Trestec for technology
Technology firms build on cloud platforms, open source, sub-processors and other software suppliers, and their customers want proof that this chain is controlled. Trestec keeps that proof current.
Third party risk in technology
A software or managed service firm is both a supplier and a buyer. Customers in regulated sectors pass their own requirements down, while your service depends on hosting, identity, payments and support providers of your own.
Shared cloud infrastructure
Many software suppliers run on the same hosting and identity providers, so one outage reaches many services.
Software supply chain compromise
Attackers target build systems, updates and widely used tools to reach every customer at once.
Security evidence that lapses
SOC 2 reports, ISO 27001 certificates and penetration tests expire and go unchecked.
Sub-processors and AI use
Sub-processor changes and suppliers' use of AI on your data are hard to track without a record.
When a supplier fails
Publicly reported events that show how disruption travels through third parties.
December 2020
SolarWinds Orion
Attackers inserted malicious code into updates of SolarWinds' Orion software, reaching thousands of organisations including government departments.
May to June 2023
MOVEit Transfer
A flaw in the MOVEit file transfer product was exploited at scale. In the UK, staff data at several large employers was taken through their payroll provider.
July 2024
CrowdStrike
A faulty security software update crashed millions of Windows computers on 19 July 2024, showing how far a single supplier's change can reach.
Rules and expectations that apply
A summary of the main requirements, not legal advice. Confirm what applies to your firm with your advisers.
| Rule or expectation | What it asks of you |
|---|---|
| Customers' DORA obligations | EU financial entities must put Article 30 terms into ICT contracts and record their providers in a Register of Information, so ICT suppliers are asked for the matching evidence. |
| ISO 27001:2022 supplier controls | Annex A controls 5.19 to 5.23 cover supplier relationships, supplier agreements, the ICT supply chain, supplier monitoring and cloud services. |
| UK GDPR Article 28 | Processors may engage sub-processors only with the controller's authorisation, under written terms. |
| UK Cyber Security and Resilience Bill | A Bill before Parliament (introduced November 2025) that would extend UK network and information security rules to managed service providers, data centres and designated critical suppliers. |
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
Rule or expectation
What it asks of you
How Trestec helps
Due diligence portal
Collect SOC 2, ISO and penetration test evidence through guided requests, with AI screening and expiry checks.
Supply chain mapping
Record hosting providers and sub-processors behind each supplier and see shared dependencies.
Risk assessment and monitoring
Tiered reviews with named sign off, alerts on expiring evidence, and an AI exposure view of suppliers' model providers.
Contract analyser
Check security, sub-processing, audit and exit terms, including the DORA Article 30 markers your customers ask for.
Assess suppliers by what they support
- Tiering with your own versioned rules
- Guided assessments with reasons shown
- Expiring evidence raised as alerts
- AI exposure and model provider concentration
AI suggests and flags. A named person reviews the evidence and decides.
Materiality assessment · Harbour Data Centres
Outcome
Material Third Party
Trestec in technology: feature by feature
The same platform, applied to hosting, identity, payments and support providers, sub-processors and the software you build on.
Supplier register and tiering
Every hosting provider, software supplier, sub-processor and contractor in one record, with an owner, tags and a change history, tiered by your own rules.
In technology
Tag suppliers as infrastructure, sub-processor or tooling, and tier those that host customer data above internal productivity tools.
Nth parties from due diligence and contracts
Sub-processors and hosting providers named in due diligence answers or contracts are recorded behind each supplier.
In technology
A support platform you use names the hosting provider and sub-processors behind it; they appear in your supply chain view.
Concentration analysis
Reliance is measured by provider, country and type of service against thresholds you set, and the screen shows when one is crossed.
In technology
See how many of your suppliers run on the same hosting provider, so one outage is not a surprise.
Due diligence portal
Suppliers answer and upload by secure link and one-time code. AI screening runs on submission and flags gaps and expired evidence for a reviewer, and annual refreshes keep it current.
In technology
Collect SOC 2 reports, ISO 27001 certificates and penetration test summaries, with expiry dates checked.
Contract analyser and renewal alerts
Contracts are read for liability, termination, exit, renewal, sub-processing and other clauses, with each finding linked to the source text, and renewal dates raise alerts.
In technology
Check sub-processing, audit and exit terms in your hosting agreements before renewal comes round.
Risk assessment and AI exposure
Tiered assessments with named sign off, and an AI exposure view that records suppliers' model providers and shows concentration across them.
In technology
See which suppliers process your data with AI and whether many of them rely on the same model provider.
Important services and exit strategies
Link suppliers to the services you deliver, and Trestec raises a task when a supplier that needs an exit strategy has none.
In technology
Map the hosting, identity and payment providers behind your customer platform, and document how you would move off each one.
Reporting and exports
A weekly digest email counting new alerts, expiring contracts and open incidents, board report drafts saved to report history, and spreadsheet exports of supplier records.
In technology
Export your current supplier evidence to answer a customer's security questionnaire.
How it works for technology
Illustrative example. The company, suppliers and events are invented to show how the features fit together.
- 01
A customer asks about your supply chain
A prospective customer in financial services sends a questionnaire about your hosting providers, sub-processors and their security evidence.
- 02
The register answers the first questions
The supplier register and supply chain view show your hosting and sub-processor chain, with owners and tiers.
- 03
Lapsed evidence is found
One sub-processor's ISO 27001 certificate has expired. A due diligence refresh goes to it by secure link, and chasers follow it up.
- 04
Contract terms are checked
The contract analyser shows the sub-processing and audit terms in the agreement, linked to the clause text.
- 05
The answer is sent with evidence
Supplier records are exported as a spreadsheet for the response, and the open item is tracked until the new certificate is approved.
Talk to us about technology
See how Trestec would keep your supplier security evidence current.