At‑a‑glance

DSCSA EPCIS & EUDR TRACES signals (customer‑licensed)

Parakeet can ingest traceability and regulatory signals that customers license and authorize for use, then unify them with supplier and material records for monitoring, reporting, and action. No sponsorships or partnerships are implied.

• DSCSA EPCIS events: Object/Aggregation/Transaction/Transformation events (e.g., commissioning, aggregation, shipping/receiving) with GTIN/GLN, serial/lot/expiry, and event time/location. Data scope: product, batch, and facility. Typical method: API/SFTP; cadence: event‑driven or scheduled.

• EUDR due diligence: Consignment references, product/botanical details, origin geolocation and risk determinations, operator statements, and status updates where provided via EU systems. Data scope: product and plot/parcel.

• TRACES (EU): Consignment notifications and CHED status/outcomes (where licensed), border control decisions, and related sanitary/phytosanitary documentation metadata. Data scope: shipment/consignment and facility.

Glossary

• DSCSA: U.S. Drug Supply Chain Security Act (pharma serialization and traceability).

• EPCIS: GS1 Event‑based standard for supply chain visibility (v1.2/2.0).

• EUDR: EU Deforestation Regulation (due diligence and traceability obligations).

• TRACES: EU platform for tracking movements of animals, food, and plants.

Note: Examples are illustrative only. Ingestion occurs only when customers provide licensed access (e.g., to their EPCIS repositories or EU system exports). Unify TPRM/SCRM hub + external feeds (ratings, ESG, cyber, financial, media) with multi‑tier mapping and supplier linking—powering proactive Supply Chain Resilience.

Quick links: Supply Chain Resilience • TPRM hub • Certification Automation

Introduction

Parakeet Risk consumes external third‑party risk and sustainability data that customers license and authorize, unifying it with supplier records for monitoring, reporting, and action. This page explains supported feed types, ingestion methods, refresh cadences, field mapping, deduplication/linking, and audit logging.

Supported feed types (customer‑licensed)

• ESG ratings and supplier assessments (e.g., EcoVadis, IntegrityNext)

• Cybersecurity ratings (e.g., SecurityScorecard, RiskRecon)

• Financial/credit and supplier viability indicators

• Adverse media and enforcement actions

Note: Examples are illustrative only. Parakeet does not imply sponsorships or partnerships; ingestion occurs when customers provide access to their licensed sources.

Customer-licensed sources (examples)

• EcoVadis — ESG ratings and supplier scorecards

• SecurityScorecard — external cyber hygiene and risk ratings

• Kharon or Sayari — sanctions, beneficial ownership, and adverse media to support UFLPA/traceability reviews

• Additional sources on request (ingested when customers provide licensed access)

Disclaimer: Ingestion occurs only when customers provide licensed access; no sponsorships or partnerships are implied.

Ingestion methods

• API connector

• Customer provides API base URL, auth method (key, OAuth, or token), and scopes.

• Supports push (webhooks) or pull (scheduled GET). Rate‑limit aware with backoff.

• SFTP/CSV

• Drop zone with PGP encryption optional; schema validated on ingest.

• Designed for Spreadsheet Synergy: preserves existing Excel/CSV layouts while adding enterprise‑grade automation and audit trails.

• Email‑to‑ingest

• Unique mailbox per tenant; attachments (CSV/XLSX) parsed against a registered schema.

• Auto‑acknowledgment with validation results to sender list.

Refresh cadence options

• Event‑driven (near‑real‑time): webhook push from source triggers ingest and normalization.

• Scheduled: hourly, daily, or weekly pulls from API/SFTP.

• On‑demand: user‑initiated sync for urgent investigations.

• SLA guardrails: staleness thresholds raise alerts if a source has not refreshed within a configured window.

Coverage matrix (signals, cadence, and staleness SLAs)

Illustrative coverage by category. Actual providers depend on customer-licensed sources and configured ingestion methods.

Sample normalized record (0–100)

The example shows a single supplier signal normalized into Parakeet’s unified model. Values are representative only.

{
 "vendor_id": "VND-007833",
 "source_name": "Cyber rating (customer-licensed)",
 "source_type": "Cybersecurity",
 "rating_normalized_0_100": 80,
 "issue_categories": ["Vulnerabilities", "Patch"],
 "data_scope": "domain",
 "confidence": 0.94,
 "effective_date": "2025-09-01T21:05:10Z",
 "last_update": "2025-09-01T21:05:10Z",
 "staleness_days": 2,
 "status": "fresh",
 "collection_method": "API",
 "evidence_ref": {
 "artifact_type": "api_response",
 "fingerprint": "sha256:2c0c...b91e"
 }
}

Mapping and normalization

Incoming fields are normalized to Parakeet’s unified risk model and enriched by the Rosella AI Agent for consistent scoring and categorization.

