Vendor Policy

1. Purpose and Scope

Cartographer Consulting LLC ("Cartographer," "we," "us," or "our") engages outside talent to help deliver client work. Our clients trust us with access to their systems, their revenue data, and their internal operations. Every person who works under our name inherits that trust — and the obligations that come with it.

This Vendor Policy sets out the standing requirements for anyone Cartographer engages to support client delivery or internal operations, including:

• Independent contractors and freelancers
• Subcontractors and subcontracting firms
• Agencies and delivery partners
• Referral and channel partners with access to client information

Throughout this Policy, each of the above is a "Vendor." Where a Vendor is a company rather than an individual, this Policy applies equally to every one of that Vendor's employees, contractors, and agents assigned to Cartographer work.

How this Policy operates. Cartographer asks every Vendor to acknowledge this Policy in writing as a condition of engagement, and attaches the then-current version to the Vendor's signed agreement. It supplements — it does not replace — the terms of your signed agreement. Where this Policy and your signed agreement conflict, your signed agreement controls, and you should tell us about the conflict so we can resolve it.

2. Engagement Requirements

No Vendor may begin work, receive client information, or be granted system access before all of the following are complete:

1. A signed written agreement — an Independent Contractor Agreement or subcontractor agreement executed by both parties. Verbal engagements are not permitted.
2. A signed Non-Disclosure Agreement, where confidentiality obligations are not already fully covered by the engagement agreement.
3. Tax documentation — a completed Form W-9 (or Form W-8 series for non-U.S. Vendors). Cartographer reports payments to U.S. Vendors on Form 1099-NEC as required by law.
4. Acknowledgment of this Policy.
5. Any client-required screening — see Section 12.

Cartographer does not authorize work to begin before these items are complete, and no Cartographer representative may waive this requirement verbally. If you are asked to start before your paperwork is done, tell us.

3. Independent Contractor Status

Vendors are independent contractors, not employees of Cartographer. Specifically:

• Nothing in the engagement creates an employer-employee, partnership, joint venture, or agency relationship.
• Vendors are not eligible for and will not receive employee benefits, including health insurance, retirement benefits, paid time off, sick leave, or workers' compensation coverage.
• Vendors set their own hours and work location, provided agreed deadlines and deliverables are met.
• Vendors provide their own equipment, tools, and materials unless the engagement agreement states otherwise.
• Vendors are solely responsible for all applicable taxes on amounts received, including income and self-employment taxes. Cartographer does not withhold taxes.
• Vendors may perform services for others during the term, provided doing so creates no conflict of interest and does not interfere with performance for Cartographer. See Section 10.
• Vendors have no authority to enter into contracts, make commitments, or otherwise bind Cartographer or any Cartographer client unless specifically authorized in writing.

4. Confidentiality

4.1 What Is Confidential

"Confidential Information" includes any information a Vendor receives from or about Cartographer or a Cartographer client, whether written, oral, electronic, or visual, including:

• Business strategies and plans
• Technical systems and architectures
• Operational processes and procedures
• Financial information and pricing
• Customer, prospect, and supplier information
• Employee and contractor information
• Trade secrets and know-how
• Product and service specifications
• Client relationships and engagement details
• Implementation methodologies and frameworks
• Anything marked confidential, or that a reasonable person would understand to be confidential

The identity of Cartographer's clients is itself confidential. Do not disclose who we work with, name a client in a case study, portfolio, résumé, or social post, or confirm a client relationship to a third party without Cartographer's prior written consent.

4.2 Vendor Obligations

Every Vendor agrees to:

• Maintain strict confidentiality of all Confidential Information
• Use Confidential Information solely to perform the engagement
• Disclose Confidential Information to no third party without Cartographer's prior written consent
• Limit internal access to those with a genuine need to know, each bound by equivalent obligations
• Protect Confidential Information with at least the same degree of care used for the Vendor's own confidential information
• Notify Cartographer promptly of any unauthorized disclosure, access, or use
• Implement and maintain appropriate security measures

4.3 Exclusions

These obligations do not apply to information that was publicly known at the time of disclosure; became publicly known through no fault of the Vendor; was rightfully known to the Vendor before disclosure; was independently developed without use of the Confidential Information; was rightfully received from a third party without confidentiality obligations; or is released for disclosure with Cartographer's written consent.

