A vendor change, from a phone photo to a signed-off decision
Harbor Ledger, the sample company you can click through, wants to move its database backups to Brookvale Backup. Here is what happens between someone photographing page 4 of the contract and Dana Reyes signing off.
Someone sends a photo of the contract page
An engineer photographs page 4 of Brookvale's data processing addendum and sends it to @Kanonik in the team chat, with the question everyone has: does this break anything we've promised?
Kanonik pulls out the facts that matter
Three facts, each with its page and clause: backups are kept for 14 days (4.2), they're stored in the United States (4.3), and Brookvale gives 10 days' notice of a new sub-processor (4.5). Each carries the photo's fingerprint, so the record shows which page it came from.
The owner approves them through a signed link
Dana Reyes owns vendor promises. She gets a signed approval link, opens it in the Kanonik app and approves the three facts there. Nothing typed in a chat counts as approval, and the AI never approves anything.
The facts go on the record
Each approved fact becomes a line in Harbor Ledger's record. Lines are only ever added, each one links to the line before it, and the record shows who approved it and when.
The record answers, and warns
The same lines answer a Brightwater Payments questionnaire, give the auditor a vendor-agreement line, and feed Foresight. Foresight compares the move with what Harbor Ledger has promised and finds three conflicts: backups kept 30 days, customer data in the EU and 30 days' notice of a new sub-processor. Page 4 says nothing about training AI models, so that promise needs more information. The change waits for Dana's sign-off.
Pulled from page 4
- Backup retention14 daysPage 4, clause 4.2 3f9ac21e
- Where backups are storedUnited StatesPage 4, clause 4.3 3f9ac21e
- Notice of new sub-processors10 daysPage 4, clause 4.5 3f9ac21e
Signed approval link sent to Dana Reyes
Approved by Dana Reyesthrough the signed link, 30 Sep 2026, 14:32
The record, Harbor Ledgerappend-only
- 0411Ferrow Card Services: SOC 2 Type II report on file5d1f
- 0412Brookvale Backup keeps backups for 14 dayse7c3after 5d1f
- 0413Brookvale Backup stores backups in the United States2a60after e7c3
- 0414Brookvale Backup gives 10 days' notice of new sub-processors9b18after 2a60
Brightwater Payments questionnaire
Is there a DPA with each sub-processor?
Yes, signed. Brookvale Backup: lines 0412 to 0414.
SOC 2 Type I, Shah Assurance
Vendor agreements: Brookvale Backup DPA, approved by Dana Reyes, 30 Sep.
Foresight checkMove database backups to Brookvale Backup
- Backups are kept for 30 daysConflict
- Customer data stays in the EUConflict
- Customers get 30 days' notice of a new sub-processorConflict
- Customer data is never used to train AI modelsNeeds information
You can watch an approval in the app on How it works.
Try it on your next vendor change.
Solo is $99 a month and starts with a 14-day trial.