Supplier & Vendor Management

Purpose

This procedure defines how Maelstrom AI assesses, selects, and manages suppliers and vendors so that they are assessed against our security requirements. It applies across both platforms operated under our ISMS — Provii (zero-knowledge age verification) and downpipes (no-custody backup & disaster recovery for the Cloudflare data layer).

Critical Suppliers

Cloudflare

Services: Workers, KV, D1, R2, Durable Objects, Secrets Store, Pages, Analytics, DDoS protection. For downpipes, Cloudflare additionally hosts the vendor-side control-plane (with the downpipes Licence Signer in Cloudflare Secrets Store, fail-open) and the static, signature-pinned update channel R2 bucket (updates.downpipes.io). The customer-operated engine and console run in the customer’s own Cloudflare account, under the customer’s keys — out of our custody. Criticality: High - Complete service dependency Security Assessment:

• SOC 2 Type II certified
• ISO 27001 certified
• Enterprise SLA (99.99% uptime)
• Regular security audits published

Contract Terms:

• Data processing agreement
• Security and privacy provisions
• Incident notification requirements
• Right to audit

Monitoring:

• status.cloudflare.com for outages
• Security advisories reviewed
• Annual contract review

GitHub

Services: Source control, CI/CD (Actions), artifact hosting, security scanning — for both the Provii and downpipes codebases Criticality: High - Development dependency Security Assessment:

• SOC 2 Type II certified
• GitHub Advanced Security features enabled
• Bug bounty program
• Regular security updates

Contract Terms:

• GitHub Enterprise Cloud agreement
• Data protection addendum
• Security features included

Monitoring:

• GitHub status page
• Security advisories
• Dependabot alerts

npm Registry

Services: JavaScript package distribution for application and SDK dependencies Criticality: Medium - Supply chain dependency Security Assessment:

• Supply chain controls (lockfiles, hermetic builds, npm audit)
• Provenance and signature verification where available Monitoring:
• npm status page
• Advisory feeds and npm audit alerts

downpipes as Upstream Supplier (operating-model boundary)

For downpipes, the supplier relationship is inverted at one point: Maelstrom is itself the upstream supplier of signed engine and console updates flowing into a customer’s own Cloudflare account. This is a supply-chain path into customer tenants and is managed as such:

• Updates are pulled, never pushed: the engine fetches verified updates from the static, signature-pinned update channel (updates.downpipes.io); there is no vendor inbound path and no phone-home.
• The engine verifies the update signature against a pinned public key before applying; safe-apply is canary-gated with automatic rollback.
• The downpipes Update Signer is held offline by the operator and is never deployed to any Worker, so the key that could ship code into customer tenants exists in no running system.
• The vendor-side control-plane is fail-open and holds no customer keys, data or Cloudflare tokens; it never gates backup or restore.

See Supply Chain Security procedures and the Risk Register (RISK-2026-DP-H01) for the corresponding controls.

Vendor Selection Process

For New Vendors

Step 1: Requirements

• Define business need
• Identify security requirements
• Determine criticality level

Step 2: Assessment

• Review vendor security posture
• Check certifications (ISO 27001, SOC 2)
• Review terms of service
• Assess data handling practices

Step 3: Approval

• Security Lead: Security assessment
• ISMS Owner: Final approval for critical vendors
• Document in vendor register

Step 4: Onboarding

• Sign contracts/agreements
• Configure security settings
• Document access credentials
• Add to monitoring

Vendor Risk Assessment

Risk Factors

Current Vendor Ratings

1. Cloudflare. High criticality, Low risk (strong security)
2. GitHub. High criticality, Low risk (strong security)
3. npm Registry. Medium criticality, Low risk (supply chain controls)

Ongoing Monitoring

Quarterly Review:

• Verify vendor still meets requirements
• Check for security incidents
• Review contract compliance
• Update risk assessment

Continuous Monitoring:

• Status pages for outages
• Security advisories
• News/breach notifications

Vendor Incidents

If vendor has security incident:

1. Assess impact to Maelstrom AI
2. Activate incident response if needed
3. Communicate with vendor
4. Document in incident register
5. Review vendor relationship
6. Update risk assessment

Vendor Termination

Offboarding Process:

• Revoke vendor access to our systems
• Retrieve/delete our data from vendor
• Terminate contracts
• Document lessons learned
• Update vendor register

Open Source Dependencies

Managed via: Supply Chain Security procedures, across both the Provii and downpipes codebases

Controls:

• Dependency scanning (cargo audit, npm audit)
• Licence compliance reviews
• Vulnerability monitoring
• Hermetic builds (locked versions)

Related Documents

1. Supply Chain Security procedures
2. Risk Register - Supplier risks
3. Statement of Applicability - Controls A.5.19-A.5.22
4. Sub-Processors List - downpipes engages no sub-processor for customer data (no-custody)

Document Information

• Version. 1.2
• Effective Date. 2025-01-13
• Last Updated. 2026-06-19
• Owner. ISMS Owner
• Review Frequency. Annually
• Classification. Public
• Change (1.2). downpipes added as second in-scope platform; the legacy backup worker retired in favour of self-hosted downpipes.