Ethicaline is a firm dedicated to compliance and investigations. We built the TPRM platform out of our field practice: the conviction that assessing a third party also means knowing how to investigate when the risk demands it.
A fine understanding of regulatory frameworks, from Sapin II to the new Asian rules.
Real investigative know-how • fraud, corruption, beneficial owners, on-site verification.
A platform that industrializes the third-party program without diluting analytical rigour.
Most TPRM platforms stop at the questionnaire. Our origin as an investigation firm lets us go all the way through the risk: in-depth enquiry, documentary and on-site, is part of the offering.
Obligation to map risks and document the assessment of third parties (clients, suppliers, intermediaries) under the anti-corruption regime.
EU corporate sustainability due diligence: identifying, preventing and remediating harms along the value chain.
Supply-chain due-diligence act: risk analysis and corrective measures across suppliers.
Anti-corruption law with extraterritorial reach: due diligence on intermediaries and business partners.
DORA governs digital operational resilience for the financial sector.
Asia-Pacific is accelerating. Singapore's MAS is redefining third-party risk, Australia's APRA imposes a DORA-comparable framework, and China is overhauling its supply-chain rules. A program that was adequate three years ago now has gaps.
Issued March 2026, they supersede the old outsourcing rules and extend expectations to all third-party arrangements: register, governance, full lifecycle and sub-contractors.
Operational-risk standard in force since July 2025 (material-provider contract compliance due by July 2026). Monitoring and continuity of critical providers.
Decrees 834 and 835 (2026) govern information gathering and due diligence. China also concentrates most FCPA actions and requires China-specific supplier verification.
Strengthened expectations on operational resilience and provider management for financial institutions.
Growing expectations on operational resilience, third-party risk and technology risk.
Business responsibility and sustainability reporting obligations, including the value chain, aligned with global standards.
This summary is provided for general information only and does not constitute legal advice. Applicable obligations depend on your situation: we recommend confirming your scope with your counsel.
Ethicaline TPRM handles sensitive third-party data. Data protection isn't a feature we bolted on • it's how the platform was built.
The platform's technologies and components are chosen, by design, to be hosted within the European Union • in France and Germany. Your data resides in the EU.
Privacy is an architectural decision, not a policy afterthought. We collect only the data needed to run assessments, and keep personal data minimal and purposeful.
The platform is built to align with GDPR from the ground up • EU data residency, data minimization, and controlled access as founding principles.
Access to the platform is authenticated, with role-based permissions that ensure users see only the data appropriate to their role.
Ethicaline TPRM is deployed on infrastructure hosted within the European Union • in France and Germany • selected specifically for European data-protection expectations.
The underlying infrastructure providers maintain recognized, independently-audited security and privacy certifications, and data processing agreements aligned with GDPR are in place across the technologies used:
These certifications are maintained by the infrastructure providers on which the platform is built, and are independently audited. Sources: Cloudflare Trust Hub, Supabase Security, Fly.io Compliance. Certification scope is that of each provider; Ethicaline inherits these controls through its use of their EU-region services.
We keep this presentation deliberately high-level. The full detail of our architecture, hosting locations, sub-processors, certifications and data-processing terms is available in our GDPR documentation on request • contact us for the complete pack.
This site uses privacy-first, cookieless analytics and sets no tracking or marketing cookies. Privacy & Cookies