Sourcegraph Procurement Policy

Request for Quotes Process

Sourcegraph employees must request competitive quotes, in writing, as far as practicable, as presented in table 2 below.

The number of quotes sought can be restricted to less than the required number if there are legitimate reasons for limiting the number of suppliers. Such reasons might include:

• only a limited number of suppliers with the capability, experience and suitability to meet the procurement requirement
• the need for compatibility with existing equipment or services
• absence of competition due to technical reasons (e.g. exclusivity, proprietary information)
• the cost of changeover is prohibitive
• an unsolicited proposal with very advantageous conditions and appropriate approval
• time sensitive

The justification for limiting the number of suppliers must be communicated via email to ap@sourcegraph.com.

Sourcegraph employees should also inquire as to whether customer references / testimonials are available for items of expenditure greater than $10,000.

NDAs (Vendors)

The best practice is to share and sign our NDA with every vendor when you begin conversations and before you disclose confidential business information. Once you have a fully signed NDA, save a copy in our NDA folder as Vendor Name-NDA-Year-Month-Day. For NDA signatory authority, see our contract review and signature authority policy.

Is a DPA required?

If the vendor will receive any personal data from us, ask for the vendor’s DPA. Personal data includes any teammate personal data (including account login email/pw, addresses, DOB, etc.) and any customer content (such as sourcecode metadata, which contains usernames and emails). If the vendor is a SaaS solution, then yes, we need a DPA.

Commercial Negotiations

The table below highlights different commercial terms of a procurement negotiation, in order of importance to Sourcegraph. Buyers are encouraged to consult with the Finance team if they require support during commercial negotiations with suppliers.

When should I use this process?

Airbase will guide you through the required fields and approval necessary depending on your purchase inputs. Before creating an Airbase request, take a look at the table below to determine if this is needed.

• If cost = 0 and classification is PUBLIC or INTERNAL -> no ticket needs to be raised
• If cost = 0 and classification is PRIVATE or RESTRICTED but LOCALLY* -> no ticket needs to be raised
• If cost = 0 and classification is PRIVATE or RESTRICTED but ONLINE* -> raise a ticket
• If cost >0 and classification is PUBLIC or INTERNAL or PRIVATE or RESTRICTED -> raise a ticket

*Locally - meaning the data is not leaving your laptop (for instance text editor)

*Online - data is shared with 3rd party (browser extensions that access private or restricted data and are shared back with the service provider)

What counts as a vendor?

We categorize our vendors into the following groups:

• Software: this can be SaaS or non-SaaS products

• Services: Consulting services; any company that is commissioned to perform knowledge enhancing project-based work for Sourcegraph. Examples of this include any work that concludes with a report issued to the company, product development work, training development, sales & marketing projects and regulatory consulting work.

• Temporary contractors : Individuals that have been contracted for a limited amount of time to enhance/assist/deliver project base work (they are a separate group since their access level to data will most likely be different to a ‘Service’ engagement)

How do I submit a request in Airbase?

You can find a how to video here and for existing vendors missing a PO here.

Step 1: Visit Airbase

• Click “Request Purchase” from your dashboard and in the dropdown select “Purchase”

Step 2: Enter your Purchase Request Details (note these may change order depending on input details in 01. and .02)

1. Primary Information: Select your type of purchase category

• Software Subscription
• Individual (i.e. a single ChatGPT subscription for yourself)
• Org Level New
• Org Level Renewal
• Hire a Contractor (temporary contractor)
• Sales/Marketing events (sponsorships, event space, etc)
• Hardware (computers, servers, peripherals)

2. Vendor and Budget Details

• Vendor name
• Description of services
• Vendor website
• TCV (total contract value) of goods or services being purchased
• Attach a copy of the MSA, Order form/SOW that has the amounts included

3. Data Classification

• Select the correct data management security which will route to Security team for review depending on answer.

4. Has this vendor gone through JIRA review previously?

• If yes is selected, the request will move directly to Manager and Finance approval (and Exec approval if over 50K USD). Please only select this option if you have previously
  completed a full vendor review in JIRA.
• If no is selected, process will continue as normal.

5. Contractor Prerequisite Questions (applicable only if requesting a temporary contractor)
6. Save and next step!

Step 3: Notification that your manager will be sent your request for approval.

