Buying from upstreams
How a Startup buys, from the make-or-buy call through upstream review, the Agreement, and spend, and how it is onboarded by its own buyers.
A Startup buys through one Process, Procure: a need, a make-or-buy call, upstream review, an Agreement, then spend within Limits. Every party it buys from is an upstream.
Upstreams
An upstream is any party a Startup buys from: outside software, a subprocessor, the upstream that fulfills a dropship Order, or a sibling Startup. Each one has a record: the Capability it backs, its Agreement, its last review, and whether it processes personal data.
Those records form the Startup's upstream list. The upstreams that process personal data are its subprocessor list, generated from that list and published with its paper.
Make or buy
Procure starts by asking whether the Startup already has what it needs. Most needs end there: every Startup inherits the Systems and Capabilities of the platform, so the answer is a System it already runs.
A need the platform does not meet is bought, from a sibling first. A sibling Startup that sells the outcome is ordered under an Agreement, through the interchange, and billed on acceptance. An outside upstream comes after.
Procure's loop tests one belief: buying costs less than building while its Fully loaded Cost falls. A bought Capability whose Cost rises for a quarter returns to the make-or-buy call.
Upstream review
Upstream review checks every upstream before its first use and every year after. The Risk Analyst checks four things: security, privacy terms, continuity, and whether it processes personal data.
The Upstream review Control keeps each upstream's security report on file and opens a Task before any report expires. An upstream that every sibling relies on is a Portfolio Risk, scored once for all of them.
Agreement and spend
The Contracts Manager reviews the upstream's terms, and the Agreement records them. Money leaves only through Spend management: bills, expenses, and cards, each paid against Limits and spend states.
A one-off purchase uses spend: a single-use card within a Mandate and its Limit. A new recurring commitment is a one-way money decision, so it waits its delay window.
A purchase over the Limit becomes an Approval.
The Billing Specialist pays each upstream bill on its terms, and every payment posts to the Ledger.
Being bought from
The Startup's own Customers run the same process on it. A company's procurement team asks for a tax form, a certificate of insurance, a security questionnaire, and data processing terms.
Vendor onboarding answers all four. The Sales Engineer answers the questionnaire from records the Startup already keeps. The certificate comes from Company coverage, and the tax form from the entity's Tax IDs.
Example
platecost.app needs wholesale produce prices to recompute plate costs. Make or buy finds no System that holds them, so the Operations Lead buys a price feed. Upstream review finds no personal data, so the feed stays off the subprocessor list, and the $200 monthly Agreement waits its delay window and proceeds.
Next
- Procure: the Process, its RACI, and its loop.
- Subprocessors: the published list the upstream list generates.
- Risk and continuity: what happens when an upstream fails.