Vendor Management Policy

Bridgit Platform (askbridgit.ai)

Version 2.0 · Effective: October 16, 2026 · Next Review: October 16, 2027

1. Purpose and Scope

This policy governs how Core Innovation Corp. (operating as Bridgit, askbridgit.ai) ("Bridgit") selects, assesses, contracts with, monitors and offboards third-party vendors that process platform data or provide services critical to the platform. It also publishes Bridgit's current list of sub-processors (section 3).

Applies to: all third-party vendors, service providers and sub-processors engaged by Bridgit, and everyone involved in selecting or managing them.

Framework alignment: aligned with ISO 27001 A.15, SOC 2 CC9.2 and GDPR Article 28 principles. Bridgit is not certified to ISO 27001 or SOC 2.

2. Vendor Risk Tiers

Vendors are scored from 1 to 5 on four criteria: data access and sensitivity, service criticality, data residency and jurisdiction, and compliance posture. The scores determine the tier. Bridgit relies on each vendor's published security and compliance attestations; it does not audit vendors directly.

3. Sub-Processors

The following third parties process customer data in production. Data hosting is in Canada. When AI or search features are used, the content needed for the request is processed in the United States.

Bridgit does not currently hold signed data processing agreements with these sub-processors. Each provider's commercial / API terms apply, including no training on API data and retention as published by that provider (currently up to 30 days by default).

Backups: Automated database backups are stored in the Montréal region. Full database exports taken before each production release are stored in Montréal and are kept with no automatic expiry today.

Health information: the platform is not designed to hold personal health information, and customers must not enter it, including in AI features, unless a written agreement with Bridgit expressly permits it.

Changes to sub-processors: Bridgit gives customers at least 30 days' notice before adding a sub-processor that processes customer content. Notice is given by email to organization administrators and by updating this page. A customer may raise an objection with the Privacy Officer during the notice period.

Other AI providers. Anthropic (Claude) and OpenAI are the AI providers configured in production and used routinely. The platform also supports Google (Gemini), Cohere, Mistral, Perplexity, DeepSeek and Microsoft Azure OpenAI; these are available but are not currently enabled in production. Enabling one, platform-wide or for an organization that selects it, would add a sub-processor that processes the request content (in the United States, or the location stated in the notice) under that provider's commercial / API terms, and we would give customers at least 30 days' notice first.

4. Due Diligence Before Engagement

Before engaging a vendor that will process personal data or customer content, Bridgit:

1. documents the business need
2. maps the data the vendor will receive, process or store, and where
3. reviews the vendor's terms, privacy policy, data-retention and model-training terms (for AI providers), and published security attestations
4. confirms that the vendor's terms are acceptable (section 5)
5. assigns a risk tier
6. carries out a privacy impact assessment where the Risk Assessment Policy requires one, including for new transfers of personal data outside Canada
7. obtains the approval of Matthew Bromwich, CEO and Privacy Officer

Bridgit then updates the list in section 3, subject to the 30-day notice.

5. Contractual Requirements

Before engaging a vendor that processes personal data, Bridgit reviews whether the vendor's terms provide for:

• processing only on Bridgit's instructions
• confidentiality of processing personnel
• appropriate security measures
• conditions on the vendor's own sub-processors
• help with individuals' privacy requests
• notice of security incidents
• deletion or return of data at the end of the service
• information to show compliance

The terms that apply to each vendor are shown in section 3. Bridgit does not currently hold signed data processing agreements with its sub-processors; each provider's commercial / API terms apply.

6. Ongoing Monitoring

The CEO and Privacy Officer reviews each vendor's tier, data flows, terms and agreement status at least at each annual review of this policy, and when there is a material change. A material change includes new data being shared, a new location, a change to the vendor's data-use or model-training terms, or a vendor security incident. Bridgit acts on the security advisories and incident notices that Critical and High vendors send to it. A security incident at a vendor that affects Bridgit data is handled under the Incident Response Policy, including notice to affected customers.

7. Vendor Offboarding

Data: export any Bridgit data needed; ask the vendor to delete Bridgit data under its terms, and obtain confirmation where the vendor provides it.

Access: promptly after ending the service, and in any case within 14 days:

• rotate or delete the vendor's API keys
• revoke OAuth grants and delete stored tokens
• remove vendor-specific IAM roles or service accounts
• remove the integration's configuration and secrets
• redeploy

Transition: complete due diligence on any replacement vendor before switching, and update section 3 and the related policies.

8. Processor Obligations (GDPR Art. 28; PIPEDA Principle 1)

Bridgit remains responsible for personal data it transfers to vendors for processing. It uses contractual and other means to give that data a comparable level of protection while the vendor processes it. Bridgit relies on each vendor's terms for the vendor's own sub-processors, and reviews changes to them for jurisdiction and processing impact.

9. Policy Administration