Supplier, Contractor, and Vendor Code of Conduct

Organization: Igzibo Engineering Solutions, Inc.
Version: 1.1
Status: Living policy
Effective Date: September 16, 2026
Owner: Igzibo Engineering Solutions, Inc.
Review Cycle: At least annually and after material legal, contractual, security, or business changes.

1. Purpose

This Supplier, Contractor, and Vendor Code of Conduct establishes baseline requirements for third parties that provide services, personnel, technology, products, recruiting, staffing, consulting, engineering, research, or other capabilities to Igzibo Engineering Solutions, Inc.

The Code is intended to establish consistent expectations for ethical conduct, confidentiality, privacy, security, intellectual property, and responsible business practices.

2. Scope

This Code may apply to:

• Contractors.
• Consultants.
• Recruiting and staffing partners.
• Technology vendors.
• Suppliers.
• Professional-service providers.
• R&D partners.
• Subcontractors.
• Agents and intermediaries.
• Other business partners designated by Igzibo.

Specific contractual requirements may supplement this Code.

Definitions

Confidential Information: Non-public information requiring controlled access under the Data Classification and Handling Standard.

Igzibo: Igzibo Engineering Solutions, Inc.

Personal Information: Information that identifies, relates to, describes, or can reasonably be linked to an identifiable individual.

Supplier: A third party that provides goods or services to Igzibo.

Third Party: An external organization or individual that is not Igzibo.

Vendor: A third party providing a product, service, platform, technology, or other business capability.

AI (Artificial Intelligence): A machine-based system capable of generating predictions, recommendations, decisions, content, or other outputs based on inputs.

R&D (Research and Development): Activities involving research, experimentation, prototyping, engineering investigation, or development of new or improved products, services, methods, or technologies.

4. General Conduct

Suppliers and representatives must:

• Act honestly and professionally.
• Comply with applicable law.
• Follow contractual requirements.
• Protect Igzibo and client information.
• Protect credentials and access.
• Avoid conflicts of interest.
• Maintain accurate business records.
• Report material incidents.
• Respect intellectual-property rights.
• Cooperate with authorized investigations.

5. Compliance With Law

Suppliers must comply with laws and regulations applicable to their services and personnel.

No business objective authorizes unlawful conduct.

Where a contract establishes stricter requirements, the contractual requirement controls.

6. Confidentiality

Suppliers must protect confidential information received from Igzibo or its clients.

Confidential information may be used only for authorized purposes.

Suppliers must not:

• Sell information.
• Use information for unrelated purposes.
• Disclose information without authorization.
• Transfer information to unauthorized parties.
• Use client information for unrelated training or demonstrations.

Confidentiality obligations may continue after an engagement ends.

7. Privacy and Personal Information

Suppliers handling Personal Information must:

• Use it only for authorized purposes.
• Limit access to personnel with a legitimate need.
• Apply appropriate safeguards.
• Follow applicable privacy requirements.
• Follow contractual processing instructions.
• Report suspected unauthorized access or disclosure.
• Return or delete information when required.

Additional data-processing requirements may be established in contracts or data-processing agreements.

8. Security

Suppliers accessing Igzibo systems or information must follow applicable security requirements.

These may include:

• Individual accounts.
• Multi-Factor Authentication (MFA).
• Least-privilege access.
• Secure credential handling.
• Approved devices and systems.
• Secure communications.
• Appropriate logging.
• Timely removal of access.

Igzibo's Identity and Access Management Standard, Data Classification and Handling Standard, and Technology and Third-Party Service Security Standard establish additional requirements.

9. Security Incident Reporting

Suppliers must promptly report suspected or confirmed incidents involving Igzibo systems, information, personnel, or client information according to applicable contractual requirements.

Examples include:

• Credential compromise.
• Unauthorized access.
• Malware.
• Lost devices containing protected information.
• Accidental disclosure.
• Unauthorized data transfer.
• Security compromise of a connected service.

Suppliers must cooperate with incident investigation and response.

10. Intellectual Property

Suppliers must respect:

• Igzibo intellectual property.
• Client intellectual property.
• Third-party intellectual property.
• Software licenses.
• Open-source licenses.
• Copyrights.
• Patents.
• Trademarks.
• Trade secrets.

Ownership and licensing are determined by applicable contracts.

