Outsourcing data sheet
This is what a third-party risk register asks for, in the order it asks.
- Contracting entity
- You contract with Obscurity Ltd, an Irish company trading as ConsentMark.
- Company registration
- Its Companies Registration Office number is 622475.
- VAT number
- Its VAT number is IE3526981EH, checkable on the European Commission VIES service.
- Registered office
- 60 Merrion Square South, Dublin 2, D02 HE24, Ireland.
- ICT service type
- Measurement and reporting on what a client's public websites send to third parties, and advisory work on the controls around it. We hold no client production system. The engagement scope identifies any client analytics data we access and the controls that apply to it. Whether the service supports a critical or important function is the financial entity's own classification.
- Subcontracting chain
- Every sub-processor is named in section 6 of the ConsentMark privacy policy, with what it does and where the data sits.
- Substitutability
- The evidence is yours and leaves in an open format, and the scoring methodology every grade was issued under is published, versioned and dated on the product site. A successor reads the record without us.
- Audit and access rights
- You may ask for the information needed to demonstrate compliance with the Data Processing Agreement once a calendar year on 30 days' notice, and we contribute to audits and inspections you or an auditor you mandate carry out. An audit with reasonable cause is not held to that cadence. You bear your own costs; where an audit finds a material deficiency, we bear the cost of the follow-up that verifies the remediation.
- Business continuity
- Recovery objectives are eight hours to restore service and twenty-four hours of data, both set to what the quarterly restore test demonstrates rather than to a target. The infrastructure is defined as code and the operating procedures are written down, and the handover material for your engagement sits in your own repository.
- Exit lead time
- Your exit pack is the copy you keep. You build it yourself from the reports page, in an open format, and it verifies offline with the script it carries. The pack's link expires after 30 days, and the pack can be rebuilt. Deletion is confirmed in writing.
- Where the data sits
- Client scan data is processed and stored in AWS in Dublin, Ireland (eu-west-1). Correspondence is handled in Google Workspace.
Where the detail is
The ConsentMark privacy policy carries the sub-processor list and the retention windows. The ConsentMark security page carries the incident and disclosure route and the assurance position. Anything not answered on these pages goes to contact@obscurity.ie.