Outsourcing data sheet
This is what a third-party risk register asks for, in the order it asks.
- Contracting entity
- You contract with Obscurity Ltd, an Irish company trading as ConsentMark.
- Company registration
- Its Companies Registration Office number is 622475.
- VAT number
- Its VAT number is IE3526981EH, checkable on the European Commission VIES service.
- Registered office
- 71 Lower Baggot Street, Dublin 2, D02 P593, Ireland.
- Legal Entity Identifier
- Registration in progress. The code goes here when it is issued.
- ICT service type
- Measurement and reporting on what a client's public websites send to third parties, and advisory work on the controls around it. We hold no client production system and process no data about your customers - no payment, policy or account data. Whether the service supports a critical or important function is the financial entity's own classification.
- Subcontracting chain
- Every sub-processor is named on the ConsentMark security page, with what it does and where the data sits.
- Substitutability
- The evidence is yours and leaves in an open format, and the scoring methodology every grade was issued under is published, versioned and dated on the product site. A successor reads the record without us.
- Audit and access rights
- You may ask for the information needed to demonstrate compliance with the Data Processing Agreement once a calendar year on 30 days' notice, and we contribute to audits and inspections you or an auditor you mandate carry out. An audit with reasonable cause is not held to that cadence. You bear your own costs; where an audit finds a material deficiency, we bear the cost of the follow-up that verifies the remediation.
- Business continuity
- Recovery objectives are eight hours to restore service and twenty-four hours of data, both set to what the quarterly restore test demonstrates rather than to a target. The infrastructure is defined as code and the operating procedures are written down, and the handover material for your engagement sits in your own repository.
- Exit lead time
- On termination, evidence is returned in an open format within 90 days, or deleted at your choice.
- Where the data sits
- Client scan data is processed and stored in AWS in Dublin, Ireland (eu-west-1). Correspondence is handled in Google Workspace.
Where the detail is
The ConsentMark security page carries the sub-processor list, the retention windows, the incident and disclosure route, and the assurance position. Anything not answered on either page goes to contact@obscurity.ie.