# Review an upstream

URL: /workflows/processes/upstream-review/review-upstream · Id: `workflow:review-upstream`

> Review an upstream checks a new provider’s security, privacy terms and continuity before first use, and sets the date it is reviewed again.

Review an upstream checks a new provider’s security, privacy terms and continuity before first use, and sets the date it is reviewed again.

## Trigger
Runs on `Integration.created`. Part of [Upstream review](/workflows/processes/upstream-review), run by the [Operations Team](/agents/operations).

## Steps
1. Score the provider’s security from its reports and certifications.
2. Record whether it processes personal data, and sign its data processing terms when it does.
3. Name the fallback provider the Startup fails over to.
4. Approve or refuse the provider and set its review a year out.

## Outputs
- [Risk](/business/nouns/risk)
- [Agreement](/business/nouns/agreement)
- [Integration](/business/nouns/integration)

## Example
A [Startup](/business/nouns/startup) adds a transcription provider. The [Risk Analyst](/agents/operations/risk-analyst) scores its security from its audit report. The [Privacy Officer](/agents/legal/privacy-officer) signs its data processing terms, and the next review is a year out.