Vendor Risk: What Happens to Your Data Once You Share It With Someone Else

Every small business shares sensitive data with someone outside itself: a payroll processor, an outside accountant, a billing tool, a document-signing service, a subcontractor. Each of those relationships extends your risk, whether or not anyone is tracking it that way. You do not need a formal program to get a handle on it, but you do need a list.

The question vendor risk actually asks

The question is not "do we trust this vendor?" Trust is not a control. The real question is: if this vendor has a breach, what of ours is exposed with it? The answer depends entirely on what you sent them, how long they keep it, and whether you remember. For firms covered by the FTC Safeguards Rule, which includes many tax preparers and accounting firms, overseeing service providers is part of the expected program, so this is not only good manners; see https://www.ftc.gov for the current text.

A lightweight approach

1. List who actually receives sensitive data. You do not need every vendor, only those handling Social Security numbers, health information, payment data or client financial records. Check your accounts payable list and your email contacts to catch the ones you forgot.
2. Write down what each one gets. "Payroll provider: employee names, SSNs, bank accounts." This one line is the foundation of everything else.
3. Ask each a short set of questions. How is data encrypted in transit and at rest? Who on their side can see it? Do they use sub-vendors? How would they tell you about a breach, and how quickly? What happens to your data when you leave?
4. Get it in writing. A contract or terms page should say how they protect data and notify you.
5. Minimize what you send. The same data-minimization habit that helps internally helps here. If a vendor needs a name and invoice amount, do not send the full client file.
6. Revisit on a schedule. Once a year, and whenever a vendor changes how it works or you change what you send.

Red flags worth noticing

• A vendor that cannot explain how it protects data in plain terms.
• No clear way to export or delete your data when the relationship ends.
• Requests for more data than the task needs.
• Sharing through personal email or chat rather than a secure channel.

The part most reviews miss

Vendor reviews usually focus on what you deliberately send through an approved channel. They rarely catch what accumulates informally: an email thread with an attachment, a spreadsheet a contractor was copied on once, a folder shared with a link and never closed. Picture a small insurance office that shares one client folder with a part-time contractor. Months after the project ends, the folder is still shared, and nobody remembers what is in it.

Knowing what sensitive data exists on your own systems is what lets you notice that. MyVaultMate scans local drives, synced OneDrive and Google Drive folders and external disks for Social Security numbers, ITINs, payment card numbers, labeled license, passport and date-of-birth values, health ID numbers and health-related keywords. A synced folder that you share with a vendor shows up in the findings if it holds those items, with the file path and a redacted sample. It does not see who a folder is shared with, does not track data once it has left your computers, and does not assess vendors themselves. It finds and ranks; deciding what to unshare, remove or move is up to you or your IT provider. Detection is rule-based, so occasional false alarms occur, and email read is limited to saved .eml and Outlook .msg files.

What to do this week

• Make the list of vendors that receive sensitive data and write the one-line "what they get" for each.
• Review your cloud sharing settings for folders shared outside the office, and close any no longer needed.
• Pick the vendor holding the most sensitive data and send them the short question set.

This is general education, not legal advice. You can see what a report looks like at /sample.