--- title: "Vendor Vetting Hub — GDPR Article 28, DORA & KYV | APIWORX" description: "A complete vendor vetting resource: GDPR Article 28, DORA, NIS2, SOC 2, ISO 27001, and Know Your Vendor (KYV) guidance — plus a free 30-point due-diligence…" lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://apiworx.com/#organization", "name": "APIWORX", "alternateName": [ "APIWorks", "Apiworx" ], "url": "https://apiworx.com/", "logo": { "@type": "ImageObject", "@id": "https://apiworx.com/#logo", "url": "https://apiworx.com/og-image.png", "caption": "APIWORX" }, "image": { "@id": "https://apiworx.com/#logo" }, "description": "APIWORX is the commerce iPaaS with the ops team included — the purpose-built integration platform for multi-channel commerce brands, connecting ecommerce, marketplaces, POS, wholesale, and EDI to NetSuite, Sage Intacct, and Acumatica.", "foundingDate": "2018", "sameAs": [ "https://www.linkedin.com/company/apiworx", "https://x.com/apiworx", "https://www.facebook.com/apiworx", "https://www.instagram.com/apiworx" ], "address": [ { "@type": "PostalAddress", "streetAddress": "1401 Lavaca Street Suite 241", "addressLocality": "Austin", "addressRegion": "TX", "postalCode": "78701", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Chennai", "addressCountry": "IN" }, { "@type": "PostalAddress", "addressLocality": "Manila", "addressCountry": "PH" }, { "@type": "PostalAddress", "addressLocality": "Buenos Aires", "addressCountry": "AR" } ] }, { "@type": "WebSite", "@id": "https://apiworx.com/#website", "name": "APIWORX", "alternateName": [ "APIWorks", "Apiworx" ], "url": "https://apiworx.com/", "inLanguage": "en-US", "description": "APIWORX is the commerce iPaaS with the ops team included — connectors, flows, and reconciliations for multi-channel commerce brands, operated by an expert team on the SLA.", "publisher": { "@id": "https://apiworx.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://apiworx.com/connectors?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "SoftwareApplication", "@id": "https://apiworx.com/#software", "name": "APIWORX", "operatingSystem": "Web", "applicationCategory": "BusinessApplication", "description": "Commerce iPaaS with the ops team included — 60+ commerce-specific connectors across ecommerce, marketplaces, POS, wholesale, and EDI, operated by an expert team. Flat-fee pricing.", "url": "https://apiworx.com/", "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD" }, "publisher": { "@id": "https://apiworx.com/#organization" } } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "WebPage", "name": "Vendor Vetting Hub — GDPR Article 28, DORA & KYV", "description": "A complete vendor vetting resource: GDPR Article 28, DORA, NIS2, SOC 2, ISO 27001, and Know Your Vendor (KYV) guidance — plus a free 30-point due-diligence checklist.", "url": "https://apiworx.com/blog/vendor-vetting", "isPartOf": { "@type": "WebSite", "name": "APIWORX", "url": "https://apiworx.com" }, "breadcrumb": { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://apiworx.com/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://apiworx.com/blog" }, { "@type": "ListItem", "position": 3, "name": "Vendor Vetting Hub" } ] } }, { "@type": "Organization", "@id": "https://apiworx.com/#organization", "name": "APIWORX", "alternateName": [ "APIWorks", "Apiworx" ], "url": "https://apiworx.com/", "logo": "https://apiworx.com/og-image.png", "sameAs": [ "https://x.com/apiworx", "https://www.linkedin.com/company/apiworx", "https://www.facebook.com/apiworx", "https://www.instagram.com/apiworx" ], "description": "APIWORX is a managed iPaaS for ecommerce, wholesale, and multichannel retail operators. We deliver production-tested, production-tested integrations between Brightpearl, NetSuite, Shopify, Amazon, Wayfair, Sage Intacct, and 60+ other commerce, ERP, and EDI platforms — run as a managed service.", "foundingDate": "2018", "founder": { "@type": "Person", "name": "Charlie