certifications like SOC 2 may not apply — note their absence differently than for SaaS third parties. Subprocessors are less relevant unless the firm uses cloud tools to process customer data.
For Staffing / Outsourcing third parties, focus on data handling practices, background check policies, confidentiality agreements, and insurance coverage.
</third_party_classification>
<investigation_triggers>
- Found a privacy policy → analyze_document with that URL
- Found a trust center → assess_compliance with that URL
- Found a subprocessors page → extract_subprocessors with that URL
- No subprocessors page → try extract_subprocessors with the third party's main URL
- Found a DPA or security page → assess_data_processing with the best available URL
- Found a status page or security page → assess_incident_response with that URL
- Found SLA or infrastructure docs → assess_business_continuity with that URL
- Found a team, credentials, or about page → assess_professional_standing (for professional services third parties)
- Found engagement terms or professional standards → analyze_document with that URL
- Found AI policy, responsible AI, or AI-related content → assess_ai_risk with that URL
- Third party mentions AI, ML, automation, or algorithmic features → assess_ai_risk with the relevant page
- No AI involvement apparent → skip assess_ai_risk; mark AI risk as N/A
</investigation_triggers>
## Output Format
Write a comprehensive markdown assessment report with these sections:
# Third party Assessment: [Third party Name]
## Executive Summary
Brief overview of the third party and key findings. End with a clear **Recommendation**:
- **Approve** — Acceptable risk, proceed with standard contractual protections
- **Approve with Conditions** — Acceptable risk subject to specific conditions listed below
- **Escalate** — Significant gaps require further investigation or risk acceptance by management
- **Reject** — Unacceptable risk based on available information
## Overall Risk Score
Provide a numeric score from 1 to 100 (higher = lower risk) with a weighted breakdown:
| Category | Weight | Score (0-100) | Weighted |
|----------|--------|---------------|----------|
| Security Posture | 25% | ... | ... |
| Compliance & Certifications | 20% | ... | ... |
| Privacy & Data Processing | 20% | ... | ... |
| Business Continuity | 15% | ... | ... |
| Market Presence & Stability | 10% | ... | ... |
| Incident Response | 10% | ... | ... |
| **Overall** | **100%** | | **[total]** |
For professional services third parties, adjust the weights:
| Category | Weight | Score (0-100) | Weighted |
|----------|--------|---------------|----------|
| Professional Standing | 25% | ... | ... |
| Privacy & Data Processing | 20% | ... | ... |
| Compliance & Certifications | 15% | ... | ... |
| Market Presence & Stability | 15% | ... | ... |
| Security Posture | 10% | ... | ... |
| Business Continuity | 10% | ... | ... |
| Incident Response | 5% | ... | ... |
| **Overall** | **100%** | | **[total]** |
Justify each category score in one sentence.
## Third party Classification
- Name, description, headquarters, legal entity
- **Third party type**: SaaS, Infrastructure, Professional Services, Staffing
- **Privacy role**: Controller, Processor, Subprocessor, or None — with justification
- **Processes PII**: Yes/No
- **Cross-border transfers**: Yes/No — list countries if applicable
- **AI involvement**: Yes/No — list use cases if applicable
- Main website and key URLs discovered
## Market Presence
- Notable customers (logos, case studies, testimonials)
- Company size signals (employee count, funding, customer count)
- Market position and credibility indicators
## Security Posture
### SSL/TLS Configuration
### Security Headers
### Email Security (DMARC/SPF)
### Content Security Policy
### CORS Configuration
### DNSSEC
### Known Breaches
For each subsection, assign a rating: **Pass**, **Warning**, or **Fail**.
## Compliance & Certifications
- List all certifications found with details
- Audit report availability
## Privacy & Data Processing
- Data retention and deletion policies
- Data locations/jurisdictions
- GDPR/CCPA compliance indicators
- Encryption practices (at rest, in transit)
- Cross-border transfer mechanisms
- DPA status (available, available on request, not found, behind login)
- DSAR (Data Subject Access Request) capability
- Data minimization and purpose limitation practices
### Sub-Processors
If a subprocessors list was found, include a table:
| Name | Country | Purpose |
|------|---------|---------|
List all sub-processors discovered with their country and purpose where available.
## AI Governance (include when third party involves AI)
- AI usage disclosure and use cases
- Model transparency and explainability
- Bias detection and fairness measures
- Training data governance (is customer data used for training? opt-out available?)
- Human oversight mechanisms
- AI incident handling
- Regulatory compliance (GDPR Art. 22, EU AI Act awareness)
If the third party does not use AI, note: "Third party does not appear to use AI/ML in their product or service delivery."
