| name | s4h-ethics-vendor-review |
| description | Evaluate a third-party vendor, supplier, partner, or integration against ethical standards before signing a contract or shipping their code or service. Use when considering a new supplier, SaaS tool, data provider, API integration, outsourcing arrangement, or partnership. TRIGGERS: 'vet this vendor', 'is this supplier ok', 'ethics check on this partner', 'should we use this third party', any third-party evaluation where labour practices, data handling, business model, or alignment with values is a consideration. |
Ethics Vendor Vetting
Every supplier relationship is a values choice. When you integrate a vendor's service, you extend your ethical surface area — their data practices become partly yours, their labour conditions are part of your supply chain, their business model is something you're funding.
Most vendor decisions get evaluated on price, capability, and reliability. This vetting adds the dimension that gets skipped: who is this, actually, and is this the kind of organisation we want to be in relationship with?
It applies two lenses: virtue ethics (what does choosing this vendor say about who we are?) and justice/fairness (are the benefits of this relationship fairly distributed, or does it depend on someone else bearing a cost we don't see?).
Your Process
Step 1: Define the relationship
What is the vendor providing? What is the nature and depth of the dependency? How much leverage would they have once integrated? What data or access do they require?
Framing check: Confirm the specific vendor and relationship before continuing. State what you've identified — the vendor being evaluated, what they provide, and the nature of the integration — in one sentence, then use AskUserQuestion:
- Question: "I'm reading this as: [your one-sentence framing of the vendor, what they provide, and what kind of relationship is being considered]. Is that right?"
- Header: "Framing"
- Options:
- Yes — proceed — framing is correct
- Adjust — one element is off; user will correct it before you continue
- Reframe — different situation than read; incorporate the correction before proceeding
Step 2: Virtue Ethics Assessment — Character and Alignment
Virtue ethics asks: what does this choice say about us? Organisations, like people, express their character through who they choose to associate with.
Examine:
- Track record: Has this vendor been involved in significant ethical violations — data breaches, regulatory penalties, labour disputes, discriminatory practices, deceptive advertising?
- Business model: How do they actually make money? Is their model aligned with serving customers, or extracting value from them? Is there a misalignment between their incentives and ours?
- Values alignment: Do their stated values and observed practices align with ours? If our users knew we used this vendor, would they be comfortable with that?
- Transparency: Are they open about how they operate, who owns them, and how they handle the access we'd be granting them?
Step 3: Justice Assessment — Supply Chain and Structural Fairness
Justice asks: are the benefits of this arrangement fairly distributed, or is the pricing attractive because someone else is bearing an unacknowledged cost?
Examine:
- Labour practices: Where are people employed in connection with this vendor? Are those workers fairly compensated and treated? Is the pricing low because labour costs are being externalised to lower-wage jurisdictions or gig workers without protections?
- Data practices: Who benefits from the data generated by your use of their service? Are users whose data flows through this vendor aware of and consenting to that flow?
- Market power: Does integrating this vendor entrench monopolistic practices? Does it give disproportionate power to a player whose dominance is itself ethically questionable?
- Displacement: Does this integration displace workers or practices that served people fairly?
Step 4: Dependency and Exit Assessment
- How difficult is it to exit this relationship once established?
- What leverage do they gain over us once we're integrated?
- What happens to our users if this vendor changes terms, is acquired, or shuts down?
Human Check-in
Before proceeding, use the AskUserQuestion tool. State your interpretation of the situation in 1–2 sentences — what is being analyzed and what the core question is — then ask:
- Question: "My read: [your 1–2 sentence interpretation]. How do you want to proceed?"
- Header: "Scope"
- Options:
- Full analysis — Complete all steps, reasoning shown throughout
- Key findings only — Bottom-line output, skip step-by-step detail
- Red flags only — Specific concerns, skip domains that look clean
- Reframe — The read is off; correct it and the analysis will follow the corrected framing
Proceed based on their selection. If the user reframes, incorporate the correction before running any analysis.
Output Format
Vendor Being Vetted:
[Name, what they provide, depth of integration]
Virtue Ethics Assessment
| Dimension | Finding | Concern Level |
|---|
| Track record | [finding] | 🔴 / 🟡 / 🟢 |
| Business model alignment | [finding] | 🔴 / 🟡 / 🟢 |
| Values alignment | [finding] | 🔴 / 🟡 / 🟢 |
| Transparency | [finding] | 🔴 / 🟡 / 🟢 |
Justice Assessment
| Dimension | Finding | Concern Level |
|---|
| Labour practices | [finding] | 🔴 / 🟡 / 🟢 |
| Data practices | [finding] | 🔴 / 🟡 / 🟢 |
| Market power | [finding] | 🔴 / 🟡 / 🟢 |
| Displacement | [finding] | 🔴 / 🟡 / 🟢 |
Dependency Risk
[1–2 sentences: lock-in risk, exit difficulty, leverage they gain]
Verdict
[Proceed / Proceed with conditions / Do not proceed — and why]
Conditions or Mitigations
- [Specific contractual, technical, or procedural safeguard if proceeding with concerns]
Notes
This vetting is based on available information — it is not a guarantee. For high-value or high-trust integrations (e.g. a vendor receiving sensitive user data), request their SOC 2 report, data processing agreement, and subprocessor list before proceeding.
Where concerns are found but the business case is strong, name the trade-off explicitly rather than explaining it away. A conscious decision to proceed despite an ethical concern is better than a decision where the concern was never surfaced.
What's Next
After delivering this output, use AskUserQuestion to offer the next move:
- Question: "Vendor reviewed. What's next?"
- Header: "Next"
- Options:
/s4h-ethics-check — Run a full ethical check of the vendor relationship/s4h-decision-criteria-weighting — Weight vendor decision criteria on the ethical findings/s4h-ethics-data-audit — Audit the vendor's data practices- Done — Wrap up and synthesise what we have so far
