How do we keep a profile for each vendor, with a source for what we say about it?

What the profile holds

• Status (Approved, Under review or Not approved) and how critical it is (Low, Medium or High). Complipath suggests a level from your register and says why, for example that the vendor supplies a high-risk AI system or receives sensitive data. You can set your own.
• An owner at your company, what the vendor does for you, and the processes that use it beyond your AI systems.
• What it receives: personal data, sensitive data and customer data (each Yes, No or Not sure) and where the data is stored, in your own words. These are your entries; nothing fills them in from the vendor's pages.
• Contract start, renewal, notice period, service level, a contact person and notes, and the date of the next review.
• Any vendor, AI or not. A vendor appears when a system names it or when you add one, with the systems that use it listed beside it.

Where a fact about the vendor comes from

• A fact about the vendor itself shows only if a person at Complipath read it on the vendor's own page and confirmed it. Seven fields exist: where the data are, training on customer data, the data processing agreement, subprocessors, certifications, its AI Act role and a security contact.
• A fact that shows has a link to the page it came from and the day it was read. A field nobody has read is left out and never shown as a blank, so a vendor with no read facts shows none.
• For the AI vendors it knows, the list of vendors links their public terms and, where known, their data processing agreement; it quotes a sentence from them where one was found, with its link and the day it was read.
• Those pages are read again once a month. A sentence that is no longer on its page stops showing, and a page that does not answer changes nothing.
• The quote is the vendor's own sentence, word for word. Complipath does not paraphrase it or judge whether it is enough for your use.

Review, contract and offboarding

• Seven checks to tick. The first four: a signed data processing agreement in your evidence files; certifications checked and current; where the data is stored known; training on your data checked, and turned off if needed.
• The other three: its subprocessors read, who at your company has access reviewed, and contract dates and notice period recorded.
• Save a next review date and it becomes one open task, moved when the date moves.
• Pick a contract file linked to the vendor and Complipath reads a start date, a notice period, automatic renewal and an uptime service level from its text, each with the sentence and the page. Nothing is filled in until you accept it.
• Offboarding is three dated steps: data deleted or returned with the vendor's confirmation; accounts, keys and integrations removed; the contract terminated. Started and all three dated, the vendor shows as Offboarded.

The subprocessor list

• One list of the vendors that receive personal or customer data, as a PDF, as a CSV that opens in Excel, or saved to the evidence library in one press.
• Four columns: Subprocessor, What it does for us, Where the data is stored and Data it receives. An empty cell reads Not recorded; an empty purpose names the systems the vendor supplies instead.
• A vendor is on it only if you recorded it as receiving personal data or customer data, it is not marked Not approved and it is not offboarded. Receiving sensitive data alone, or Not sure, does not put it on the list.
• The PDF's footer says which vendors it lists and the day it was made.

What it does not do

• It does not look a vendor up when you add it. A vendor with nothing read shows no facts, and no fact is not a statement that the vendor does not do something.
• It does not approve a vendor or judge whether it is safe to use. The status is yours, and the suggested criticality is a reading of your register.
• No model reads your contract. The dates and terms come from rules over the text of a PDF, Word or Excel file; a file with no readable text gets a message to fill the fields in by hand.
• The list is your vendors, not Complipath's own. Complipath's parties are on its subprocessors page.

Which plan

Every plan, including the free first system. No plan check sits on the vendor pages, the profile or the subprocessor list; saving needs the right to edit the workspace.

Where it sits in the law

• It is not an AI Act duty, and it sends nothing to an authority.
• The rule on a processor using another processor is GDPR Article 28(2): the processor shall not engage another processor without prior specific or general written authorisation of the controller. The list names your vendors; it does not decide which of them is your processor.