Purpose and scope

This page documents how Parakeet Risk ingests customer-licensed regulatory and third‑party risk intelligence, normalizes it, and maps resulting signals into watchlists, alerts, and risk scores across modules such as Continuous Compliance, EHS Control Center, and Supply Chain Resilience.

Data licensing and disclaimers

• Customer‑licensed only: Parakeet connects to feeds you already license from the providers listed below. Parakeet is not a reseller and does not grant access or entitlement to third‑party content.

• No implied partnership: Mention of a provider indicates technical compatibility requested by customers; it does not imply a commercial relationship or endorsement.

• You are the controller of licensed content. Parakeet acts as a processor for ingestion, classification, storage, and workflow automation under your data processing and retention configurations.

Ingestion and normalization

• Transport options (customer‑provided): API endpoints, SFTP/secure file drop, email-to-ingest, RSS/Atom, and flat files (CSV/JSON). Exact mechanisms depend on the customer’s entitlement and provider capabilities.

• File and message validation: schema checks, deduplication by external ID and content hash, and timezone normalization. Failed records are quarantined for review.

• Core normalization schema (high level):

• Metadata: source_vendor, external_id, title, summary, language, publish_date, last_updated.

• Scope: jurisdiction, industry/taxonomy tags, facility/site, supplier/entity, product/material.

• Classification: content_type (regulation, guidance, enforcement, rating, questionnaire, issue), change_type (add/update/repeal), criticality.

• Signals: rating/score, score_delta, confidence, evidence_uri(s).

• Mappings: related_controls/policies, accountable_owner, due_date, workflow_state.

• Rosella assistance: Rosella can summarize source documents, extract obligations, propose control mappings, and draft remediation tasks for review by human owners.

Watchlists and risk‑score mapping

• Watchlists: configurable collections of entities or topics (e.g., “FDA labeling changes,” “Tier‑1 suppliers,” “OT cyber posture”). Feeds can auto‑enroll items into watchlists based on rules (jurisdiction, NAICS, part/material, supplier name, domain, or tags).

• Signal → score: each ingested item generates a normalized signal with weightings by source_vendor, signal type, severity/criticality, and recency half‑life. Scores roll up at asset, process, site, supplier, and enterprise levels.

• Triggers and automation: create/assign corrective actions, launch audits, open incidents, start supplier questionnaires, or sync tasks to Trello, Slack, or Microsoft Teams. Key dates sync to Google Calendar.

Provider connectors (customer‑licensed)

The following connectors reflect common customer requests. Parakeet ingests only the content you are entitled to receive under your direct subscription.

Enhesa (regulatory change intelligence)

• Content types: regulatory updates, obligations, and guidance licensed by the customer.

• Typical use: EHS/Regulatory watchlists by jurisdiction; obligation extraction into Continuous Compliance.

• Notes: customer provides delivery method and scope; Parakeet stores evidence links and maps changes to owners and controls.

Reg

Scan (regulatory research and updates)

• Content types: customer‑licensed regulatory change notifications and references.

• Typical use: change tracking, audit prep, and policy updates with tasks routed to owners; evidence retained for audits.

Bit

Sight (third‑party cyber risk ratings)

• Content types: customer‑licensed ratings and issue summaries for monitored domains/entities.

• Typical use: supply‑chain cyber posture watchlists; triggers to open findings or questionnaires for vendors with score drops.

Security

Scorecard (third‑party cyber risk ratings)

• Content types: customer‑licensed security ratings, factor scores, and issue categories.

• Typical use: continuous vendor monitoring; workflow to track remediation and re‑scoring.

Eco

Vadis (ESG/sustainability ratings)

• Content types: customer‑licensed sustainability ratings, scorecards, and themes.

• Typical use: supplier sustainability watchlists; integration with sourcing gates and quality checkpoints.

Example field mapping

Feed (example)	Primary objects	Key incoming fields (examples)	Parakeet mapping target	Typical watchlists	Risk signal mapped
Enhesa	Regulatory changes	external_id, jurisdiction, topic, change_type, effective_date, summary	Regulation item → obligations → owners/controls	EHS by site/jurisdiction	Compliance gap risk (+/− by change_type)
RegScan	Regulatory updates	external_id, citation, geography, category, update_date	Regulation item → policy/control impact	Policy/standard families	Policy drift risk (recency‑weighted)
BitSight	Ratings	entity_id, rating, vector, issue_count, observed_date	Vendor profile → cyber posture	Tier‑1/Tier‑2 suppliers	Cyber risk (score_delta weighted)
SecurityScorecard	Ratings	entity_id, overall_score, factor_scores, last_change	Vendor profile → factor tracking	Critical vendors	Cyber risk (factor‑specific weights)
EcoVadis	ESG ratings	supplier_id, overall_score, theme_scores, year	Supplier ESG profile → sourcing gates	Sustainability‑critical suppliers	ESG risk (theme‑weighted)

Notes: Field names vary by provider and customer plan; the table illustrates typical mappings. Customers choose weights, thresholds, and half‑lives.

Matching and entity resolution

• Suppliers/entities: exact and fuzzy matching by legal name, alternative names (AKA/DBA), registration numbers, domains, and country; human review queue for ambiguous matches.

• Sites/facilities: match by site codes, addresses, geocoordinates, and plant IDs.

• Regulations → controls: tag‑based and Rosella‑assisted mapping to internal policies/controls; owners assigned from HRIS via integrations with Workday or BambooHR.

Workflows and evidence

• Every ingested item carries immutable metadata and an audit trail in Features: timestamps, user actions, and system automations.

• Evidence links and attachments are preserved; changes generate versioned snapshots.

• Tasks can sync to finance/ERP contexts via NetSuite, Sage, or QuickBooks when controls have financial impact.

Deployment steps (typical)

1) Validate entitlements: confirm provider subscription scope and delivery method (API/SFTP/file). 2) Configure ingestion: credentials, schemas, and field mapping; define dedupe strategy. 3) Define watchlists and thresholds: scope by sites, suppliers, product lines, and jurisdictions. 4) Score tuning: set signal weights, recency half‑life, and escalation thresholds. 5) UAT: backfill 90–180 days of history, verify mappings, and run dry‑run workflows. 6) Go‑live and monitor: enable alerts to Slack/Teams and sync key dates to Google Calendar.

Security and compliance notes

• Data handling follows your configured retention policies and role‑based access controls in Parakeet.

• Minimal PII: regulatory and rating feeds generally carry limited PII; configure redaction where necessary.

• All automations are fully auditable with evidence preservation to support external audits and certifications (see Certification Automation).

Supported modules and outcomes

• EHS and regulatory change management: obligation tracking, policy updates, and site‑level accountability through EHS Control Center.

• Continuous compliance and audit readiness: live dashboards, alerts, and automated evidence collection via Continuous Compliance.

• Third‑party and supply chain resilience: consolidated vendor profiles and automated remediation in Manufacturing/Supply Chain.