◣
Vendor risk tiering
ComplianceGiven a vendor and the data they touch, assign a risk tier and the due-diligence depth required — so you don’t pentest your snack supplier.
The routing recipe
Job typeClassification / routingPolicyBalanced
routes to
GPT-OSS 20B groq
groq:openai/gpt-oss-20b
90.9
match score
84.6
task fit
100
cost
96.4
speed
Why this model from benchmarks & capabilities
- "Classification / routing" leans hardest on instruction; GPT-OSS 20B scores 78/100 there — #23 of 40.
- Strength on this class of work shows up on IFEval, MMLU (zero-shot), where OpenAI (open-weight) models are competitive.
- Cost: free tier. Speed: ~1000 tok/s on Groq LPU.
- Chosen over GPT-OSS 120B for cheaper & faster.
| Capability the job needs | Weight | GPT-OSS 20B | Catalog rank |
|---|---|---|---|
| instruction | 0.90 | #23 of 40 | |
| speed | 0.90 | #1 of 40 | |
| knowledge | 0.30 | #26 of 40 |
Relevant benchmarksIFEval MMLU (zero-shot)
EconomicsCost: free tier.
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over GPT-OSS 120B for cheaper & faster. (GPT-OSS 120B, score 83.9)
Speed: ~1000 tok/s on Groq LPU. vs runner-upChosen over GPT-OSS 120B for cheaper & faster. (GPT-OSS 120B, score 83.9)
Example result
Sample input ▾
Vendor: a transactional email provider that processes customer email addresses and sends on our behalf; has API access to our app.
Tier: High.
Why: processes customer personal data (emails) and holds standing API access to your app — a compromise reaches your users.
Due diligence: SOC 2 Type II review (or ISO 27001), signed DPA with SCCs, a security questionnaire (auth, encryption, breach SLA, sub-processors), and scoped API keys with least privilege. Reassess annually or on a security incident.
Test it on your own data