--- question: "What is an example of a third-party vendor?" title: "What Is an Example of a Third-Party Vendor" seoTitle: "Third-Party Vendor Examples and Fourth Parties" summary: "A third-party vendor is any outside company that provides goods or services to your organization under a contract. For a SaaS company, typical examples are its cloud provider (AWS, Google Cloud, Azure), payment processor (Stripe), email and messaging services (Google Workspace, Slack), payroll provider (Gusto, Deel), and support or CRM tools (Zendesk, HubSpot). A fourth party is your vendor's vendor: if your CRM hosts its data on AWS, AWS is a fourth party to you. Third-party risk management matters because a vendor with access to your systems or customer data carries your risk, and SOC 2, ISO 27001, and HIPAA all require you to assess and monitor those vendors." publishedAt: "2026-09-14" keywords: - "example of a third party vendor" - "third party service examples" - "what is a fourth party vendor" - "third party vendor risk" pillar: "Beyond SOC 2" faqs: - question: "what is an example of a third party service?" answer: "A third-party service is work performed for your organization by an outside company. Examples include cloud hosting from AWS, payment processing from Stripe, payroll from Gusto, background checks from Checkr, penetration testing from a security firm, and outsourced customer support. If it runs under a contract and touches your systems or data, it belongs in your vendor inventory." - question: "what is an example of a fourth party?" answer: "A fourth party is a vendor's own vendor. If you use HubSpot as your CRM and HubSpot hosts on AWS, AWS is a fourth party to you. You have no contract with a fourth party, so you manage the risk through your third party: its subprocessor list, its SOC 2 report's section on subservice organizations, and contract terms requiring notice of changes." - question: "what are 3rd party websites?" answer: "Third-party websites are sites operated by someone other than you or the visitor, such as an embedded payment page, a scheduling widget, or an analytics or advertising script loading from another domain. From a compliance view they matter because they can collect data from your users, so privacy laws treat the scripts on your site as vendors you are responsible for disclosing." --- ## What is an example of a third-party vendor? A third-party vendor is **any outside company that provides goods or services to your organization under a contract**. For a SaaS company the common examples are its cloud provider (AWS, Google Cloud, Azure), payment processor (Stripe), productivity and messaging tools (Google Workspace, Slack), payroll provider (Gusto, Deel), and CRM or support platform (HubSpot, Zendesk). A **fourth party** is your vendor's vendor, such as the cloud host behind your CRM. ## Third-party vendor examples by category | Category | Examples | Typical data access | Risk tier | |---|---|---|---| | Cloud infrastructure | AWS, Google Cloud, Azure, Cloudflare | Hosts production and customer data | High | | Code and deployment | GitHub, Vercel, Datadog | Source code, secrets, logs | High | | Identity | Okta, Google Workspace, Microsoft Entra ID | Controls access to everything else | High | | Payments | Stripe, Braintree | Cardholder and billing data | High | | Customer communication | Zendesk, Intercom, SendGrid | Customer names, emails, message content | Medium | | HR and payroll | Gusto, Deel, Rippling | Employee personal and financial data | Medium | | Sales and marketing | HubSpot, Salesforce, LinkedIn Ads | Prospect contact data | Medium to low | | Professional services | Law firm, auditor, penetration tester | Varies; often confidential documents | Varies | | Office and facilities | Coworking space, hardware reseller | Physical access, devices | Low | Tier each vendor by what it can reach. A free analytics script on a login page can carry more risk than an expensive consulting contract. ## Third, fourth, and nth parties | Party | Relationship | How you manage the risk | |---|---|---| | Third party | Contracts directly with you | Security review, contract terms, periodic reassessment | | Fourth party | Contracts with your vendor | Your vendor's subprocessor list and its SOC 2 subservice organization disclosures | | Nth party | Further down the chain | Concentration analysis, such as how many critical vendors depend on one cloud region | A SOC 2 report handles fourth parties explicitly. The system description names subservice organizations and states whether their controls are included (the inclusive method) or carved out (the carve-out method). When a vendor carves out its cloud host, you need that host's own report as well. ## What compliance frameworks require for vendors SOC 2 criterion CC9.2 asks you to assess and manage risk from vendors and business partners. ISO 27001 Annex A covers supplier relationships in its organizational controls. HIPAA requires a business associate agreement with every vendor that creates, receives, maintains, or transmits PHI for you. In practice, an auditor asks for the same four things under each framework: a complete vendor inventory, a risk rating per vendor, evidence of review for the high-risk ones (usually their SOC 2 report or a questionnaire), and signed contracts or BAAs. The most common gap is the inventory itself, because vendors get added by engineers through a package, an API key, or a free-tier signup, without anyone recording it. For the lifecycle around that inventory, see [the five stages of third-party management](/resources/answers/what-are-the-5-stages-of-third-party-management).