# Vendor management policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.

## Rules

1. Every company that processes clinic data on Veteros' behalf is listed in
   `docs/v2/subprocessors.md` with its purpose, data categories, location and transfer mechanism,
   before it receives any clinic data.
2. Before use: a signed data processing agreement, a security review (the vendor's security report
   or questionnaire), and confirmation of retention terms. AI providers additionally must not use the
   data to train or improve models; Google Gemini is used only under paid terms (enforced at startup,
   `apps/v2/src/server/ai/data-terms.ts`).
3. Adding or replacing a sub-processor changes the "Last changed" date of the registry. Owners who
   subscribed receive an email notice through the outbox (`apps/v2/src/server/trust/notices.ts`)
   before the change takes effect, with `{{NOTICE_PERIOD_DAYS}}` days to object where their contract
   allows it.
4. Vendors are reviewed every year: current agreement, latest security report, incidents.
5. Card data never reaches Veteros: checkout and payment methods stay on the billing provider's
   hosted pages.

## Evidence

The registry and its history, signed agreements, vendor review notes, notice records
(`subprocessor_notices`).