Alsmiller" }, "address": [ { "@type": "PostalAddress", "streetAddress": "1401 Lavaca Street Suite 241", "addressLocality": "Austin", "addressRegion": "TX", "postalCode": "78701", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Chennai", "addressCountry": "IN" }, { "@type": "PostalAddress", "addressLocality": "Manila", "addressCountry": "PH" }, { "@type": "PostalAddress", "addressLocality": "Buenos Aires", "addressCountry": "AR" } ] }, { "@type": "CollectionPage", "name": "Vendor Vetting Hub", "description": "GDPR Article 28, DORA, SOC 2, ISO 27001, and Know Your Vendor (KYV) guidance for operations and security leaders evaluating integration vendors.", "url": "https://apiworx.com/blog/vendor-vetting", "mainEntity": { "@type": "ItemList", "itemListElement": [ { "@type": "ListItem", "position": 1, "url": "https://apiworx.com/blog/soc2-iso27001-gdpr-integration-vendor-verification", "name": "SOC 2, ISO 27001, and GDPR Badges: What Integration Vendors Are Not Telling You" }, { "@type": "ListItem", "position": 2, "url": "https://apiworx.com/blog/kyc-vs-kyv-vendor-vetting", "name": "KYC vs. KYV: Why Vendor Vetting Is Not Optional in 2026" }, { "@type": "ListItem", "position": 3, "url": "https://apiworx.com/blog/offshore-integration-developer-risks", "name": "Offshore Integration Developer Risks: The Hidden Cost of Cheap Integration in 2026" } ] } }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is vendor vetting and why does it matter for integration platforms?", "acceptedAnswer": { "@type": "Answer", "text": "Vendor vetting (sometimes called Know Your Vendor or KYV) is the structured due-diligence process you run before granting a third party access to production systems. For integration platforms, the risk is uniquely high: the vendor holds persistent, programmatic, multi-system credentials. A compromised integration vendor exposes everything they connect to." } }, { "@type": "Question", "name": "What does GDPR Article 28 require from data processors?", "acceptedAnswer": { "@type": "Answer", "text": "Controllers must ensure processors provide ‘sufficient guarantees’ of technical and organizational compliance. In practice that means a signed Data Processing Agreement, a named EU Representative under Article 27 for non-EU processors, documented legal bases for each processing activity, and a 30-day response window on data subject requests under Article 12. Liability for vendor non-compliance lands on the controller." } }, { "@type": "Question", "name": "Who must comply with DORA and what does it require for vendors?", "acceptedAnswer": { "@type": "Answer", "text": "DORA — the EU Digital Operational Resilience Act, effective 17 January 2025 — applies to EU financial entities and their ICT third-party providers. It requires pre-contractual third-party assessments, specific contractual clauses covering audit rights and incident notification, and ongoing monitoring. Financial entities remain fully responsible for regulatory obligations even when functions are outsourced." } }, { "@type": "Question", "name": "How do I verify a SOC 2 or ISO 27001 claim?", "acceptedAnswer": { "@type": "Answer", "text": "For SOC 2, request the actual audit report under NDA — confirm a named CPA firm, Type II designation, and a report date within the past 12 months. For ISO 27001, ask for the certificate number and accredited certification body, then verify it on iafcertsearch.org or certcheck.ukas.com. Verification takes under a minute. No number means no certificate." } }, { "@type": "Question", "name": "What is the difference between KYC and KYV?", "acceptedAnswer": { "@type": "Answer", "text": "KYC (Know Your Customer) is a regulated obligation for financial institutions — verify identity, screen against sanctions, monitor ongoing activity. KYV (Know Your Vendor) applies the same discipline to third parties you grant operational access to. KYC has a single regulator with subpoena power. KYV