Beyond SOC 2
What is an example of a third-party vendor?
What is an example of a third-party vendor?
A third-party vendor is any outside company that provides goods or services to your organization under a contract. For a SaaS company the common examples are its cloud provider (AWS, Google Cloud, Azure), payment processor (Stripe), productivity and messaging tools (Google Workspace, Slack), payroll provider (Gusto, Deel), and CRM or support platform (HubSpot, Zendesk). A fourth party is your vendor's vendor, such as the cloud host behind your CRM.
Third-party vendor examples by category
| Category | Examples | Typical data access | Risk tier |
|---|---|---|---|
| Cloud infrastructure | AWS, Google Cloud, Azure, Cloudflare | Hosts production and customer data | High |
| Code and deployment | GitHub, Vercel, Datadog | Source code, secrets, logs | High |
| Identity | Okta, Google Workspace, Microsoft Entra ID | Controls access to everything else | High |
| Payments | Stripe, Braintree | Cardholder and billing data | High |
| Customer communication | Zendesk, Intercom, SendGrid | Customer names, emails, message content | Medium |
| HR and payroll | Gusto, Deel, Rippling | Employee personal and financial data | Medium |
| Sales and marketing | HubSpot, Salesforce, LinkedIn Ads | Prospect contact data | Medium to low |
| Professional services | Law firm, auditor, penetration tester | Varies; often confidential documents | Varies |
| Office and facilities | Coworking space, hardware reseller | Physical access, devices | Low |
Tier each vendor by what it can reach. A free analytics script on a login page can carry more risk than an expensive consulting contract.
Third, fourth, and nth parties
| Party | Relationship | How you manage the risk |
|---|---|---|
| Third party | Contracts directly with you | Security review, contract terms, periodic reassessment |
| Fourth party | Contracts with your vendor | Your vendor's subprocessor list and its SOC 2 subservice organization disclosures |
| Nth party | Further down the chain | Concentration analysis, such as how many critical vendors depend on one cloud region |
A SOC 2 report handles fourth parties explicitly. The system description names subservice organizations and states whether their controls are included (the inclusive method) or carved out (the carve-out method). When a vendor carves out its cloud host, you need that host's own report as well.
What compliance frameworks require for vendors
SOC 2 criterion CC9.2 asks you to assess and manage risk from vendors and business partners. ISO 27001 Annex A covers supplier relationships in its organizational controls. HIPAA requires a business associate agreement with every vendor that creates, receives, maintains, or transmits PHI for you.
In practice, an auditor asks for the same four things under each framework: a complete vendor inventory, a risk rating per vendor, evidence of review for the high-risk ones (usually their SOC 2 report or a questionnaire), and signed contracts or BAAs. The most common gap is the inventory itself, because vendors get added by engineers through a package, an API key, or a free-tier signup, without anyone recording it. For the lifecycle around that inventory, see the five stages of third-party management.