Supplier Code of Conduct
The standards we ask of organisations that supply goods and services to Octopath AI Ltd, mirroring the commitments we make ourselves under our licences and our development process.
1. Scope
This code applies to all suppliers, contractors and their sub-contractors providing goods or services to Octopath AI Ltd, including cloud, software, hardware, data and professional services.
2. Legal compliance and ethics
Suppliers must comply with all applicable laws and codes of practice, including the Bribery Act 2010 and the Modern Slavery Act 2015, and must not offer, give or accept bribes or facilitation payments. Suppliers must disclose any conflict of interest.
3. Tobacco industry
Consistent with the Cancer Research UK Code of Practice on Tobacco Industry Funding, which binds our licences, suppliers must inform us if they are, or become controlled by, a tobacco company or its affiliate.
4. Labour and human rights
Suppliers must not use forced, bonded or child labour, must respect freedom of association, provide safe working conditions and pay at least the legal minimum wage, and must have appropriate policies under the Modern Slavery Act 2015.
5. Information security and data protection
Suppliers handling our data or systems must maintain controls proportionate to ISO 27001, notify us of security incidents without undue delay, comply with UK GDPR and the Data Protection Act 2018 as processors where applicable, and support our vulnerability disclosure timelines (acknowledgement within 2 business days).
6. Software supply chain
Software suppliers must provide licence information for all components, respond to vulnerability reports affecting their products, and support our maintenance of a software bill of materials (CycloneDX) and SOUP records under IEC 62304.
7. Quality and regulatory
Suppliers of components used in medical device software must support our design-control and traceability obligations under ISO 13485 and provide documentation on request.
8. Environment
Suppliers should minimise environmental impact, comply with environmental law and, where relevant, report energy use of hosted services.
9. Reporting concerns
Concerns about a breach of this code may be raised confidentially at [ethics@octopath.ai]. We will not retaliate against anyone raising a concern in good faith.
10. Review
We review this code annually and may audit compliance. Persistent or serious breaches may lead to termination of the supply relationship.
Contact
Questions about this document: info@octopath.ai. Data protection: privacy@octopath.ai. Security: security@octopath.ai.