is enforced through a fragmented mosaic — GDPR, DORA, NIS2, CCPA — but the legal obligations are equally binding." } } ] } ] }, { "@context": "https://schema.org/", "@type": "SoftwareApplication", "applicationCategory": "BusinessApplication", "name": "APIWORX", "image": "https://sourceforge.net/s/apiworx/icon", "description": "SourceForge Software Rating", "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5", "bestRating": "5", "ratingCount": "1" } } ] --- Commerce iPaaS · 60+ operated connectors · Ops team included · Flat-fee pricing [Support](https://portal.apiworx.com)[Partners](/partners) [](https://chatgpt.com/?q=who+is+apiworx)[](https://claude.ai/new?q=who+is+apiworx)[](https://www.perplexity.ai/search?q=who+is+apiworx)[](https://gemini.google.com/app?q=who+is+apiworx)[](https://grok.com/?q=who+is+apiworx)[](https://copilot.microsoft.com/?q=who+is+apiworx) Resources [Sign In](https://app.apixx.io) [](https://x.com/apiworx)[](https://www.linkedin.com/company/apiworx)[](https://www.facebook.com/apiworx)[](https://www.instagram.com/apiworx) [![APIWORX managed integrations logo](data:image/webp;base64,UklGRq4LAABXRUJQVlA4TKELAAAvKoENEK+nkI0kqAxLev4Cr4CQICH7f6tZIJDEtvZyCNO2TdHM/n94XaY+9hsP+1w/0CFAMEAwQjgACHChQXBFmoCICC/d2t60kS49KeMwlzuzzMzMu8PMjOXONPouYGKpyvLur4j+O3DbxpHkZHev53rKvIC2bduqE+ucJJDg7u7u7u7uFO5OkSJBj3z2/gD23GuvQ7st9zWi/xAkyY3bDJz7WoIgCMB5AVylvpbI2XmZhAclXuw6VP6Wxq+hz93lK1fEJvO/b5Gh2hU9l6tmZM4H/6/ARYphmM3fsYn4LjE517VcP+OR7cZ+heM0Q9p4LMLqQuceMZ2O6hg7FTyJLuun58AAsmIRdytp0eopDak6MXY6kK3d++nZQlJiEIk6VVPo2Cemcl97esqiZ+pUS/7sPPqBuhjEI/dvRLbDjnZ0HImXphtE9Ag/u/olodsYxCz7uncIF+7EZKLbQjxJZFynuZ8ed60yv/1RxCA2iFmn8DgrQYnQsujZuvkw+AUUo6q5dZbKnd/ZDjFN+4VUb0r2Ghls4E+tL2SqmkZ8gZg+2yb2R2IsxgWnL39sLhC3Yfhf8hT3lWWkeq/I5OylH0PC4134Y2NvEtNxBzC8xsqFRy4PHZO1FJA4JsaGp5rKDW+NtDU09y3eOIhj/5ijqrKlucj73nhHQ1PP7CnVOWnkATYqJaAXQ0JqpLEuFvpbGlr6Fi8tppNs0ijljgZaT1+VmBZswBpbMWJoPY9Fn5q+ctEGbOFHodYHPd8rRaahWNpIVJIb/LEmhbugtDXpnePagKow2HalY1KqS4pIeQWgdFWHlSPFJEd1nILEfOpx1ppgqJbQdqHHmitKCBKW9CmEVQkSUp+0zIOc0C4weEJMZv7f+2LdvWvHPTrbeGG+I/eIURr04NtpBm3BaVuIdKmgRuEW9KwI8VShUWg2hGlGpZbAKyHBqNJxgmpXdXSBmBGhcFNm6KzyRkOkUKMq8IN4SgQNhd8aLjGYusW5uvf4B5VlclZ45NqjZ88eXU9FWKEZrzD2u6Hmq8009F6JctkK6hUm7nF58IOGCGszjErdSUqV+O6VozruN/QWmCKPtFNpcBC7PhDRQ/OWCVqKcN+S6/xfBGq95LdIQM1HhcGxnFcWy6s+jkLfMhO3BKVqYiFJ8eoLzSFoKXZRWqPBsxbqbxyYPMQQOmGL3Mt6jKFnRUdkge1CWiIVk/mo3q1q4hQnF1aXpisZsCiFQ73yEsqvKs+KJx6bPMQSUE6zr0qdo+kAFvD9emI1qcU1xalESDQ5Kj0GE7sMXfJEMIP6qdMWmDTfg5tabpDBRBB6htUTPHQjQ8Z9WcjB9WsgXdJyDE5526lQ4ip4zyMSBBFhkhaVYjrEkyVxKHZAvdImHx0hhPM4qWbvMZVmWGp7h2pdSqD/S8bvsRTOA8CwoMz3zmBOy5zBe58Hv/Tjd7RT16E9F+eFIrIJP1D8V2qzEA2gaZGcOIZU/I/kx+QU5NiHETjyRYkdNFHLBU2WIxh2hB7sdYFoOqio0BQ51nPnnGZYebru8tyCHrcMX2Y1ldd5Ah/dFDpShGq2eOwDZdoxWm6W8WOTFG3AjsTBcxS3rysLAhgbtmfEBLpwG/xZiyO7V622O25qktORcRO8u4AHzkzmbPkswKXC1umLZgL5DovvFFDxl6BOMgXa8lzi40RJEuz8pupjna2hb/a94+C2JDz+MI1H4ITzHEeT6L6O+0TNy/BEByZ9xorHmYT+MbbYB169ZCF6dVfHe0A67enelEJvVfapksstBToZJ64ZqPaOiGSAwIIvceEHJlni8jV6q+MN1Qre3EkCrjg1XiqPCU7iaMSkzeMaKFFZUX5/vibLtwIXcCGYkviw0NtzHAiKekecY3LviuA31THVFZxJHeOtIrxxB14p5F3ILPwRVubAq5SHkwti1Q8rldiekmQqH34lgMdBxbohaRMca8APfwExj6kj25BkRLniDqaVtzy0PbLh4XxcsigTHGw4DyGLg7IZxgzy6lOK3mc4lJfIDpmi+4A9FuvAKAd2jsBb6UJwOVQy65kJ4Ijneh+HAZ70KgjZMI8wfVbmiU0ulvQhTRLfM1CLwc/iAVuFX0CIj2yCBcHlIk3o+OZc9sggnBPmFD6VwzyPTpB+z0NU4AZQDdYSsVkpNtzO8copIbYu9MlzvB+cQOMhlam1aIvLfjml1zpeU/PSd8D3woE70aDRNTg3NNoDOy15Nole4B948Zj6eAUpgBLjm8Un7GTl7+AUK+wJHpab0CnnsHc9p3NDBlQMPBI5TNFork7fE5OPIBQNMEIj64xKSTtxTwTfkDK4X99YRA1JrWeUpSskv/BejA5iSkfKbZs9tT0wiyU6i3eDQwcLt0gSF9WhK0EehXDyJGtkuZL0JcQHRGmTEJTzzTsPd1vnr3BAzVzKvhn43rjeCOkIG4OPtz49+9iu8RSxyHRZ6SsAGc/lcqSWgXcmhi3Zwe+r/zFwoDCGzSqLKWD2FxB/kwzK+l0tgXFyNaONedoI6ltATdiPqZ1DEwvzisOa8pw/Fxsa+XwXy8N6TWvVpHyc+q1p2Es5OAVYH/8C3zicyx9VhmY6QvNkcE3LVdYmC6stl31PPPp5XUITAzsPCwINnKvdziITjBLFofe3IASdUPgCGb4z9n/2JH95QdPChe6dOhTwQBPfIINKQEuoxJqvcS2TuPpXffxUcdv0Qw1EOxwX5nMLOWvswtTUHx/QG2zCxWxSE/t2WESupf/pHGUI7Z0NExayIcR7Bi7hC2nT1H8GtZ56ben