# Buying from upstreams

URL: /workflows/buying-from-upstreams · Id: `page:workflows/buying-from-upstreams`

> How a Startup buys, from the make-or-buy call through upstream review, the Agreement, and spend, and how it is onboarded by its own buyers.

A [Startup](/business/nouns/startup) buys through one [Process](/business/nouns/process), [Procure](/workflows/processes/procure): a need, a make-or-buy call, upstream review, an [Agreement](/business/nouns/agreement), then spend within [Limits](/business/nouns/limit). Every party it buys from is an upstream.

## Upstreams
An upstream is any party a Startup buys from: outside software, a subprocessor, the upstream that fulfills a dropship [Order](/business/nouns/order), or a sibling Startup. Each one has a record: the [Capability](/business/nouns/capability) it backs, its Agreement, its last review, and whether it processes personal data.

Those records form the Startup's upstream list. The upstreams that process personal data are its [subprocessor list](/systems/trust-and-governance/subprocessors), generated from that list and published with its paper.

## Make or buy
Procure starts by asking whether the Startup already has what it needs. Most needs end there: every Startup inherits the [Systems](/business/nouns/system) and Capabilities of the platform, so the answer is a System it already runs.

A need the platform does not meet is bought, from a sibling first. A sibling Startup that sells the outcome is ordered under an Agreement, through the interchange, and billed on acceptance. An outside upstream comes after.

Procure's loop tests one belief: buying costs less than building while its [Fully loaded Cost](/agents/finance#fully-loaded-cost) falls. A bought Capability whose [Cost](/business/nouns/cost) rises for a quarter returns to the make-or-buy call.

## Upstream review
[Upstream review](/workflows/processes/upstream-review) checks every upstream before its first use and every year after. The [Risk Analyst](/agents/operations/risk-analyst) checks four things: security, privacy terms, continuity, and whether it processes personal data.

The [Upstream review](/systems/trust-and-governance/controls/upstream-review) [Control](/business/nouns/control) keeps each upstream's security report on file and opens a [Task](/business/nouns/task) before any report expires. An upstream that every sibling relies on is a [Portfolio](/business/nouns/portfolio) [Risk](/business/nouns/risk), scored once for all of them.

## Agreement and spend
The [Contracts Manager](/agents/legal/contracts-manager) reviews the upstream's terms, and the Agreement records them. Money leaves only through [Spend management](/systems/spend): bills, expenses, and cards, each paid against Limits and spend states.

A one-off purchase uses [spend](/business/nouns/mandate/spend): a single-use card within a [Mandate](/business/nouns/mandate) and its Limit. A new recurring commitment is a one-way money decision, so it waits its [delay window](/agents/autonomy-levels/delay-windows).

A purchase over the Limit becomes an [Approval](/business/nouns/approval).

The [Billing Specialist](/agents/finance/billing-specialist) pays each upstream bill on its terms, and every payment posts to the [Ledger](/systems/ledger).

## Being bought from
The Startup's own [Customers](/business/nouns/customer) run the same process on it. A company's procurement team asks for a tax form, a certificate of insurance, a security questionnaire, and data processing terms.

[Vendor onboarding](/workflows/processes/vendor-onboarding) answers all four. The [Sales Engineer](/agents/sales/sales-engineer) answers the questionnaire from [records the Startup already keeps](/systems/trust-and-governance/buyers). The certificate comes from [Company coverage](/systems/legal-and-corporate/insurance), and the tax form from the entity's [Tax IDs](/systems/finance/tax-ids).

## Example
platecost.app needs wholesale produce prices to recompute plate costs. Make or buy finds no System that holds them, so the [Operations Lead](/agents/operations/operations-lead) buys a price feed. Upstream review finds no personal data, so the feed stays off the subprocessor list, and the $200 monthly Agreement waits its delay window and proceeds.

## Next
- [Procure](/workflows/processes/procure): the Process, its RACI, and its loop.
- [Subprocessors](/systems/trust-and-governance/subprocessors): the published list the upstream list generates.
- [Risk and continuity](/systems/trust-and-governance/risk-and-continuity): what happens when an upstream fails.