Bhaviyo
Client governance workspace
A vendor's public webpage is not the same as PendlePay's contract or account settings.
Only a public webpage and PendlePay's own subprocessor listing were available. No signed terms, DPA, transfer safeguard or account settings were reviewed.
Evidence-supported 2 · Public statement only 3 · Client-reported 1 · Not evidenced 6
Signed agreement and DPA reviewed: processor role, UK processing, no training, 30-day deletion and subprocessor notice. Minor gaps on model-change notice, certificate and breach timeframe.
Contractual 11 · Partial 1
| Question | LLM Provider A | Vendor B |
|---|---|---|
| Contract basis | ||
| Vendor's role | ||
| Processing location | ||
| International transfer safeguard | ||
| Use of data for training | ||
| Retention of inputs (prompts and documents) | — | |
| Retention of outputs | ||
| Vendor's own subprocessors | ||
| Security commitments | ||
| Breach notification | ||
| Notice of model; terms or hosting changes | ||
| Deletion at end of contract | ||
| Retention of inputs | — |