/i8fU+6W7I0YMLkkP2jgLKFHOxy0EV3UTpSvp55panIYQ3JjYUun8b2MO8j945y6IW+kKIa4D2qJukI8WS2H24S48/jizuDj76UmRfXwjfJp0MqC0PmWqQ7eV1oDJn5OlXtJsxaP3bj0g5iDAQN8+xR+QC26c4YxnWz9JPvDF6BSe+cihn+1YMjWXU44PIJ0bOCd2Z7np9sW2t1puj3H5rjE+uiYMv3M6oqmK79ctNQAvSjwNquNG34hrrk2pCPoEF6XOVSzBIvM+cUMGwrRIRU7ugboFzp9sxS9RHfy2M+FZkdGGbroEhhvEmLKBxOuaOQjJW1aehfC6A7CE9SX1EWUGpD6JlTF48BQNn82U4OjLxwEPU2LH9n309XqlXnV+/qcnRI1KB2M+h9UwbX+UUaaZP3b8En05Hs9TR9snQgd7mOHbJYIbJWdGf/ALa5T2Y7Af1MwYmnmjb9Zkn+CHPkQPhLU4QZ3NmQbLhtM5jKXzFKb9Fd7YVjnWPGmrsik0tuo3eObfFHx0z3b0C8LuQ9hb2EJcJkalFx1LLIYWK8svn7FAljrE9ZVXdLjzPgZmv8vrPR9Zj4xn4ZHPRKXBsWmcFCT0JXS2FcciuCs8E0nDYtDSXMRq4f2N+yCGS8S4I/T5Hb40dQR9JcY4lDpM0RK/xG7TI5V66t+EV0QX0su8xto592cBg+IH4Rm7CguDF03s9WAuOBTrgufqpHhQ65nw05hG34nJFrR67w+S+BqePEw0nNU0mrxdV3jnHM/HubadNIFTVk+wkqUhe9UR3hnB9HCgbRqKcOPCG9zzgr+zINkbwTLoN20HekXmykO4zNzBexfc3fNjS5zhz/dWfTLuZEb7kbYT+yO19n1oXT4o1QxqneoOSDUDzGGWddiR5UcvZHYea9e2JvWO6/RG+3qkLTNa0R6w9WmFj7cpx33jwiolbjPwpI+Hoz8H1xGd05hzsu/nkz9/Lv7Z4r9sTuT6QHrBEf8Nu+f+AA6Jl863/WMNLEhm3uABvou8EbMtVqXKELJCUrcRUbR+1ttZJfbHBtfLg6LvJaBQYk++s9J1/LlBDDnBS8oyvOuYx9VII2r9yUFnTSgstUU4BsvCYQfwR8e6WjJZ7dGH1rPCMuCr1h8eIHJrfGnxfcEHD7IL7xeXxm9HgZ+C/0v7L8lTgbTdmI0AAA==)](/) Platform Connectors Flows Who We Help [MCP](/mcp)[Pricing](/pricing) [Get my free integration assessment](/free-assessment) [](/resources)[Assess](/free-assessment) [Home](/)[Blog](/blog) Vendor Vetting Hub Vendor Vetting Resource Hub # The Operations Leader's Guide to Vendor Vetting GDPR Article 28, DORA, NIS2, SOC 2, ISO 27001, and Know Your Vendor (KYV) — explained, verified, and packaged into a 30-point checklist you can run before signing your next integration contract. TL;DR — Vendor vetting in 2026 **Vendor vetting** is the legally enforceable due diligence you must run before any third party touches production data. Under **GDPR Article 28**, the controller — not the processor — is fined when a vendor fails. **DORA** (effective 17 January 2025) and **NIS2** (October 2024) add pre-contractual ICT assessments, audit rights, and 24/72-hour incident reporting for EU entities. **SOC 2** is an AICPA attestation report (not a certificate); **ISO 27001** certificates are verifiable on IAF CertSearch and UKAS CertCheck in under a minute. Apply **Know Your Vendor (KYV)** with the same rigor as KYC — beneficial ownership, sanctions screening, audit rights — using our [30-point vendor vetting checklist (PDF)](/downloads/apiworx-vendor-vetting-checklist.pdf). Free download · PDF · No email required ## The Integration Vendor Vetting Checklist A 30-point due-diligence framework covering corporate identity, SOC 2 verification, ISO 27001 lookup, GDPR Article 28 readiness, DORA & NIS2 obligations, and operational controls. Use this before granting any third party access to production systems. - Beneficial ownership & sanctions screening - SOC 2 report verification under NDA - ISO 27001 IAF/UKAS lookup steps - GDPR Article 28 + Article 27 EU Rep - DORA pre-contract assessment clauses - NIS2 incident-reporting timelines [Download checklist](/downloads/apiworx-vendor-vetting-checklist.pdf)[Talk to APIWORX](/free-assessment) The four obligations ## What ‘vendor vetting’ actually covers in 2026 Four overlapping regulatory and operational frameworks that together define the modern duty of care for integration vendors. ### GDPR Article 28 The controller — not the processor — is fined when a vendor mishandles personal data. Article 28 requires a signed DPA, documented legal bases, and a 30-day SLA on data subject requests. ### DORA & NIS2 (EU) DORA (effective 17 Jan 2025) mandates pre-contractual ICT third-party assessments, audit rights, and incident notification clauses. NIS2 adds 24-hour early warning and 72-hour incident reporting. ### SOC 2 & ISO 27001 SOC 2 is an AICPA attestation report — not a certificate. ISO 27001 carries a unique number you can verify on IAF CertSearch and UKAS CertCheck. Badges without proof