Request access

Vendor & Third-Party Risk Management Policy

How we evaluate vendors before they touch merchant data, review them annually, and keep the public subprocessor list in sync with the internal register.

Version 1.1 Effective October 27, 2026 Governance Full text on request

The full policy text is shared on request

Request access and we'll open version 1.1 for your review, along with everything listed below.

  • Every published policy in full
  • Control detail with SOC 2 criteria
  • Named subprocessor list
Request access Already approved? Sign in

Most requests are approved within one business day.

All policies