4.4 Survival

Confidentiality obligations survive termination of the engagement as follows, and where more than one period applies, the longest controls:

• Minimum floor — one (1) year from the date of termination, per the standard Independent Contractor Agreement.
• Individual Non-Disclosure Agreement — two (2) years after the Vendor's working relationship with Cartographer ends, where the Vendor has signed that agreement.
• Client flow-down — for any client's Confidential Information, the period Cartographer owes that client under the applicable client agreement, which is frequently longer than either period above. Cartographer will tell you when a longer client-specific period applies to your work.
• Trade secrets — for as long as the information remains a trade secret under applicable law.

5. Client Data Handling

Client data is the most sensitive material a Vendor will touch. The following are non-negotiable:

• Need-to-know only. Access only the data required for your assigned work. Do not browse client systems, records, or files outside your scope.
• No purpose creep. Use client data only for authorized work on that client's engagement. Never for your own business development, benchmarking, or model training, and never for portfolio or marketing purposes except under the narrow approval process in Section 9.
• No cross-client mixing. Never move, copy, or reference one client's data in the context of another client's work.
• Encryption required. Client data must be encrypted in transit and at rest.
• Sanctioned storage only. Store client data only in Cartographer-approved systems. Do not export, download, or transfer client data to personal devices, personal cloud accounts, personal email, or unapproved third-party tools without explicit written authorization.
• No unnecessary copies. Work in the source system where possible. Where a local copy is unavoidable, delete it as soon as it is no longer needed.
• Return or delete on exit. Return or permanently delete all client data and Confidential Information on termination of the engagement, or on request, and certify in writing that you have done so, on the timeline in Section 16. The only exception is a portfolio copy expressly permitted under Section 9.
• Comply with applicable law. Follow all data protection and privacy laws applicable to the data you handle. If you believe a task would violate one, stop and raise it with us.

6. Information Security Requirements

Vendors must maintain, at minimum:

• Multi-factor authentication enabled on every system that supports it
• Strong, unique passwords for every account, managed in Cartographer's approved password manager where one is provided
• No credential sharing. Never share a password or authentication factor with anyone, including other Vendors. The single exception is a shared white-label account provisioned by a client in the client's own tenant for delivery under that client's brand: those accounts are named, MFA-protected, granted without administrative rights where the platform allows, and documented in the engagement record. Cartographer will tell you if one applies to your work. You may not create, extend, or share such an account on your own initiative.
• Current software. Keep operating systems, browsers, and security software patched and supported.
• Device security. Full-disk encryption, screen lock, and current anti-malware protection on any device used for Cartographer or client work.
• Secure networks. Remote access to Cartographer or client systems requires a secure VPN connection.
• Approved tools only. Use only Cartographer-approved technologies for business communications and data storage. Do not install unauthorized software on Cartographer or client systems.
• No personal use. Do not use Cartographer or client systems for personal purposes.
• Incident reporting within 24 hours. Report any actual or suspected security incident, unauthorized access, lost or stolen device, phishing compromise, or accidental disclosure to Cartographer within twenty-four (24) hours of becoming aware of it. Cooperate fully in any investigation and in documenting remediation.

Reporting an incident promptly is never held against a Vendor. Concealing or delaying an incident report is grounds for immediate termination.

7. Approved Technology and Access

Vendors may be granted access to Cartographer or client systems and tools — including Slack, HubSpot, Asana, Google Workspace, password management systems, file sharing platforms, and other applications ("Cartographer Technology") — solely for purposes related to the engagement.