• Core mapped attributes

• vendor_id (customer master reference)

• rating/score (numeric or tier mapped to standard scale)

• issue_categories (standardized taxonomy)

• last_update (UTC timestamp)

• Additional metadata

• source_name, source_dataset_id, collection_method (API/SFTP/Email)

• data_scope (entity, facility, product, or domain)

• confidence and effective_date

Cyber TPRM ratings ingestion

Customer-licensed external cybersecurity ratings mapped to Parakeet’s unified 0–100 model; examples include domain-level hygiene, vulnerability posture, and patch cadence. No sponsorships or partnerships are implied.

feed: Cyber TPRM ratings (customer-licensed)
collection_method:
 api:
 auth: [api_key, oauth_token]
 mode: [pull_scheduled, webhook_push]
 rate_limit_backoff: true
data_scope: domain | entity
primary_keys:

 - vendor_id (customer master)
linking_keys:

 - website_domain (preferred deterministic)

 - legal_name + country (fallback)

 - duns_number (if present)
raw_fields_example:
 letter_grade: A|B|C|D|F
 score_numeric: 0..100 (if provided)
 factors:

 - vulnerabilities

 - patch

 - dns_email

 - network_security
 last_seen_utc: ISO-8601
mapping_rules:
 rating_normalized_0_100:
 when: letter_grade present
 map: {A: 95, B: 80, C: 65, D: 50, F: 30}
 else: clamp(score_numeric, 0, 100)
 issue_categories:
 from: factors
 taxonomy: ["Vulnerabilities", "Patch", "DNS/Email Hygiene", "Network Security"]
 data_scope:
 from: domain_scope → "domain" else "entity"
 last_update:
 from: last_seen_utc
 confidence:
 compute: deterministic_link ? 0.98: 0.90
staleness:
 cadence: daily–weekly
 alert_if_no_refresh_days: 7
quality_checks:

 - require(letter_grade or score_numeric)

 - domain_format_valid(website_domain)

 - timestamp_fresh(last_seen_utc)
audit_evidence:
 api_fingerprint_sha256: true
 response_checksum_sha256: true
pii_in_feed: false

Updated: November 2025

ESG supplier ratings ingestion

Customer-licensed ESG ratings and assessments mapped to standardized tiers and 0–100 scores; examples include scorecards, audit findings, and corrective actions. No sponsorships or partnerships are implied.

feed: ESG supplier ratings (customer-licensed)
collection_method:
 api_or_sftp: true
 email_to_ingest: optional (CSV/XLSX)
 encryption: pgp_optional
data_scope: entity | facility | product
primary_keys:

 - vendor_id (customer master)
linking_keys:

 - supplier_legal_name + country (preferred)

 - supplier_ids_from_source (if provided)
raw_fields_example:
 provider_score_0_100: 0..100
 medal_or_tier: Bronze|Silver|Gold|Platinum
 themes: [Environment, Labor & Human Rights, Ethics, Sustainable Procurement]
 assessment_date_utc: ISO-8601
 corrective_action_status: Open|In Progress|Closed
mapping_rules:
 rating_normalized_0_100:
 when: provider_score_0_100 present → provider_score_0_100
 else: tier_to_score({Bronze: 55, Silver: 70, Gold: 85, Platinum: 93})
 normalized_tier:
 from: medal_or_tier
 issue_categories:
 from: themes
 last_update:
 from: assessment_date_utc
 confidence:
 compute: facility_level ? 0.95: 0.92
staleness:
 cadence: monthly–quarterly
 alert_if_no_refresh_days: 90
quality_checks:

 - require(provider_score_0_100 or medal_or_tier)

 - legal_name_present(supplier_legal_name)

 - date_valid(assessment_date_utc)
audit_evidence:
 file_hash_sha256: true (for SFTP/email)
 api_fingerprint_sha256: true (for API)
pii_in_feed: false

Updated: November 2025

Financial/credit ingestion

Customer-licensed financial/credit risk and viability indicators normalized to a 0–100 score; examples include probability of default, liens, delinquency, and bankruptcy flags. No sponsorships or partnerships are implied.