Step 4: Budget approval

Step 5: Legal review questions (if applicable, review happens in tandem with TechOps and Security reviews)

Step 6: TechOps review questions (if applicable, review happens in tandem with Legal and Security reviews)

Step 7: Security review questions (if applicable, review happens in tandem with TechOps and Legal reviews)

Step 8: Notification that your exec lead will be sent your request for approval if the amount is greater than or equal to 50K.

Step 9: Select how you want to pay your vendor

• If the vendor will be sending us an invoice rather than you paying for this on a virual credit card, please select “Purchase Order” or if you have already completed the vendor review and Finance has requested you enter a PO.3
• Services start/end date - this would be the start/end of your software or contractor services
• Select spend categories (i.e. Software, Consultants and other Professional Services, Events)
• Update cost center if applicable. This will default to the requestors cost center.

Step 10: Submit for approval!

You can watch the linked Loom videos for additional help/clarification or reach out in #discuss-finance.

SLA

Requests are approved within 10 business days. Please ensure you are requesting your spend as soon as you decide on a vendor. You can view the progress of your request at anytime in Airbase under “Requests”.

What are the reviewers looking for?

Security

• What type of information is being shared with the vendor: customer data, sourcegraph data, both?
• Security compliance certifications like ISO27001 or SOC 2.
• Encryption standards of data at rest and in transit (transport layer security).
• Clear measures around confidentiality, integrity, availability, and resilience of processing systems and services.
• Clear process in case of a security incident and the reporting to Sourcegraph.
• Ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.
• Periodic testing on security, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

Legal

• MSA, DPA, Order form or SOW
• Review when annual spend is over $100,000, or annual spend is over $1,000 and vendor receives (a) customer data or (b) teammate personal data
• Typical customer data includes customer source code, repo names, support tickets, customer logs, incident data, etc.
• Typical teammate personal data includes login information, username, email, name, address, etc.

TechOps

• Okta provisioning and/or SAML available?
• If no, how is access protected

Finance/Budget

• Amount
• Contract and Commercial Terms

System/Relationship Owner Responsibilities

Every vendor we use at Sourcegraph has an internal system/relationship owner assigned to them. By assigning a Sourcegraph system owner, we have a designated point of contact for all communication with the vendor, which will facilitate turnaround times on any matters during our engagement with the vendor as well as any internal process that require vendor input/output.

The system/relationship owner is typically the person who initiates the engagement with the vendor (i.e. vendor onboarding requestor), however, in certain cases the vendor request might have been delegated to a team member but the ongoing system owner duties will be taken on by a team lead (please make sure to discuss system/relationship ownership with your team/prospective users before logging a vendor request).

Please see below the responsibilities of a system/relationship owner:

• Liaise with the vendor as the main point of contact for any engagement/partnership matters
• Working with finance to ensure the product or service is accurately budgeted for
• Keeping billing information up to date and uploading receipts as needed into Airbase
• Negotiate and request contracts/upgrades/renewals
• Onboarding and offboarding of users if not behind Okta or supported by Tech Ops (including annual access reviews for systems)
• Produce usage guidance for tool to users (please reach out to compliance about security and compliance guidance on usage)
• Help provide/extract data from vendor when requested (for instance compliance reasons (evidence), security reviews, and other data collection efforts)

Logo Rights or Case Study

Must be approved by the business champion and marketing.

Contract Renewals

For all contracts, designated buyers (employees who are responsible for the spend) should monitor contract end dates or renewal dates to ensure that:

• Renegotiations can commence in a timely manner, in advance of cessation or renewal
• Sourcegraph employees can go to market to request additional quotes from alternative suppliers (if required)
• If desired, that a vendor / contractor can be terminated by Sourcegraph allowing for any required notice period

Purchase Order Process

For procurement that exceeds the equivalent of 5,000 USD, a Purchase Order (PO) will be required in Airbase. Please attach the quote, estimate, or contractual draft to the PO prior to finalizing an agreement. The Finance team can be reached via ap@sourcegraph.com or the #finance Slack channel. For contract review, see the Contractual Execution section below.

POs are not required for our FT international teammates, but will be required for any temporary contractors.

Managing Conflicts of Interest

Any actual, potential or perceived conflict of interest that has the potential to unfairly affect or influence the proper outcome of the procurement process, must be identified and documented in the purchase order requisition.