Supplier Code of Conduct

About this code

Our customers trust Pistachio AS and its subsidiaries (Pistachio) with their data and their people. That trust depends on the companies we work with too. This code applies to every supplier, vendor, contractor and service provider that works with Pistachio (Supplier), including their employees and subcontractors.

We expect every Supplier to follow the law wherever it operates and to meet this code. Where the law and this code differ, the higher standard applies.

Business ethics

• No bribery or corruption. Never offer, give, ask for or accept an improper advantage, directly or through others.
• Modest gifts only. Gifts and hospitality to Pistachio staff must be modest, transparent and never meant to influence a decision.
• Declare conflicts. Tell us about any conflict of interest that could affect your work with us.
• Fair dealing. Compete fairly, keep accurate records and respect intellectual property.
• Trade rules. Comply with applicable sanctions and export control laws.

People and human rights

• No forced labour, human trafficking or child labour of any kind.
• Pay at least the legal minimum wage, respect legal limits on working hours, and pay overtime fairly.
• Treat people equally, and do not tolerate discrimination or harassment.
• Provide a safe and healthy workplace.
• Respect workers' right to join or not join associations, as local law allows.

Environment

Comply with environmental laws, work to reduce your energy use and emissions, and only make environmental claims you can back up.

Data protection and security

If you handle our data, you must protect it as carefully as we do. We expect you to:

• keep information security policies, backed by your leadership and reviewed regularly,
• manage information security risks, including access control, secure development, vulnerability management, logging and monitoring, protection against malware, and business continuity,
• run background checks, where local law allows, on people who access confidential information,
• keep our information confidential and use it only to deliver your services to us,
• comply with the GDPR and other data protection laws, and only transfer personal data outside the EEA with a lawful safeguard in place,
• tell us without undue delay about any security incident or data breach that could affect us, and
• tell us in advance about material changes to your service, data location or subcontractors.

Responsible AI

We decide whether and how AI is used on our data. You may only use AI on our data where we have approved it in writing, and never to train AI models. AI providers must give us the documentation the EU AI Act requires.

Your own suppliers

Hold your own suppliers and subcontractors to standards at least as high as this code, especially where they handle our data.

Raising concerns

Tell us if you suspect a breach of this code, by Pistachio or anyone working for us. You can raise it with your Pistachio contact or email security@pistachioapp.com. We never tolerate retaliation against anyone who raises a concern in good faith.

Checking compliance

We assess Suppliers before we work with them and review them regularly. We may ask for evidence, such as certifications or questionnaire answers, and we expect you to fix any gaps.

Version history