are marketing, not compliance. ### Know Your Vendor (KYV) Regulated firms spend millions on KYC, then hand production credentials to unverified offshore developers. KYV applies the same rigor — beneficial ownership, sanctions screening, audit rights — to your vendor file. Who this is for ## Who needs a vendor vetting program in 2026 Six roles carrying personal or organizational liability for third-party integration vendors — and the specific obligation this hub addresses for each. ### VPs of Operations & COOs Mid-market commerce and SaaS leaders granting integration vendors persistent access to ERP, OMS, and customer data — and carrying the operational liability when something breaks. ### CISOs & Security Leaders Security teams building third-party risk management (TPRM) programs and needing repeatable verification steps for SOC 2, ISO 27001, and GDPR Article 28 vendor claims. ### EU financial entities under DORA Banks, payment institutions, insurers, and crypto-asset service providers required to document pre-contractual ICT third-party assessments and exit strategies under DORA. ### Procurement & Vendor Management Procurement leaders standardizing vendor onboarding playbooks across integration, iPaaS, and offshore-developer engagements — with audit-ready evidence per vendor. ### Founders evaluating iPaaS vendors Growth-stage founders comparing integration platforms and needing to separate verifiable compliance from compliance theater before signing a multi-year contract. ### Privacy & Data Protection Officers DPOs and privacy counsel responsible for Article 28 processor diligence, named EU Representative requirements, and 30-day data subject request SLAs. The vendor vetting series ## Read the full cluster Three deep-dive articles covering the regulatory framework, the badge-verification playbook, and the offshore developer risk profile. [ ![SOC 2, ISO 27001, and GDPR compliance badges with verification overlay — integration vendor due diligence guide](/images/blog/soc2-iso27001-gdpr-integration-vendor-verification.jpg) Part 1 · Governance ### SOC 2, ISO 27001, and GDPR Badges: What Integration Vendors Are Not Telling You Most integration vendors display SOC 2, ISO 27001, and GDPR badges with no verifiable proof. Here is how to check a SOC 2 certified integration platform — and what we found when we audited the market. March 18, 2026 Read ](/blog/soc2-iso27001-gdpr-integration-vendor-verification)[ ![KYC vs KYV vendor vetting comparison — Know Your Vendor compliance under GDPR Article 28, DORA, and NIS2](/images/blog/kyc-vs-kyv-vendor-vetting.jpg) Part 2 · Governance ### KYC vs. KYV: Why Vendor Vetting Is Not Optional in 2026 KYC vs. KYV explained: how DORA, NIS2, GDPR Article 28, and CCPA make Know Your Vendor a legal obligation — and why integration vendors are the highest-risk category most operations leaders fail to vet. April 23, 2026 Read ](/blog/kyc-vs-kyv-vendor-vetting)[ ![Offshore integration developer risk illustration — vendor vetting checklist for SOC 2 and GDPR Article 28 controllers](/images/blog/offshore-integration-developer-risks.jpg) Part 3 · Governance ### Offshore Integration Developer Risks: The Hidden Cost of Cheap Integration in 2026 Offshore integration developer risks explained: SOC 2 fraud, GDPR Article 28 liability, IP exposure, and the 10-point vendor due-diligence checklist every operations leader should run before signing. April 22, 2026 Read ](/blog/offshore-integration-developer-risks) ## Red flags that should stop the procurement Five signals we have documented across India-based and freelance integration vendors marketing into UK and US mid-market buyers. - Vendor refuses to share SOC 2 report under NDA. - ISO 27001 badge displayed but no certificate number — or no result on IAF/UKAS. - GDPR claim with no DPA and no named EU Representative under Article 27. - Headcount, tenure, or client volume claims that cannot be substantiated. - Production