Last updated: 19/10/2026 · v5

This Vendor Management Policy sets out how Juro selects, contracts with, monitors and offboards third-party vendors, so that they protect Juro data and customer data to the same standard Juro does.

SOC 2 criteria: CC2.3, CC3.2, CC3.3, CC3.4, CC4.1, CC4.2, CC6.4, CC9.2, P6.2, P6.4

<aside> <img src="/icons/calendar-day_gray.svg" alt="/icons/calendar-day_gray.svg" width="40px" />

Last reviewed: October 2026. This policy is reviewed at least annually.

</aside>

Ownership

• Work Tech owner (VP People, Talent & Work Tech) — policy owner. Runs the software request process, maintains the vendor inventory and runs the annual review of high-risk vendors.
• Legal — contract and data protection review, sub-processor disclosure and customer notification.
• Finance — budget, commercial and payment terms review.
• Application Security Engineer — security review where a vendor accesses Juro code, customer data or production systems.
• Business Owner — every vendor has a named Business Owner in the Software universe, who is accountable for how it is used, who has access, and its renewal.

Scope

This policy applies to every third-party vendor that:

• stores, processes, transmits or can access Juro data, including customer data, personal data (of customers, employees or candidates), source code and credentials; or
• provides a service whose failure would materially disrupt Juro's operations or the service Juro provides to customers.