Topic starter
10/06/2026 10:34 pm
TL;DR: Claims about ownership, Russia ties, data transfer, and disclosure are false, while pointing to its Trust Center, UBO filings, and public corporate records as evidence of transparency and compliance, according to SumSub. For IAM and security teams, the broader issue is not the vendor dispute itself, but how quickly trust, ownership, and data-location assumptions become governance questions.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Statement Addressing False Allegations Circulating About Sumsub”.
Key questions
Q: How should security teams verify vendor transparency before granting access?
A: Security teams should verify ownership records, data residency claims, subprocessors, and independent attestations before granting access to sensitive workflows.
Q: What breaks when vendor ownership information is incomplete?
A: When ownership information is incomplete, accountability becomes difficult to prove and the buyer cannot reliably assess who controls the supplier.
Q: Why do data residency claims matter in third-party risk reviews?
A: Data residency claims determine where personal or regulated data can be stored, processed, and accessed, which affects legal exposure and operational control.
Practitioner guidance
- Validate corporate ownership records Check UBO, PSC, and shareholder filings against the vendor’s declared control structure before approving access to regulated data or workflows.
- Review data residency and subprocessors Confirm where end-user data is processed, which regions host it, and which subprocessors are in scope before signature and at renewal.
- Treat trust centres as evidence sources Use the Trust Center, SOC 2 materials, PCI DSS attestations, and restricted documentation as evidence inputs, then test whether they match contractual commitments.
Bottom line: Vendor due diligence becomes an identity and data-governance problem when a supplier handles sensitive information for regulated workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 2:39 am
Vendor transparency is a governance control, not a communications function. When a supplier handles identity-adjacent or other sensitive data, its ownership structure, operating jurisdiction, and disclosure record become part of the risk posture. Security teams that treat these as reputational issues miss the control point entirely. The practitioner conclusion is that due diligence must test evidence quality, not narrative confidence.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which shows how quickly supplier opacity becomes an identity governance problem when delegated access is involved.
A question worth separating out:
Q: Who should own vendor transparency decisions when allegations arise?
A: Procurement, legal, security, and risk owners should share the decision, because transparency disputes are both contractual and operational. The key is to define who can pause onboarding, who can demand evidence, and who can approve exceptions before the supplier becomes embedded in sensitive workflows.
👉 Read our full editorial: Sumsub’s transparency rebuttal shows the governance gap in vendor due diligence
12/06/2026 4:13 am
Vendor transparency is now an identity governance issue, not a brand issue. When a supplier handles sensitive information, the due diligence record becomes part of the control environment that governs access, trust, and data sharing. The practical implication is that procurement evidence, corporate filings, and security attestations need to be evaluated together, not as separate workstreams.
A question worth separating out:
Q: How do trust centres fit into vendor due diligence?
A: Trust centres are useful evidence repositories, but they are not substitutes for independent validation. Teams should use them to collect certifications, security controls, and disclosure artefacts, then compare those materials with corporate records, contractual terms, and ongoing monitoring requirements.
👉 Read our full editorial: Sumsub’s transparency rebuttal shows the governance gap in vendor due diligence
This post was modified 1 day ago by NHI Mgmt Group