Your vendor file on BestPair

Your compliance team has to run a vendor file on us whatever we do. Ours follows CFPB Bulletin 2016-02, so you can lift it into your process. Ask [email protected] for any item.

1. Due diligence. Vendor kit: W-9, bank verification letter and billing details. SOC 2 Type 1 report, completed May 2026, under NDA.
2. Policies, procedures, controls and training. Security controls and compliance status are in the BestPair Security Pack. Tell us what your review needs.
3. Contract compliance terms. One Adobe Acrobat Sign signature accepts the Order Form, Standard Terms and Data Processing Addendum, plus a Business Associate Agreement if you work healthcare accounts.
4. Ongoing monitoring. A SOC 2 Type 2 report is shared under NDA once issued. Every invoice carries a results statement.
5. Action on problems. In Stage 2's first 90 days you can end it on 30 days' written notice. Ask us for the incident response and notification terms and we'll point you to the clause that sets them.

For your risk rating: BestPair never contacts consumers, and we never ask for consumer names, Social Security numbers, phone numbers, email or street addresses, or bank details.