3 things Vancouver importers should check in a vendor security review

What to take away

This guide uses Canadian rules as a worked example. The same three checks apply to any small business, including firms in the United States.

The site covers small business cybersecurity basics. Treat this as a vendor security review template. Swap in your own state privacy and breach rules, your contract terms, and your risk tolerance. Map data, set a notice clock, and collect evidence before you sign.

This article uses Vancouver importers as a worked example, but the three checks are general small business cybersecurity basics. They apply to any small business in the United States that shares data with a supplier.

Use the import case to see the basics in action. Then swap in your own state privacy and breach rules. Map your data, set a notice clock, and collect evidence before you sign.

Check one: where the supplier stores and moves your data

Start with a map. Ask the supplier to name every country where your data is stored, processed, backed up and supported. For a small business importer, the answer usually includes the United States, sometimes the Philippines or India for support desks.

Data transfer terms matter because moving personal information across borders does not move your legal responsibility. Under privacy law, your business remains accountable for personal data a supplier holds on your behalf. The Office of the Privacy Commissioner of Canada (OPC) publishes guidance for businesses on that accountability, and in British Columbia the Office of the Information and Privacy Commissioner for BC (OIPC BC) oversees the province's private-sector privacy law.

Write the transfer terms into the contract. Name the countries, the cloud regions, and the subprocessors allowed to touch your data. Require notice before any new country or subprocessor is added. If the supplier cannot name its subprocessors, treat that as a finding, not a detail.

Keep that map beside the signed contract. When the supplier adds a service six months later, the map tells you within minutes which personal information is now in scope. Without it, you are guessing.

Questions that surface the real answer

Ask where backups live, not just primary storage. Ask who can access the data and from where. Ask what happens if a subprocessor changes its own hosting region without telling anyone.

For a trade firm, the data may include customer names, addresses, payment details and customs broker records filed through the Canada Border Services Agency (CBSA). For a tech firm, it may include source code and user analytics. Both are worth mapping before you sign.

Run this as part of a wider vendor risk assessment so the data map sits beside your other supplier questions.

Check two: the supplier's breach notification duties and timelines

Breach notification duties are where contracts often go quiet. A supplier may promise to tell you about a breach, but say nothing about how fast, in what form, or what happens if it delays.

Privacy law sets the floor, not the ceiling. For example, PIPEDA requires organizations to report certain breaches of security safeguards to the OPC and to notify affected individuals when there is a real risk of significant harm. British Columbia has its own private-sector privacy law, the Personal Information Protection Act (PIPA BC), which also requires organizations to report breaches to the OIPC BC and to notify affected individuals when there is a real risk of significant harm. Your supplier's contract should meet that standard and go further for your business.

Set a clock. Ask for notification within 24 to 72 hours of the supplier confirming an incident. Require a written notice that names the data involved, the number of affected records, the cause, and the containment steps taken.

Keep the clause short enough to actually use. A notification duty buried in a 40-page supplier agreement gets found by lawyers, not by the person holding the alert at 2 a.m. on a Saturday.

What the notice must contain

A useful notice tells you what happened, when it was discovered, what data was exposed, what the supplier has done, and who to contact. Without those five items, your own incident response team starts from zero.

Add a duty to cooperate. The supplier should provide logs, forensic reports and staff time during your investigation. If the supplier refuses, you carry the cost of proving what happened.

Check the supplier's own reporting duties. A Canadian supplier may also face provincial privacy rules: a Quebec supplier falls under Law 25, which has its own breach and privacy obligations, and a British Columbia supplier answers to PIPA BC and the OIPC BC.

Check three: the evidence to request before you sign

Evidence beats assurances. A supplier that says it is secure should be able to show documents that support the claim. Ask for them before signing, and keep them on file.

Use a checklist so nothing gets skipped when a sales team is pushing for a signature.

Ask for these documents by name, and keep the dated copies with the contract:

Evidence also dates quickly. Note the date you received each document and the version number, so a later review can show what changed and when the change was disclosed to you.

Steps to run the evidence review

For cloud services, the evidence should cover shared responsibility. Ask which controls sit with the supplier and which sit with you. This is a common gap in cloud security reviews, and it decides who patches what.

Access is the other half. Ask how the supplier manages identity and access for its own staff, and whether it supports multi-factor authentication on your account.

Red flags in a trade or tech supplier review

Some answers should stop a deal or trigger a deeper look. A supplier that cannot name its data centres is a red flag. So is one that refuses to sign a breach notification clause with a timeline.

Watch for contracts that let the supplier change subprocessors without notice. Watch for audit reports that are more than 18 months old, or that exclude the service you are buying.

A supplier that treats the request as an insult is also telling you something. Vendors with real security programs keep these documents ready, because every other customer asks for the same pack.

For importers, tariff and trade uncertainty adds pressure to cut costs, and that pressure often lands first on the security clause. Do not let it win. A cheap supplier that loses your customs data costs more than the licence fee.

Check whether the supplier has a privacy contact. If all privacy requests route to a foreign inbox, your customers' requests may stall. Use a privacy compliance checklist to test how the supplier's practices line up with your own duties.

Small firms without a security team can turn to Small Business BC for advisory support on supplier and vendor reviews. The OIPC BC publishes guidance for BC organizations on how personal information must be handled, which is useful when you test a supplier's records practices.

If the supplier is based in British Columbia, check the OIPC BC for breach reports and investigation findings under PIPA BC. A clean record is not proof of security, but a pattern of complaints is a warning.

A quick worked example

A small business importer signs a logistics platform hosted in the United States, with support staff in the Philippines. The contract names no subprocessors and sets no breach timeline.

Six months later, the platform reports a breach affecting customs records. The importer learns about it from a customer, not the supplier. Notification arrives four days after the supplier knew.

With a proper review, the importer would have had a named subprocessor list, a 48-hour notice clause, and a security contact. The cost of adding those terms before signing is small. The cost after a breach is not.

Common questions