For critical vendors without a SOC 2 report that access PYRANA.ai data or affect system security, a quarterly vendor risk assessment must be performed so that these higher-risk vendors receive compensating oversight.

For critical vendors that do not have a SOC 2 report

— Pyrana Vendor Management Policy.pdf

but that have access to PYRANA.ai data or that impact the security of PYRANA.ai system

— Pyrana Vendor Management Policy.pdf

a quarterly vendor risk assessment is performed

— Pyrana Vendor Management Policy.pdf