# Upstream review

URL: /workflows/processes/upstream-review · Id: `process:upstream-review`

> Upstream review checks every upstream before it is used and yearly after: security, privacy terms, continuity, and whether it processes personal data.

Upstream review checks every upstream before it is used and yearly after: security, privacy terms, continuity, and whether it processes personal data.

## Outcome
| Part | This Process |
| --- | --- |
| Outcome | Each upstream is reviewed before first use and yearly after, with its Risk scored and its data processing on record. |
| Reads | [Integration](/business/nouns/integration) |
| Leaves | [Risk](/business/nouns/risk), [Agreement](/business/nouns/agreement), [Integration](/business/nouns/integration) |
| Runs in | Each Startup |

## Accountable
[Risk Analyst](/agents/operations/risk-analyst), [Operations Team](/agents/operations).

Responsible: [Risk Analyst](/agents/operations/risk-analyst).

Consulted: [Security Engineer](/agents/engineering/security-engineer), [Privacy Officer](/agents/legal/privacy-officer).

Informed: [Operations Lead](/agents/operations/operations-lead).

## Workflows
| Workflow | Runs | Team |
| --- | --- | --- |
| [Review an upstream](/workflows/processes/upstream-review/review-upstream) | on `Integration.created` | [Operations Team](/agents/operations) |

## Who does each step

| Workflow | Step | Role | Calls | Approval |
| --- | --- | --- | --- | --- |
| [Review an upstream](/workflows/processes/upstream-review/review-upstream) | 1. Score the provider’s security from its reports and certifications. | [Risk Analyst](/agents/operations/risk-analyst) | [Risk.assess](/business/nouns/risk/assess) | None |
| [Review an upstream](/workflows/processes/upstream-review/review-upstream) | 2. Record whether it processes personal data, and sign its data processing terms when it does. | [Privacy Officer](/agents/legal/privacy-officer) | [Agreement.create](/business/nouns/agreement/create) | None |
| [Review an upstream](/workflows/processes/upstream-review/review-upstream) | 3. Name the fallback provider the Startup fails over to. | [Integration Engineer](/agents/engineering/integration-engineer) | [Integration.update](/business/nouns/integration/update) | None |
| [Review an upstream](/workflows/processes/upstream-review/review-upstream) | 4. Approve or refuse the provider and set its review a year out. | [Risk Analyst](/agents/operations/risk-analyst) | [Risk.treat](/business/nouns/risk/treat) | None |

## Events
| Direction | When | What happens |
| --- | --- | --- |
| In | On `Integration.created` | Starts [Review an upstream](/workflows/processes/upstream-review/review-upstream) |
| Out | [`Risk.assessed`](/business/events/Risk.assessed) | Raised by step 1 of [Review an upstream](/workflows/processes/upstream-review/review-upstream) |
| Out | `Agreement.created` | Raised by step 2 of [Review an upstream](/workflows/processes/upstream-review/review-upstream) |
| Out | `Integration.updated` | Raised by step 3 of [Review an upstream](/workflows/processes/upstream-review/review-upstream) |
| Out | [`Risk.treated`](/business/events/Risk.treated) | Raised by step 4 of [Review an upstream](/workflows/processes/upstream-review/review-upstream) |

## Plays
No Play names this Process.

## Controls
No Control names this Process or a Workflow of it.

## Settings
None.

## Failure
A failed step retries; when retries run out, the Action goes to the [Risk Analyst](/agents/operations/risk-analyst).

## Loop
No loop: the path is never randomized, because it serves [Upstream review](/systems/trust-and-governance/controls/upstream-review).

## Code

**Ask**

```text
Turn on upstream review
```

**API**

```bash
curl -X POST https://api.sb/leaseline.app/processes/process_1/enable \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY"
```

**SDK**

```ts
import { $ } from 'startup-builder'

await $.Process.enable({ process: 'process_1' })
```

**CLI**

```bash
npx startup-builder do Process.enable --json '{"process":"process_1"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Process.enable({ process: 'process_1' })"
  }
}
```

## Enable
On by default for every Product Template. [Process.pause](/business/nouns/process/pause) stops new Actions; Actions in progress finish.

## Example
Before a [Startup](/business/nouns/startup) adds a transcription upstream, the [Risk Analyst](/agents/operations/risk-analyst) reads its security report, data terms and region. It processes personal data, so it joins the [subprocessor list](/systems/trust-and-governance/subprocessors) before the first call.