D7 · Third parties
This document lists the third parties involved in Bolívar Connect and defines how they are assessed before integrating them and throughout the relationship.
1. Third-party register
Section titled “1. Third-party register”| Category | Function | Data it receives | Criticality |
|---|---|---|---|
| Cloud (AWS) | Compute, storage, encryption and secrets management | All of the platform’s (encrypted hosting) | High |
| Regulated financial institution in Venezuela | Holding funds and executing the pago móvil or bank transfer | Name, national ID, bank, account or phone, and amount | High |
| Transactional email | Sending client onboarding and access emails | Client contact email | Medium |
| Code repository | Version control | None from clients or beneficiaries | Medium |
| DNS | Domain resolution | None | Low |
2. Assessment before integrating
Section titled “2. Assessment before integrating”Every new third party is assessed against these criteria, and the result is recorded:
| Criterion | What is checked |
|---|---|
| Certifications | Current ISO 27001, SOC 2 or PCI-DSS, or equivalent regulation in its sector |
| Encryption | TLS 1.2 or higher on its API; encryption at rest of the data it receives |
| Authentication | Per-client, rotatable credentials; signature on the webhooks it sends |
| Data | Which personal data it needs, where it hosts it and how long it keeps it |
| Contract | Confidentiality, data protection, incident notification and its own subprocessors |
| Continuity | Committed availability and support channel |
A high-criticality third party is not integrated unless it meets all the criteria. A medium- or low-criticality one can be integrated with mitigations approved by the Security Officer.
3. Technical controls on each integration
Section titled “3. Technical controls on each integration”They are independent of the third party:
- it is only sent the data essential for its function;
- its credentials live in AWS Secrets Manager and are rotated upon any suspicion;
- its webhooks are verified by signature and timestamp, and deduplicated;
- a circuit breaker takes it out of service if it fails;
- its results are reconciled against the platform’s records.
4. Follow-up
Section titled “4. Follow-up”- Annual review of each high- and medium-criticality third party: validity of certifications, incidents during the year and changes in its subprocessors.
- Per-event review: upon an incident at the third party or a relevant change in its service.
- Offboarding a third party: revocation of its credentials and confirmation that the data it received was returned or deleted.