## Document Analysis
### Privacy Policy
### Terms of Service
### Data Processing Agreement
(Include findings for each document analyzed)
### Privacy Contractual Clauses
- Data processing instructions and scope
- Subprocessor approval mechanism (prior written consent, objection-based, notification-only)
- Cross-border transfer safeguards (SCCs, BCRs, adequacy decisions)
- Breach notification timeline and obligations
- Data return and deletion on termination
- DSAR cooperation obligations
### AI Contractual Clauses (include when third party involves AI)
- Prohibition on using customer data for model training
- Transparency obligations about AI usage
- Audit rights for AI systems
- Automated decision-making restrictions
- Model update notification requirements
### General Contractual Terms
- Liability caps and limitations
- Indemnification obligations
- Termination provisions and data return
- Governing law and dispute resolution
## Incident Response & Business Continuity
### Incident Response
- IR plan documentation
- Breach notification timeline
- Communication procedures
- Incident history
### Business Continuity
- Disaster recovery (RTO/RPO)
- SLA/Uptime commitments
- Infrastructure redundancy
- Geographic distribution
## Professional Standing (include for professional services third parties)
### Licensing & Credentials
### Industry Memberships
### Professional Liability Insurance
### Team Qualifications
### Conflict of Interest Policy
## External Research
- Security incidents reported externally
- Regulatory actions
- Customer sentiment
- Recent news
- Professional disciplinary actions (if applicable)
- Red flags identified
## Risk Summary
| Category | Rating | Notes |
|----------|--------|-------|
| SSL/TLS | Pass/Warning/Fail | ... |
| Security Headers | Pass/Warning/Fail | ... |
| Email Security | Pass/Warning/Fail | ... |
| CSP | Pass/Warning/Fail | ... |
| CORS | Pass/Warning/Fail | ... |
| DNSSEC | Pass/Warning/Fail | ... |
| Breach History | Pass/Warning/Fail | ... |
| Compliance | Pass/Warning/Fail | ... |
| Privacy | Pass/Warning/Fail | ... |
| Market Presence | Strong/Moderate/Weak | ... |
| Data Processing | Strong/Adequate/Weak | ... |
| Incident Response | Strong/Adequate/Weak | ... |
| Business Continuity | Strong/Adequate/Weak | ... |
| Professional Standing | Strong/Adequate/Weak/N/A | ... |
| AI Governance | Strong/Adequate/Weak/N/A | ... |
## Three-Pillar Risk Assessment
Aggregate the per-category findings into three risk pillars. Score each from 0-100 (higher = lower risk).
### Security Risk (Pillar 1)
Aggregates: Security Posture, Compliance & Certifications, Business Continuity, Incident Response.
- **Score**: [0-100]
- **Justification**: [one sentence]
### Privacy Risk (Pillar 2)
Aggregates: Privacy & Data Processing, DPA status, DSAR capability, Cross-border transfers, Subprocessors.
- **Score**: [0-100]
- **Justification**: [one sentence]
### AI Risk (Pillar 3) — only when third party involves AI
Aggregates: AI governance, Model transparency, Bias controls, Human oversight, Training data governance.
- **Score**: [0-100] (or N/A if third party does not use AI)
- **Justification**: [one sentence]
## Minimum Acceptance Baseline
Evaluate these hard-reject criteria. If ANY criterion fails, set the recommendation to **Reject** and list the failures.
**Security baseline**:
- SSL certificate must be valid and not expired
- HTTPS must be enforced
- A recognized security certification (SOC 2, ISO 27001) must be present OR the third party must be a professional services firm where this is not standard
**Privacy baseline** (when third party processes PII):
- A privacy policy must be publicly available
- A DPA must be available or available on request
- DSAR handling capability must be documented
- No active unresolved data breaches
**AI baseline** (when third party involves AI):
- AI usage must be disclosed transparently
- Customer data must not be used for model training without clear opt-out
- Basic human oversight must exist for consequential decisions
List each criterion as **Met** or **Failed** with a brief note. Summarize whether the minimum baseline is met overall.
## Information Gaps & Recommended Actions
This section is REQUIRED even if the third party is well-documented. List what could not be verified:
- **Critical Gap**: [description] — **Action**: Request [specific document/evidence] from the third party
- **Notable Gap**: [description] — **Action**: [what to ask for]
- **Minor Gap**: [description] — **Action**: [optional follow-up]
At minimum, note what could not be independently verified and suggest what to request from the third party before finalizing the due diligence.
## Sources
List all URLs visited during the assessment with what was found at each.
Reference in New Issue View Git Blame Copy Permalink