Third-Party Vendor Review Process
Last updated: October 12, 2026
Part of the JorgAI security and trust documents.
| Document control | |
|---|---|
| Document | Third-Party Vendor Review Process |
| Practices in effect since | Platform launch, April 2026 |
| Formal issue | October 2026 |
| Last reviewed | October 12, 2026 |
| Owner and approver | Founder, JorgAI LLC |
| Related documents | Information Security Policy (section 9 and Appendix A); Privacy Policy |
1. Purpose
JorgAI uses a small number of third-party vendors to run its service. This process ensures that every vendor is reviewed before it receives any JorgAI data, receives only the data its purpose requires, operates under written terms, and is re-reviewed on a schedule.
2. Scope
Every vendor, cloud provider, model provider or other service that processes, stores or transmits JorgAI data, and every vendor whose failure would affect the availability of the service. The current list is published in Appendix A of the Information Security Policy and in the Privacy Policy.
3. Review before use
| Step | What is checked | Outcome recorded |
|---|---|---|
| 1. Purpose and data | What the vendor will do and the minimum data needed to do it; whether that data includes customer brokerage data, personal data, or credentials | Data classification and the exact fields shared |
| 2. Security posture | SOC 2 or ISO 27001 report where available; encryption in transit and at rest; access controls; breach notification terms; data residency | Review notes and any gaps |
| 3. Data use terms | Written terms covering permitted use, no sale or secondary use, no training of AI models on our data, retention and deletion | Agreement reference |
| 4. Access design | How JorgAI authenticates to the vendor; scoping of credentials; where credentials are stored (AWS Secrets Manager only) | Credential inventory entry |
| 5. Approval | The founder approves or rejects; vendors that would receive brokerage account data are held to the highest bar | Entry in the subprocessor list |
4. Ongoing review
Each vendor is re-reviewed annually and whenever it changes its service, terms, ownership or security posture. The review confirms the data shared is still the minimum required, that the vendor's security documentation is current, and that credentials have been rotated on schedule. Vendors that fail a review are remediated or replaced.
5. Retirement
When a vendor is retired, JorgAI revokes its access, deletes credentials, confirms deletion of any data the vendor held, and removes it from the subprocessor list.
6. Current vendors
Vendors with access to customer brokerage data: Amazon Web Services (hosting, database, cache, secrets, logs), Apple APNs and Resend (trade alerts the customer enables), Sentry (error monitoring, no account data by design). Vendors that receive no brokerage data: Anthropic (market data and the customer's rule settings only), Stripe (billing), Loops (email address and account-status flags), Alpaca Data and Massive (market data), Google Analytics and Microsoft Clarity (anonymized usage). All vendors are located in the United States.
7. Review and approval
Reviewed at least annually. Approved by the founder of JorgAI LLC, October 2026.