access requested before contract and DPA are signed. - Compliance ‘trust center’ that contradicts the marketing page. KYC vs KYV ## Mapping KYC discipline to vendor onboarding Treat every integration vendor like a regulated counterparty. The same seven controls your finance team applies to KYC translate directly into Know Your Vendor obligations under GDPR Article 28, DORA, and NIS2. Onboarding requirement KYC (Know Your Customer) KYV (Know Your Vendor) Identity & legal entity verification Government ID, proof of address, UBO disclosure under AML directives. Certificate of incorporation, registered address, beneficial ownership ≥25%, D-U-N-S or company number. Sanctions & watchlist screening OFAC, EU Consolidated List, UN, HMT — screened at onboarding and continuously. Same lists applied to the vendor entity, parent company, and named directors. Re-screen annually. Source-of-funds / financial standing Income verification, source-of-wealth declarations for higher-risk customers. Audited financials or D&B credit report, insurance certificates (E&O, cyber, professional liability). Risk rating & tiering PEP status, geography, transaction profile drive low/medium/high risk tiers. Data sensitivity, system access scope, and data residency drive Tier 1–3 vendor classification. Contractual & regulatory obligations AML program, customer due diligence file, suspicious activity reporting. Signed DPA (GDPR Art. 28), DORA/NIS2 clauses, audit rights, exit strategy, sub-processor list. Ongoing monitoring Transaction monitoring, periodic refresh of customer file (typically 1–3 years). Annual SOC 2 / ISO 27001 refresh, quarterly access review, breach-notification SLA tracking. Evidence retained for audit KYC file produced for the regulator on request — retention 5–7 years post-relationship. Vendor file produced for the controller, supervisory authority, or financial regulator on request. Reference: GDPR Articles 27 & 28, EU DORA (Reg. 2022/2554), NIS2 Directive (2022/2555), AICPA SOC 2 Trust Services Criteria, ISO/IEC 27001:2022. How APIWORX fits ## Where APIWORX sits in the iPaaS landscape APIWORX is one of several capable integration platforms operations leaders evaluate alongside Workato , Boomi , Celigo , MuleSoft , and Tray.io . Each platform has genuine strengths — Workato and Boomi for enterprise breadth, MuleSoft for API management depth, Celigo for SaaS-to-SaaS templates, and Tray.io for developer tooling. We encourage running the same vendor vetting checklist against every shortlisted vendor, including us. What we believe sets APIWORX apart for mid-market commerce and ERP buyers is the combination of a verifiable compliance posture, a managed-service operating model, and an audit-ready data layer purpose-built for trading-partner ecosystems. If a competitor is the right fit for your stack, that is a good outcome — provided the same evidence standard was applied. Compare us directly on our [comparison hub](/compare). FAQ ## Vendor vetting, in plain English The questions operations and security leaders ask most often when standing up a vendor vetting program. What is vendor vetting and why does it matter for integration platforms? + Vendor vetting (sometimes called Know Your Vendor or KYV) is the structured due-diligence process you run before granting a third party access to production systems. For integration platforms, the risk is uniquely high: the vendor holds persistent, programmatic, multi-system credentials. A compromised integration vendor exposes everything they connect to. What does GDPR Article 28 require from data processors? + Controllers must ensure processors provide ‘sufficient guarantees’ of technical and organizational compliance. In practice that means a signed Data Processing Agreement, a named EU Representative under Article 27 for non-EU processors, documented legal bases for each processing activity, and a 30-day response window on data subject