> For the complete documentation index, see [llms.txt](https://docs.didge.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.didge.io/home/corporate/corporate/governance-and-compliance/third-party-platforms.md).
# Third-Party Platforms
MFC Safe Pty Ltd
Third-Party Platform Compliance Policy
***
1\. Policy Overview
MFC Safe relies on a secure and resilient software infrastructure composed of trusted third-party platforms. This policy defines our compliance standards, selection criteria, and verification methods for all integrated service providers used in the Didge platform and broader digital ecosystem.
***
2\. Policy Statement
MFC Safe mandates that all core third-party service providers supporting our platform operations must meet internationally recognized standards for information security, privacy, availability, and data integrity.
Minimum Requirements:
• Must hold valid and current ISO/IEC 27001 certification (Information Security Management System – ISMS).
• Must provide independent validation of security practices via public or client-accessible certification reports (e.g. SOC 2, ISO 27701, ISO 27017, ISO 9001).
• Must support advanced technical controls aligned with MFC Safe’s security model (e.g. data encryption, audit logs, disaster recovery, and access control).
***
3\. Core Third-Party Platforms in Use
| Amazon Web Services | ISO 9001, ISO 27001, ISO 27017, ISO 27018, ISO 27701 | DOOS encryption, IAM controls, VPC isolation, audit logging |
| ------------------- | ---------------------------------------------------- | ------------------------------------------------------------ |
| MongoDB, Inc. | ISO 9001, ISO 27001 | Daily backups, TLS encryption, replica sets, IP whitelisting |
| GitHub | ISO 27001 | SSO, repo-level permissions, secure code scanning |
| Cloudflare | ISO 27001 | WAF, DDoS protection, TLS termination, edge cache security |
| Sentry | ISO 27001 | Encrypted event storage, RBAC, alerting |
| Auth0 | ISO 27001, ISO 27017, ISO 27018 | MFA, user role management, token encryption |
| Google LLC | ISO 9001, ISO 27001 | Endpoint security, app engine isolation, data residency |
| OpenAI | SOC 3 | Data confidentiality, service-level security controls |
| Twilio, Mailgun | ISO 27001, ISO 27701 | Secure messaging, API traffic controls, GDPR compliance |
***
4\. Compliance Verification Matrix
| Policy Area | Purpose | Assessment Criteria | Demonstrated Evidence / Controls |
| --------------------------- | ---------------------------------------------------- | ------------------------------------------------------------------------------- | -------------------------------------------------- |
| Information Security (ISMS) | Protect platform and client data | ISO/IEC 27001 Certification, access controls, encryption in transit and at rest | AWS, MongoDB, Google Cloud, Auth0, Mailgun, Sentry |
| Privacy Controls (PII/PIMS) | Align with GDPR, PDPA, privacy frameworks | ISO 27701, data minimization, deletion protocols | Auth0, Mailgun, OpenAI, AWS Privacy docs |
| Cloud Security (ISMS ext.) | Secure SaaS operations & infrastructure | ISO 27017, SOC 2, cloud audit tools, VPC, MFA | AWS, Cloudflare, Google Cloud, Sentry |
| Quality Management | Align operations with QMS and incident response | ISO 9001, CI/CD traceability, change control | AWS, MongoDB, Google, GitHub |
| Encryption & Backups | Secure critical platform data | Daily/weekly backup policies, TLS, encryption-at-rest | MongoDB backups, AWS DOOS, Cloudflare cache TLS |
| Vendor Certification Status | Standardized vendor selection | Vendor must be ISO 27001 certified or equivalent | Included in onboarding/vendor due diligence |
| Third-Party Risk Controls | Validate that vendor meets baseline security posture | Publicly listed certifications, policy documents, DR policy, audit history | Supplier-provided certificates (see links) |
***
5\. Certification Registry Reference
All certificates are logged and verified. Refer to attached registry \[Third-Party Certification Matrix] for:
• Certificate type (e.g. ISO/IEC 27001:2022)
• Supplier name and compliance category
• Expiry date and verification link
***
6\. Policy Enforcement
This policy is reviewed annually. Any third-party found non-compliant may be flagged for reassessment, migration, or deprecation. New vendors are screened against these criteria before platform integration.
Non-negotiable clause:
> MFC Safe requires that any core infrastructure partner must be certified under ISO/IEC 27001:2013 or later.
***
7\. Document Control
Owner: Technology Director, MFC Safe Pty Ltd
Effective Date: 2 April 2025
Next Review Date: 2 April 2026
Version: 1.0
***
End of Policy
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.didge.io/home/corporate/corporate/governance-and-compliance/third-party-platforms.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.