Suppliers must not use client or Igzibo intellectual property outside the authorized scope.

11. Subcontractors

Suppliers must not subcontract material work involving Igzibo or client information when the applicable agreement requires prior authorization.

Where subcontracting is permitted, the supplier remains responsible for its subcontractors' compliance with applicable requirements.

12. Anti-Bribery and Corruption

Suppliers must comply with applicable anti-bribery and anti-corruption requirements.

Suppliers must not provide or accept improper payments, kickbacks, or benefits in connection with Igzibo business.

Additional requirements are established in the Anti-Bribery and Anti-Corruption Policy.

13. Conflicts of Interest

Suppliers must disclose actual, potential, or apparent conflicts that could materially affect their work for Igzibo.

Conflicts involving clients, candidates, vendors, competitors, or related parties must be disclosed when they could affect objectivity or contractual obligations.

14. Recruiting and Staffing Partners

Recruiting and staffing partners must:

• Protect candidate information.
• Use accurate candidate information.
• Avoid unauthorized submissions.
• Follow applicable employment and anti-discrimination requirements.
• Follow client-specific recruiting requirements.
• Avoid undisclosed candidate or client conflicts.
• Maintain appropriate authorization for candidate data sharing.
• Follow agreed compensation and referral arrangements.

15. Accurate Records and Billing

Suppliers must maintain accurate records supporting:

• Services performed.
• Personnel provided.
• Expenses.
• Fees.
• Commissions.
• Referral payments.
• Invoices.

False invoices, concealed payments, or misleading records are prohibited.

16. Personnel and Qualifications

Suppliers should assign personnel with qualifications appropriate to the contracted work.

Suppliers must not materially misrepresent personnel qualifications, certifications, experience, work authorization, or identity.

Personnel changes that materially affect contractual requirements should be communicated according to the applicable agreement.

17. Client Requirements

Where suppliers work on behalf of Igzibo for a client, applicable client requirements must be followed when communicated and contractually applicable.

Suppliers must not make commitments to clients outside their authorized role.

18. Artificial Intelligence

Suppliers must follow applicable restrictions on AI use when processing Igzibo or client information.

Confidential or Restricted information must not be submitted to an AI service unless the service and use case are authorized.

AI-generated work must be reviewed for accuracy, security, confidentiality, intellectual-property, and contractual concerns.

19. Use of Igzibo Branding

Suppliers must not use Igzibo's name, logo, trademarks, client names, project names, or project results in public marketing or portfolios without authorization.

20. Records and Retention

Suppliers must retain relevant business, security, financial, and project records according to applicable contracts and law.

Legal holds and mandatory preservation requirements take precedence over ordinary deletion.

21. Monitoring and Verification

Where permitted by contract and applicable law, Igzibo may assess supplier compliance through:

• Questionnaires.
• Certifications.
• Security documentation.
• Contractual attestations.
• Reviews.
• Audits where contractually authorized.
• Incident investigations.
• Other proportionate verification methods.

22. Corrective Action

When a supplier does not meet applicable requirements, Igzibo may require:

• Remediation.
• Additional controls.
• Training.
• Access restrictions.
• Corrective action plans.
• Increased monitoring.
• Suspension of access.
• Suspension of work.
• Contractual remedies.
• Termination where appropriate.

23. Reporting Concerns

Suppliers should promptly report suspected:

• Bribery.
• Fraud.
• Security incidents.
• Privacy incidents.
• Unauthorized disclosure.
• Conflicts of interest.
• Material misconduct.
• Falsification of records.

Reports should use the reporting channel designated by Igzibo.

24. Non-Retaliation

Igzibo prohibits retaliation for good-faith reporting of concerns or participation in authorized investigations, subject to applicable law.

25. Relationship to Contracts

This Code establishes baseline expectations.

The applicable contract, statement of work, data-processing agreement, client requirement, or other binding agreement may establish more specific or restrictive requirements.

Where requirements conflict, the applicable contractual and legal requirements should be evaluated according to the agreement's precedence provisions and applicable law.

26. References and Research Basis

This Code was informed by:

• Federal Trade Commission, Protecting Personal Information: A Guide for Business
• U.S. Department of Justice and U.S. Securities and Exchange Commission, FCPA Resource Guide

Version History