requests under Article 12. Liability for vendor non-compliance lands on the controller. Who must comply with DORA and what does it require for vendors? + DORA — the EU Digital Operational Resilience Act, effective 17 January 2025 — applies to EU financial entities and their ICT third-party providers. It requires pre-contractual third-party assessments, specific contractual clauses covering audit rights and incident notification, and ongoing monitoring. Financial entities remain fully responsible for regulatory obligations even when functions are outsourced. How do I verify a SOC 2 or ISO 27001 claim? + For SOC 2, request the actual audit report under NDA — confirm a named CPA firm, Type II designation, and a report date within the past 12 months. For ISO 27001, ask for the certificate number and accredited certification body, then verify it on iafcertsearch.org or certcheck.ukas.com. Verification takes under a minute. No number means no certificate. What is the difference between KYC and KYV? + KYC (Know Your Customer) is a regulated obligation for financial institutions — verify identity, screen against sanctions, monitor ongoing activity. KYV (Know Your Vendor) applies the same discipline to third parties you grant operational access to. KYC has a single regulator with subpoena power. KYV is enforced through a fragmented mosaic — GDPR, DORA, NIS2, CCPA — but the legal obligations are equally binding. ## Make vendor vetting a default, not a fire drill See how APIWORX approaches data handling, compliance, and audit rights — with documentation you can verify. [Let's Automate](/free-assessment) [Explore the Platform](/platform) [![APIWORX managed integrations logo](data:image/webp;base64,UklGRsgLAABXRUJQVlA4TLsLAAAvK4ENELenqG0jydwH+LzOXQICgiL/RxMQFP0fjYK2DZCTf8egNm0DBq9OuSP/2G/Q37ejAJ1AqjcM1Fdw92919gpEmoCICC9bABhDkj69e2xzbdu2bdvm7CTv3ZWa1OLmHiP678BtG0eSnb1+M9sz5QW0bmtb20aS2WFmxjIzt2FmZmZOTLL1t9/76Hnf77XXLM9tRP8lyrYbt81FutDZHkEQBCF/AZry9+/dXG202lBBlprli9vD8Rj+EcX2jjOUp0zrfAdBtyV8okdizTKT1r+A2xey7NqjPIX/AYg+KrnEn4Dos/gvMG1bj1Yez0s4MPkIRG/FPIJ3kp1Yhw7t99NsgS3mI2quY5iQ+CnBwXMueV6L3tO+308FMpKHcD7Avdy3IcbxfpAjIBP/9fQA9lYeohUAHuS+dOfCugmETDV6zwBg+tezG/Boy+Qh1sHQYwzjkj87csjRFyXPq9FnBlzp+Nu13R4t+ZSXvvJE2P4PcYzfA9GWNB/RpiT/RgPeHH/gT5005SU7BtEJqRctEvqz9M5sBCnz1YH5WqsgceSCelKjV1EajyWSgAs9b9ME1FF0LmdFsv2iazMgshdC9zEQJjBvY7+VFOlCrfaWuM2k9J2c7J0WtGxJLpghJTIXC4O/fg8uXbks44ERaVS4sfXRvz/7po+klGiSJ+pWClPLNXjhcmnoz4++yZ2EOh+LJurQ68PSTyBaN3dZp/iXmTYdK1/B5GXUg4hDQGlDBS6+llvMqv/eefTXeOYwnnoiXno4k60+pjD6css1kGj05P3zWAbZnWkTO6Dmh5E+UPNb4uBjqcUs0D6heCEz87S+RrCONFG8FSUkjMyjtAXEqjcgahKSk6rlJ2HXPAq3ko1GOxoqzBCyXcjn9o3PEi30J0X0BSSkGLWeiKZH5kot2Vr2ZeJBT8tHj/sw6Nox8R7X1jG5HK8Z65z9DstgBf0pk5caDbJKvThYQce9cg2c4uR7PTXFT7Rh5SRpb6JxeHZ5ZX60tcBGsrtDmtw1KsRqoWW0+gstiRe2UaH/d0YJPQM+GUixCS4Z2LM9yhym7ZvfMlv1gYjTaGmgn3hVGZdJ1oOYigdQkaA/GEa26kjFXisVUrERjVOs4hMdD82Wxp47SlaAMkdmhUs18A20fCfgvt1SWWheYsLSke5AgYeiQ9+ilH3ewDinD6rZ32MR8pkUvswXLS6KsIAteaqhjm/KcFFxobSwLzM6UiUQYNsyL7nLE/K4DASeoPIGy5ImV+AXXDIr0KWEbksx9OOSQ22Y0JjUwtgHQc1c0lmBm5hC7AVxqnb96FmSKHHUX4UO0IDLV/h1+8Gl9NVcD/dgnw6WPD7IzdqoxWxGvo/ZHg0urFc330/fd2MuOVcznSyCgrucGki1bYI9ZyGyFcCIcRnH+EVvXLGJsSGww2UcTM78CpGqYVGxKMwlPR7RwZbya0zQfNTEzsgjHQfobHE4Z3F6RD6DkmHyGOTJNyn1AepQS2Vcpps0NmDJ8ZtEh9YajmTLnMm7m4d2KeTBLuQhe6X5ThZzVqEntCzrS79DNR2uigw6d8PYKmqCVb2XslkxrAoIuQ7hz9k2RNEznNzP7HGfyhHzGqdwRgbTR8FQOQ8fGKzZVCJVAtQZexJXRVr8wh+2Dm8whnYMGOLrvcCdtwK+Q5jSmDQWA/wjbnNjgeP0ApG7rKF4BYt84eSx5zWPRr4AenlUGMxYUIVFjNJTRfliKxGrV8MOe63jBlJcoTAch39dqO3aXFOptwB5NMLSgNHuMZD6s4cOcT88y9ARKvisEtfwCXM8OiA7pKMSL4FvpLBuHSWaltgKUJhUQZ2gaZXT7jFIm7AxLnmwFku6Z0FnTVpTImCxmQNo3MZVjmPotKR04uqzWzxGYFhDNQo9fLcaNmwVv0hBGr2xb0by+RueTwLeFK/JgdpkgM9PPKVfA2OkIAn5InCjRlHKBdssj6JL0h4eezymMw7FuLHhe0jl+0IVuieOP9GxOpJh+SY1ZD3S6rIipsFlYynPujWwEtdkMHH1VnMAJerFq8yqvjvLZPbTqsiOfkzUZYLvcPXwmw7C6FpBGvla7sMewpo3VeRRlQH/RuFEcHV7GhNoLqCzqMBv0pLK7PAYgwZFloBRHR811Cidghtcyabt8QL1+byVuSeiTJXkwVVQ/QePDr9HJ6nYwNSTE2jRZnRltCTvYZFHt9HJ/x3MatD2N3Rc4ZGnJAMNpkjC47fk2l8Yw8Km9l/g7QibEcpLDfA1N2TqGDukpPQVYJA5zAvw2fINjOTsr2odp1n9Rb+k599VHtOSVHufiJKFWLiIf3XoWM/lX/0Wozaho9bsfa3hEQaArz5N+e2vOjo1FCRVLOPLWk79fHgE9WMMcOthtkKSnSQgUQCdG1fFGMZSTtgMCC+/1sxAa8+Y3bABHvqD2bk4oav+rEmFU6D6tkMV34FxLW4zDGOs4fOEN2Dh5vs4fAGyHphImFzgSsUrYC0XXJdYAvao4s/AFxgccw/aBTC1pFBOMUzmWsOareKHqqapAg5kFIE4R2ko5hYYlz54CwGL4Bem43pYQ6IQVu82BzhY0FU+Yz0RY8ROg6BeZFIp1mrbweaV/grSYakojqkzbVFKzV3I4ykmmWjc8Eae9+xmtyZ05dHBjnrcQDngG67NfgJ/WPm9jHWV9Ez7ueikw/bYx2WZNXPMLGrv7J/NxCuBd6SGoOcQfngPXXjijMCSpWFckhYmgTVZn5nbImAwByzYwBjRGV5pOzMSrl0QmUe2ukjFriLck6XMgpP13sRZgRbfnPG15xaepQY0QTBRbLiR0i1k/pmwsQL/ihGzYSKJeyv6kD1nYeksWbCNt0H/CZDHMDl8w9XdY3Nzk731cXJpdNCRgPs006Po/HpDJj8s0/fNgjMyqZesZehmQQrv5JA5ksbTHa9vx2LgYhSGVw1bhrUP/lDWsA1fnRDrUt8qI3YN8iERS8n0jXkrfn02b7oPS1V2YVAkS+r2UsZ8YI31oum0ED+D4Wz6sb73txx3p54t3AllAX0S5vCeJKYENXWqiPF/eRAmt85a6TXJrHFZV5E5wWkBGYWXQOSOxpkN0dp8BiCkcS5HvThgedfjRNRWgB70pTwf8gWp7juMp5KxnZ/4qq3v80ferd4lU4nz8TafhQxRVhwIbIo8hDlDBj8/Y2oKPqx7kzsbbWZXpfABZc0oKPRNG/ukTclHtH2gR2octXIykJTtQUNVZCj8oUlHzxWt372T51np+W2wsJCXkOXPNdT38C8vKAxbgr119fCuheqx21NG4NaUEx+jUDc5/xJlzV4Iu0pS4bvqF5RUSI7TCrTN0DN8TMzvGmk9Nr0YewKibuRpSvVcsvRCdw9N6B4avsmQEfNlR3d2zz/CnW3MiioLr1DW3ON7GxrlK81v3JjTRHM0amRlwpye874Ld2kseDFQSpS3S8y03Gjv7M57M8FBl7Llxofsm9aiAJlX3Ln/BhQ0nFHWZLB1FT03VAe43qEjOpJMrIxKyly3SLtiid5KMU38YkemYp9ChjcuDKb1/Q13pUrG7j4hUqC80VZkdNV3QULVBXjqM1A2liYlmtA1vkv9rgyr6tgJjZikzD3pPtBmpS54Fnh3Ir/99qeO/ZhA0zAcfsNNnjmKXpCz0B1hr5R9OHBNWa7N0zpgvlLADIbIxBaoUfYB3dMfNX4eL0/mjc36l57eLybOW2AWf8hou01gAztCVGFcVmKO8UfrutzCD+6Uemfdm/XxgYGJjTtTf0HXN4vvTQ/1jS6dO/Qftszt5uTQv9GF4yT9N6zf4KNaOkn1OmcXh303t1fxe5QV+duCH2bEJDPFH6O5a+Y+lf/AcFn+Bvs+qqTxWoAM+W8kLsPU87KWx9ESGH+UJHfMuQERSb3eyzBqwzwOYkDyPFPHrVn6ReICxPyO3k/bUJX8qqXORb7m7PkexOj46ePDXpcbFWRr2rx7upwr0jD/g4gW/RsuqFY09Dv4f7T/bJojj9aRvyEA)](/) Connect commerce, ERP, and operations into one canonical data layer with AI-powered reasoning. APIWORX LLC 1401 Lavaca Street Suite 241 Austin, TX 78701 [214-717-5900](tel:+12147175900) [](https://x.com/apiworx)[](https://www.linkedin.com/company/apiworx)[](https://www.facebook.com/apiworx)[](https://www.instagram.com/apiworx) Platform - [APIWORX Overview](/platform) - [apiworx.flow](/apiworx-flow) - [apiworx.data](/apiworx-data) - [apiworx.ai](/ai) - [apiworx.crew · Beta](/apiworx-crew) - [MCP](/mcp) - [Architecture](/architecture) Who We Help - [Ecommerce Leaders](/uses/ecommerce) - [Finance Teams](/use-cases/financial-integration) - [IT & Engineering](/architecture) - [Operations](/use-cases/operational-monitoring) - [Ecommerce Industry](/uses/ecommerce) - [Wholesale & Distribution](/uses/distribution) - [Manufacturing](/uses/manufacturing) - [B2B Suppliers](/supplier-portals) - [View All Solutions](/solutions) Popular Integrations - [NetSuite Integration](/integrations/netsuite) - [Sage Intacct Integration](/integrations/sage-intacct) - [QuickBooks Integration](/integrations/quickbooks) - [Acumatica Integration](/integrations/acumatica) - [Amazon Marketplace](/integrations/amazon-marketplace) - [Browse All Connectors](/connectors) Resources - [Blog](/blog) - [Guides & Playbooks](/resources) - [Documentation](https://app.apixx.io/docs) - [Developer Resources](/developers) - [Case Studies](/case-studies) - [Compare iPaaS](/compare) - [iPaaS Alternatives](/alternatives) - [Support Portal](https://portal.apiworx.com) Company - [About Us](/about) - [Services](/services) - [Team](/team) - [Security & Compliance](/security) - [Partner Program](/partners) - [Careers](/careers) - [Talk to an expert](/free-assessment) © 2026 APIWORX LLC. All rights reserved.  |  Last revised August 20, 2026 [Terms](/terms)[Privacy](/privacy)[DPA](/dpa) [![APIWORX Reviews](https://b.sf-syn.com/badge_img/3294515/dark-default?&variant_id=sf&r=https://operate-weave.lovable.app/blog/vendor-vetting)](https://sourceforge.net/software/product/APIWorx/?pk_campaign=badge&pk_source=vendor) ![APIWORX](/assets/apiworx-icon-BgcsCO2i.png)