Vendors acknowledge that:

• All software provided is licensed to Cartographer or its client and subject to the terms of the applicable license agreements
• Vendors have no ownership rights in Cartographer Technology
• Vendors shall not copy, modify, redistribute, or reverse engineer any software provided
• All use of Cartographer Technology is subject to monitoring consistent with applicable law
• Upon termination, Vendors shall immediately cease all use of Cartographer Technology, and access will be revoked

Requests for new tools, integrations, or third-party services touching client data must be submitted to Cartographer for approval before use.

8. Artificial Intelligence Tools

Cartographer uses AI tools in delivery, and we expect Vendors to use them well and safely. The following rules apply to any use of AI in connection with Cartographer or client work:

• Approved tools only. Use only AI tools and tiers that Cartographer has approved for the engagement. If you are unsure whether a tool is approved, ask before using it.
• No client data in consumer or free-tier tools. Never enter Confidential Information, client data, personal data, or credentials into a consumer-grade or free-tier AI service, or into any tool whose terms permit the provider to train on your inputs.
• Minimize what you submit. Redact, anonymize, or summarize wherever the task allows. Submit the least information necessary to get the result.
• No training on client data. Do not use Cartographer or client information to train, fine-tune, or evaluate any model, and do not permit a third party to do so.
• Human review is mandatory. Review, verify, and correct all AI-assisted output before it is used, relied upon, or delivered. Verify every factual claim, figure, calculation, configuration recommendation, and citation independently.
• You remain fully responsible. AI assistance does not reduce a Vendor's responsibility for the accuracy, quality, originality, and legality of delivered work. "The AI produced it" is not an explanation for a defect.
• No infringing output. Do not deliver AI-generated content that reproduces third-party copyrighted material, trademarks, or code under an incompatible license.
• Disclose on request. Tell Cartographer which AI tools you used on a deliverable when asked. Some client engagements restrict or prohibit AI use entirely; where a client restriction applies, we will tell you, and it overrides this section.

9. Intellectual Property

• Assignment. All work product created or developed by a Vendor in the course of providing services — including designs, drawings, reports, documentation, code, configurations, and other materials ("Work Product") — is owned exclusively by Cartographer. The Vendor irrevocably assigns, transfers, and conveys to Cartographer all right, title, and interest in and to the Work Product, including all intellectual property rights in it, effective on creation.
• Prior inventions. Vendors represent that they have disclosed to Cartographer in writing, before the engagement begins, all pre-existing inventions, works of authorship, developments, improvements, or trade secrets they own that relate to Cartographer's business and that they may incorporate into Work Product. If any undisclosed pre-existing material of the Vendor's is embedded in Work Product, the Vendor grants Cartographer and its client a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to use, reproduce, modify, and distribute that material as part of that Work Product.
• Assistance. Vendors agree to assist Cartographer, at Cartographer's expense, in obtaining and enforcing patents, copyrights, trademarks, and other intellectual property rights in Work Product, and to execute documents Cartographer reasonably requests for that purpose.
• Cartographer methodology stays ours. Cartographer's methodologies, frameworks, templates, and educational content — including the Orientation, Cartography, and Exploration model — remain Cartographer's property. Vendors receive no license to use them outside the engagement.
• Portfolio use requires advance approval. Where a Vendor's signed Non-Disclosure Agreement grants a portfolio right, that right governs and this Policy does not narrow it. Under the standard Individual NDA, a Vendor may retain copies of their own work for portfolio and demonstration purposes only after redacting or modifying it to remove client-identifying and confidential material, giving Cartographer advance notice, and receiving written confirmation that the modified work is acceptable for portfolio use. Absent that written confirmation, do not include Cartographer or client Work Product, screenshots, deliverables, or results in a portfolio, case study, résumé, proposal, or marketing material.

10. Conflicts of Interest and Client Contact

California law voids agreements that restrain a person from engaging in a lawful profession, trade, or business. We do not ask Vendors to sign non-competes, customer non-solicitation covenants, or no-poach agreements, and we do not attempt to restrict who a Vendor works for after an engagement ends. What we do require is that Vendors respect our confidential information and our client relationships during the engagement, and never use our confidential information to compete with us afterward.