feed: Financial/Credit (customer-licensed)
collection_method:
 api_or_sftp: true
 schedule: monthly–quarterly
 schema_validation: strict
data_scope: entity
primary_keys:

 - vendor_id (customer master)
linking_keys:

 - duns_number (preferred deterministic)

 - legal_name + country (fallback)
raw_fields_example:
 probability_of_default_pct: 0..100
 credit_index_native: 1..10 | 0..1000 | vendor_specific
 liens_count: integer
 delinquency_flag: true|false
 bankruptcy_flag: true|false
 as_of_utc: ISO-8601
mapping_rules:
 rating_normalized_0_100:
 when: probability_of_default_pct present → 100 - probability_of_default_pct
 else: rescale(credit_index_native → 0..100, method: provider_profile)
 issue_categories:
 derive:

 - Liquidity (if delinquency_flag or low credit_index)

 - Delinquency (if delinquency_flag)

 - Bankruptcy (if bankruptcy_flag)

 - Legal (if liens_count > 0)
 last_update:
 from: as_of_utc
 confidence:
 compute: duns_number_present ? 0.97: 0.90
staleness:
 cadence: monthly–quarterly
 alert_if_no_refresh_days: 45
quality_checks:

 - numeric_range(probability_of_default_pct, 0, 100)

 - non_negative(liens_count)

 - boolean_flags([delinquency_flag, bankruptcy_flag])
audit_evidence:
 api_fingerprint_sha256: true
 file_hash_sha256: true
pii_in_feed: false

Updated: November 2025

Deduplication and supplier linking

• Deterministic linking using customer‑supplied keys (e.g., vendor_id, supplier ERP ID, registered domain) when available.

• Probabilistic match when keys are absent: legal name similarity, country/region, website domain, and facility identifiers.

• Link governance

• Auto‑link when confidence ≥ threshold; otherwise route to review worklist.

• All merges/splits are reversible with a full change history.

Sample anonymized payloads (representative)

The table shows how common sources map into Parakeet’s model after ingest. Values are illustrative only.

Data flow (high‑level)

Provider APIs / SFTP / Email → Ingestion Gateway (schema/quality checks) → Normalization & Rosella AI enrichment (taxonomy, scoring) → Dedup & Supplier Linker (deterministic/probabilistic) → Unified Risk Ecosystem (dashboards, alerts, workflows) → Downstream solutions: Continuous Compliance, Supply Chain Resilience, EHS Control Center

Reference architectures: Eco

Vadis, SecurityScorecard, D&B Illustrative patterns for common customer-licensed sources. No sponsorships or partnerships are implied; ingestion occurs only when customers provide licensed access.

Quick links: EcoVadis • SecurityScorecard • D&B

Eco

Vadis reference architecture

EcoVadis API/SFTP (customer-licensed)
 → Ingestion Gateway (schema + auth)
 → Normalization & Rosella enrichment (medals/tiers → 0–100, taxonomy)
 → Supplier Linker (legal name + country; optional supplier IDs)
 → Unified Risk Ecosystem (dashboards, alerts, workflows)

• Typical method: API or SFTP/CSV (scorecards, assessments, corrective actions)

• Refresh: monthly–quarterly; staleness alert > 90 days

• Core mapping examples:

• provider_score: 0–100 (native) → rating_normalized_0_100

• medal/tier → normalized_tier (e.g., Bronze/Silver/Gold) and 0–100 scale

• themes → issue_categories (Environment, Labor & Human Rights, Ethics, Sustainable Procurement)

• Notes: facility- or entity-level scope captured in data_scope; evidence artifacts stored (API fingerprints or file hashes).

Security

Scorecard reference architecture

SecurityScorecard API (customer-licensed)
 → Ingestion Gateway (rate-limit aware; webhooks optional)
 → Normalization (letter grade A–F → 0–100; signal taxonomy)
 → Supplier Linker (registered domain; fallback: legal name + site)
 → Unified Risk Ecosystem (alerts for drops; remediation workflows)

• Typical method: API (pull daily/weekly) or webhook push for events

• Refresh: daily–weekly; staleness alert > 7 days

• Core mapping examples:

• letter_grade (A–F) → rating_normalized_0_100

• issue_buckets → issue_categories (Vulnerabilities, Patch, DNS/Email Hygiene, Network Security)

• domain_scope → data_scope = "domain"

• Notes: domain-to-supplier linking is deterministic when customer provides canonical domains.

