This Vendor Risk Management Program ("VRM") governs how RAVEN selects, contracts with, and oversees third-party service providers that receive or process customer information. It is designed to satisfy the service-provider oversight requirements of the GLBA Safeguards Rule (16 CFR §314.4(f)), the FFIEC Outsourcing Technology Services booklet, and the data-aggregator and downstream-party obligations of 12 CFR Part 1033.
2. Scope
This program applies to all third-party providers that (a) receive or process consumer information on RAVEN's behalf, (b) provide infrastructure that handles consumer information in transit or at rest, or (c) provide identity, authentication, or operational services that materially affect platform security. The current list of subprocessors is published at /legal/subprocessors.
3. Subprocessor Selection
Before engaging a new subprocessor, RAVEN evaluates:
Fitness for purpose, including the scope of consumer data the provider would receive and whether less-sensitive alternatives exist
Security posture, including SOC 2 Type II attestation (or equivalent), encryption practices, access controls, and breach history
Privacy posture, including data-use restrictions, retention practices, and sub-subprocessor disclosures
Regulatory standing, including OFAC and adverse-media checks of the provider's entity and principals
Financial and operational viability sufficient to support a long-term dependency
Contractual willingness to accept the obligations described in section 4 below
4. Required Contractual Terms
Every subprocessor contract must include:
Limits on use of consumer data to the purposes for which it is provided
Prohibition on sale, license, or use of consumer data for cross-marketing
Administrative, technical, and physical safeguards consistent with the GLBA Safeguards Rule and the FFIEC Information Security Handbook
Incident notification commitment within commercially reasonable timeframes, sufficient for RAVEN to meet its own customer-notification obligations
Sub-subprocessor disclosure and material-change notice
Cooperation with RAVEN's diligence, including annual production of SOC 2 Type II (or equivalent) and security questionnaires
Audit rights or equivalent assurance mechanisms
Data return and destruction obligations at contract end
5. Ongoing Oversight
SOC 2 Type II (or equivalent) reports are collected from each subprocessor on at least an annual cadence and reviewed for control exceptions, scope, and bridge-letter coverage
Adverse media and OFAC re-screening on at least an annual cadence
Material-change notices from the subprocessor are reviewed for impact on RAVEN's risk posture and, where appropriate, communicated to RAVEN customers
Provider performance and availability are monitored continuously through the platform's enrichment engine, which tracks per-provider health, response latency, and error classification
Subprocessor incidents affecting RAVEN customer information are handled under RAVEN's Incident Response Plan
6. Customer Notification of Subprocessor Changes
RAVEN maintains the public list of subprocessors at /legal/subprocessors. RAVEN will provide notice to active customers of material additions to or replacements of subprocessors that receive consumer data, in accordance with the Customer Agreement and applicable law. Customers may object to a new subprocessor under the terms of their Customer Agreement.
7. Termination and Offboarding
When a subprocessor relationship ends, RAVEN ensures that:
Consumer data held by the subprocessor is returned or destroyed in accordance with the contract
Credentials and integration endpoints are deactivated
The subprocessor list is updated and customers are notified of the change
8. Program Maintenance
The Qualified Individual under the WISP owns this program. It is reviewed at least annually and after any material change to the subprocessor population, the regulatory environment, or RAVEN's product scope.
9. Contact
Vendor risk inquiries: security@reportraven.tech
Subprocessor change notifications: through the customer's primary point of contact