• Disclose conflicts. Tell us promptly if you take on work that competes with Cartographer, serves a Cartographer client directly, or could reasonably be perceived as a conflict. Disclosure usually resolves the issue; discovery after the fact usually does not.
• All client contact runs through Cartographer. During the engagement, do not contact, solicit, or negotiate with a Cartographer client or prospect outside the channels and scope Cartographer has authorized. Where white-label delivery applies, follow the client's communication protocols and brand guidelines and represent yourself only as authorized.
• No side agreements during the engagement. While engaged, do not enter into any direct engagement, retainer, referral arrangement, or fee-sharing arrangement with a Cartographer client or prospect concerning work within the scope of your Cartographer engagement, without Cartographer's prior written consent.
• No use of confidential information to compete. The confidentiality obligations in Section 4 continue after the engagement ends. Client lists, prospect pipelines, pricing, engagement details, methodologies, and other Confidential Information may not be used to solicit or serve anyone, at any time, whether during the engagement or after it. This is a confidentiality and trade-secret obligation, not a restraint on your right to work.
• After the engagement, you are free to work. Nothing in this Policy restricts a Vendor from working in the industry, advertising their services, accepting inbound business, or serving any client after the engagement ends, subject only to the confidentiality obligations above.

11. Invoicing and Payment

Unless the Vendor's signed agreement states otherwise:

• Fee structure. Compensation is a fixed fee per period as stated in the signed agreement.
• Service report. Vendors submit a brief service report to Cartographer by the last day of each month, covering the services performed during that same calendar month. The report includes a summary of work completed, approximate hours spent, project status updates, and any issues or concerns. Email is acceptable. Cartographer maintains these reports as a record of services provided, for tax and business purposes.
• Payment schedule. Payments are made on the fifth (5th) of the month following the month covered by the service report. A report submitted on August 31 for August services is paid on September 5.
• No advances. Vendors do not receive advances or payment in anticipation of completed work.
• Invoices. Where the Vendor's agreement requires an invoice, submit it with the monthly service report. Invoices are paid on the same fifth-of-the-following-month schedule as the fixed fee. An invoice submitted without the corresponding service report may be held until the report arrives.
• Expenses. Vendors bear all expenses incurred in performing the services unless specifically pre-approved in writing. Submit receipts and documentation for pre-approved expenses with the next monthly service report and invoice following the expense.
• Accurate records. Time, hours, and deliverable status must be reported accurately. Misreporting is a material breach.

12. Screening and Client Requirements

Some client engagements impose their own requirements on everyone with access to their systems and data — background checks, security training, confidentiality agreements executed directly with the client, insurance minimums, or restrictions on geography, subcontracting, or AI use.

Cartographer will notify Vendors of any such requirement applicable to their work. Where a client requires a background check, the process, logistics, and costs are managed by the client, and the check is conducted only with the individual's informed written consent and in compliance with the federal Fair Credit Reporting Act, California's Investigative Consumer Reporting Agencies Act, and any other applicable law. Consent is voluntary. A Vendor who declines a client-imposed requirement simply cannot be staffed on that engagement, and declining carries no other consequence.

Client-imposed requirements are cumulative with this Policy. Where a client requirement is stricter, it controls.

13. Professional Conduct

Vendors control their own schedule, methods, and place of work. The expectations below relate to results and client experience, not to how or when a Vendor chooses to work:

• Represent Cartographer professionally in all client-facing interactions
• Respond to communications within forty-eight (48) business hours, which is the standard Cartographer commits to its clients
• Attend meetings the Vendor has agreed to attend, and give as much notice as practicable — ideally twenty-four (24) hours — when a reschedule is unavoidable
• Escalate problems early rather than allowing a deadline to pass silently
• Communicate scope concerns to Cartographer rather than to the client directly
• Treat client personnel, Cartographer personnel, and other Vendors with respect
• Comply with all applicable laws and with Cartographer policies

14. Insurance

Insurance requirements, where any apply, are specified in the Vendor's signed agreement or in a client-imposed requirement communicated to the Vendor. Where general liability or professional liability coverage is required, the Vendor maintains it at the Vendor's own expense and provides a certificate of insurance on request.