D&B reference architecture

Dun & Bradstreet (D&B) API/SFTP (customer-licensed)
 → Ingestion Gateway (schema validation)
 → Normalization (heterogeneous scores → 0–100)
 → Supplier Linker (D-U-N-S; legal name + country fallback)
 → Unified Risk Ecosystem (credit risk, viability, alerts)

• Typical method: API or SFTP (credit scores, failure risk, liens, UBO metadata if licensed)

• Refresh: monthly–quarterly; staleness alert > 45 days

• Core mapping examples:

• probability_of_failure / viability indices → rating_normalized_0_100

• delinquency/bankruptcy flags → issue_categories (Liquidity, Delinquency)

• duns_number → external_entity_id; used as preferred deterministic key

• Notes: supports traceability workflows when combined with sanctions/adverse media feeds.

Governance and audit logging

Data provenance and API fingerprints

To increase trust in third‑party data ingestion, Parakeet records verifiable evidence for every ingest.

• What we capture: SHA‑256 hashes of source files, API response fingerprints, non‑sensitive header metadata, request IDs, collection method, and UTC timestamps.

• Why it matters: end‑to‑end auditability, reproducibility of results, and regulator‑ready evidence.

• Where to see it: the Evidence tab on each supplier signal; exports include a manifest and checksums.

• Chain of custody: append‑only event log with immutable IDs; all transforms are versioned with diffs and approver signatures.

Updated: Nov 2025

Sample evidence artifact (representative):

{
 "artifact_id": "artf-9d12e7c0",
 "source": {
 "type": "api_response",
 "provider": "customer-licensed",
 "collection_method": "API",
 "request_id": "req-7b0c4c2a",
 "api_fingerprint": "sha256:7e9f0a4d1c8b2e0f6a1d...3b17",
 "response_signature": "sha256:4f2a0c9e...a83e"
 },
 "file_checksums": {
 "body_sha256": "sha256:2c0c1f9a...b91e"
 },
 "timestamps": {
 "collected_at": "2025-11-05T14:22:19Z",
 "normalized_at": "2025-11-05T14:22:22Z"
 },
 "integrity": {
 "verification": "passed",
 "schema": "v3.4"
 }
}

See industry context: Pharma compliance and 21 CFR Part 11 alignment (/pharma) and TPRM hub (https://info.parakeetrisk.com/tprm).

21 CFR Part 11 supplier monitoring

For pharma and life sciences programs, Parakeet helps operationalize supplier oversight aligned to 21 CFR Part 11 by tying third‑party feeds to verifiable evidence and audit trails.

• Evidence integrity: immutable ingest logs (who/what/when/where), source file hashes, and API fingerprints maintain trustworthy electronic records.

• Controlled records: versioned mappings/taxonomies, reversible merges/splits, and role‑based access preserve record authenticity and traceability.

• Electronic signatures and approvals: workflow approvals are captured with timestamps, identity, and intent, and included in audit packets.

• Continuous assurance: alerts trigger when supplier systems, SOPs, or certifications indicate gaps in Part 11 controls; exceptions route to review worklists.

• Proof for auditors: exportable audit packets (PDF + CSV manifests) link signals to suppliers, changes over time, and supporting artifacts.

Learn more: 21 CFR Part 11 supplier monitoring guide (/ai/tprm-21-cfr-part-11).

• Immutable event log: who/what/when/where for each ingest, mapping, transformation, and link/unlink action.

• Evidence artifacts: original files/hash, API response fingerprints, validation reports.

• Change management: versioned mappings and taxonomies; diff views highlight score or category changes between refreshes.

• Access control: role‑based visibility to source data and vendor records; approvals captured directly in the workflow.

• Export: audit packets (PDF + CSV manifests) for regulators and customers’ internal audits.

Setup checklist

1) Choose feed type and provider; confirm customer license and permissions. 2) Select ingestion method (API, SFTP/CSV, or email‑to‑ingest) and register schema. 3) Configure refresh cadence and staleness thresholds. 4) Define mapping rules and category taxonomy; enable Rosella enrichment. 5) Set linking strategy and review thresholds; test with a pilot file or sandbox API. 6) Activate alerts, dashboards, and audit exports.

Related pages

• See related: https://info.parakeetrisk.com/tprm

• See also: https://info.parakeetrisk.com/working-with-external-auditors-parakeet3