Upstream review
Upstream review checks every upstream before it is used and yearly after: security, privacy terms, continuity, and whether it processes personal data.
Outcome
| Part | This Process |
|---|---|
| Outcome | Each upstream is reviewed before first use and yearly after, with its Risk scored and its data processing on record. |
| Reads | Integration |
| Leaves | Risk, Agreement, Integration |
| Runs in | Each Startup |
Accountable
Risk Analyst, Operations Team.
Responsible: Risk Analyst.
Consulted: Security Engineer, Privacy Officer.
Informed: Operations Lead.
Workflows
| Workflow | Runs | Team |
|---|---|---|
| Review an upstream | on Integration.created | Operations Team |
Who does each step
| Workflow | Step | Role | Calls | Approval |
|---|---|---|---|---|
| Review an upstream | 1. Score the provider’s security from its reports and certifications. | Risk Analyst | Risk.assess | None |
| Review an upstream | 2. Record whether it processes personal data, and sign its data processing terms when it does. | Privacy Officer | Agreement.create | None |
| Review an upstream | 3. Name the fallback provider the Startup fails over to. | Integration Engineer | Integration.update | None |
| Review an upstream | 4. Approve or refuse the provider and set its review a year out. | Risk Analyst | Risk.treat | None |
Events
| Direction | When | What happens |
|---|---|---|
| In | On Integration.created | Starts Review an upstream |
| Out | Risk.assessed | Raised by step 1 of Review an upstream |
| Out | Agreement.created | Raised by step 2 of Review an upstream |
| Out | Integration.updated | Raised by step 3 of Review an upstream |
| Out | Risk.treated | Raised by step 4 of Review an upstream |
Plays
No Play names this Process.
Controls
No Control names this Process or a Workflow of it.
Settings
None.
Failure
A failed step retries; when retries run out, the Action goes to the Risk Analyst.
Loop
No loop: the path is never randomized, because it serves Upstream review.
Code
Turn on upstream reviewEnable
On by default for every Product Template. Process.pause stops new Actions; Actions in progress finish.
Example
Before a Startup adds a transcription upstream, the Risk Analyst reads its security report, data terms and region. It processes personal data, so it joins the subprocessor list before the first call.