15. Indemnification and Liability

Vendor indemnification. The Vendor shall indemnify, defend, and hold harmless Cartographer, its officers, directors, employees, agents, successors, and assigns from and against any losses, damages, liabilities, deficiencies, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of any kind, including reasonable attorneys' fees, arising from or relating to:

• Any breach of the Vendor's agreement or of this Policy
• Any negligent or willful act or omission of the Vendor in providing the services
• Any bodily injury, death, or damage to real or tangible personal property caused by the Vendor
• Any infringement, misappropriation, or violation of third-party intellectual property rights by the Vendor or by materials the Vendor provides

Cartographer indemnification. Cartographer shall indemnify, defend, and hold harmless the Vendor from and against any such losses arising from or relating to any breach of the agreement by Cartographer, any negligent or willful act or omission of Cartographer, or any bodily injury, death, or damage to real or tangible personal property caused by Cartographer.

Limitation of liability. Except for obligations arising under Sections 4 (Confidentiality), 5 (Client Data Handling), and 9 (Intellectual Property), and except for either party's indemnification obligations above:

• Neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages.
• The total liability of either party for all claims of any kind arising from or related to the engagement shall not exceed the total amount paid by Cartographer to the Vendor during the six (6) months preceding the event giving rise to the claim.

16. Term, Termination, and Offboarding

• Termination without cause. Either party may terminate on fourteen (14) days' written notice.
• Termination for cause. Cartographer may terminate immediately for cause, including material breach, dishonesty, fraud or misconduct, violation of Cartographer policies including this one, a security incident caused by Vendor negligence, unauthorized disclosure of Confidential Information, or inability to perform essential functions of the engagement.
• Payment on termination. Cartographer pays the Vendor for all services performed through the termination date.
• Offboarding obligations. On termination, regardless of reason, the Vendor shall promptly:
  • Return all Cartographer and client property and equipment
  • Deliver all work in progress, in a usable and documented state
  • Submit a final service report and final invoice
  • Cease all use of Cartographer Technology and cooperate with access revocation
  • Then return or permanently delete all Confidential Information and client data — other than a portfolio copy expressly approved under Section 9 — and provide written certification of compliance within twenty-four (24) hours of completing the return or deletion, and in any event within five (5) business days of termination
• Survival. Sections 4, 5, 6, 9, 10, 15, 16, and 19 survive termination. Section 6 survives for as long as the Vendor retains any Confidential Information or client data.

17. Reporting Concerns

If you see something that looks like a security problem, a privacy problem, a conflict of interest, a legal or regulatory issue, or work being asked of you that you believe is improper — tell us. Contact your Cartographer engagement lead, or reach us through the contact details on our about page.

We would much rather have an awkward conversation early than a client incident later. Vendors who raise a good-faith concern will not be penalized for raising it.

18. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and post the updated Policy here. Material changes will be communicated to active Vendors in writing.

Updates apply prospectively. An engagement already underway continues to be governed by the version of this Policy in effect when the Vendor's agreement was executed, unless the parties agree otherwise in writing. Cartographer keeps a dated copy of each superseded version and will provide it on request.

19. Governing Law and Dispute Resolution

Vendor engagements are governed by the laws of the State of California, without giving effect to any choice or conflict of law provision. Any dispute arising out of or related to a Vendor engagement shall be resolved through binding arbitration in San Diego, California, in accordance with the rules of the American Arbitration Association.

Contact

Cartographer Consulting LLC 11120 East Ocean Air Drive, Suite 101-35 San Diego, CA 92130

Questions about this Policy? Contact us.