Supplier documents
Supplier pack for procurement reviews
What a buyer’s procurement, security, privacy or quality team usually asks a software supplier for: what you can read here today, and what we send on request.
Request documentsLast updated: 12 October 2026
1. How to request documents
E-mail admin@yardtwin.com with the documents you need, or send us your supplier questionnaire. The Data Processing Agreement comes from our data-protection contact, dpo@yardtwin.com. Documents marked “Public” are linked below and need no request.
2. Contracts and data protection
| Document | What it covers | How to get it |
|---|---|---|
| Terms of Service | The subscription terms, including the availability commitment (section 8) and how changes are notified. | Public: Terms of Service |
| Data Processing Agreement | The GDPR Article 28 processor terms: instructions, security measures, sub-processors, breach notification, deletion and audit. The current version is on the DPA page; a signable edition is being finalised. | Review copy on request from dpo@yardtwin.com · DPA page |
| Sub-processor list | Who may process customer data, for what, where, and the transfer safeguard; how customers are told about changes. | Public: Sub-processors |
| Service Level Agreement | Monthly availability commitment on paid plans, service credits, recovery targets and support response targets. | Public: SLA |
| Privacy policy | How YARDtwin handles personal data, retention and data-subject rights. | Public: Privacy policy |
3. Security and continuity
| Document | What it covers | How to get it |
|---|---|---|
| Security overview | Hosting, encryption, access control, testing status, availability and the compliance position. | Public: Security |
| Vendor Assurance Pack v1.2 | A questionnaire-style summary of controls for supplier assessments. | Public: download the PDF · or on request from admin@yardtwin.com |
| Business continuity summary | How the service and its data are recovered after an outage. The recovery targets and backup facts are public on the SLA page. | On request from admin@yardtwin.com · SLA: backup and continuity |
| Incident notification commitments | An initial notice within 24 hours of a confirmed security incident affecting your data. Personal-data breaches are notified without undue delay and within 48 hours of our becoming aware of them. | Stated here and in section 8 of the DPA page |
| ISO 27001 status | Certification programme under way; certificate targeted Q1 2027. | Public: Security |
4. Quality and AI
| Document | What it covers | How to get it |
|---|---|---|
| Quality Agreement template | For GxP customers: how responsibilities are split between the regulated customer and YARDtwin as the supplier of a computerised system. | Being finalised — on request from admin@yardtwin.com |
| AI use policy and EU AI Act position | How AI features are used and controlled in YARDtwin, and how they are classified under the EU AI Act. | Being finalised — on request from admin@yardtwin.com |
5. Ethics and compliance policies
Being finalised — available on request:
- Code of conduct
- Anti-bribery and corruption policy
- Modern slavery statement
- Sanctions and export controls policy
- Speak-up (whistleblowing) policy
- Environmental policy
- Health and safety policy for site visits
On request from admin@yardtwin.com
6. Company and insurance
| Document | What it covers | How to get it |
|---|---|---|
| Company registration details | The details you need to set YARDtwin up as a supplier. | Being finalised — available on request |
| Insurance certificates | Professional indemnity and public liability cover are being arranged; cyber cover is arranged at the limits a customer’s contract requires. Certificates are provided before contract signature. | Being arranged — on request from admin@yardtwin.com |