# First party and third party, explained

> What first, third and fourth party mean for suppliers, software, data, support and cloud, and why the label decides who is accountable when something breaks.

Source: https://docs.lumina-erp.com/first-and-third-parties/first-party-and-third-party-explained/

**In short.** First party is you, or in software the publisher of the platform itself. Third party is any outside business you rely on, and fourth party is the business your third party relies on. The words shift by context, but the question behind them stays the same: who is accountable, under which contract, when this breaks.

First party means you: your own people, systems and capabilities. In software it also means the publisher of the platform and what that publisher ships itself. Third party means any outside business you rely on, from a supplier or a carrier to a tax engine or an ERP add-on. Fourth party means the businesses your third parties rely on, which you usually never sign a contract with. The same words shift across purchasing, software, data, support and the cloud. In every context the label tells you who is accountable, under which contract, when something goes wrong.

## The parties at a glance

| Party | Who it is | Your relationship | Example for a distributor |
|---|---|---|---|
| First party | You, or the platform publisher when the context is software | You control it directly | Your warehouse team, your ERP database, a feature the ERP publisher ships and supports |
| Second party | The other side of a direct deal | A direct contract or transaction | A customer buying from you, a supplier selling to you |
| Third party | An outside business that serves you or sits between you and the second party | A contract you sign with them | A 3PL, a payment processor, an EDI provider, an add-on vendor |
| Fourth party | A business your third party relies on | Usually none. You depend on them through your third party's contract | The cloud host behind your add-on, the carrier your 3PL books |
| Nth party | Everyone further down the chain | None | The data center power provider behind that cloud host |

"Second party" is the least used term. In most business writing, "third party" means anyone outside your own company who is not the customer or supplier on the other side of the deal, and "vendor" is used loosely for any of them.

## The same word in five contexts

The labels move depending on whether you are talking about purchasing, software, data, support or the cloud. This table is the one to keep.

| Context | First party | Second party | Third party | Fourth party |
|---|---|---|---|---|
| Vendors and suppliers | Your own purchasing, receiving and stock | The manufacturer or supplier you buy from | Anyone helping the deal happen: a manufacturer rep, a buying group, a freight carrier, a factor | The supplier's own suppliers, the carrier's subcontracted driver |
| Software platform | Native features of the ERP, shipped and supported by the publisher | You, the licensee (rarely called this) | An independent software vendor (ISV) add-on, a marketplace app, a connector built by someone other than the publisher | The libraries, hosting and APIs the add-on depends on |
| Data | Data you collect directly: orders, invoices, customer contacts, web activity on your own site | Data a partner shares with you directly, such as a supplier's sell-through or a customer's forecast | Data you buy or receive from a business that collected it elsewhere: credit reports, prospect lists, product content feeds | The original sources a data broker compiled from |
| Support | Your own help desk and super users | The ERP publisher's support desk | The implementation partner, the add-on vendor, your managed service provider | Whoever those providers escalate to |
| Cloud | Your own servers and staff | The cloud or SaaS provider you contract with | Anything that provider runs on or ships you through (often called a subprocessor) | The subprocessors' own providers |

:::tip[One question fixes the ambiguity]
When someone says "third party" in a meeting, ask "third party to whom, and who signs the contract with them?" Much vendor confusion comes from two people using the same word from different seats.
:::

## Software: native, add-on, ISV, marketplace and SaaS

In ERP work the first party is the software publisher, and "first-party" features are the ones the publisher builds, documents, tests with each release and supports through its own help desk. Everything else is third party, however tightly it is integrated.

| Term | What it means | Who supports it | Upgrade risk |
|---|---|---|---|
| Native feature | Built and shipped by the ERP publisher | The publisher | Lowest. Tested with each release |
| Publisher-built integration | A connector or module the publisher sells separately | The publisher | Low, but check it is on the same release cycle |
| ISV add-on | A product from an independent software vendor that extends the ERP | The ISV | Medium. The ISV must certify each new ERP release |
| Marketplace app | An ISV product listed in the publisher's app marketplace | The ISV, sometimes with a publisher review at listing | Medium. A listing is not the same as support by the publisher |
| Partner-built customization | Code, reports or rules a consultant writes for you | The partner, under a services contract, or you once it is handed over | Highest. Nobody tests it with the next release unless you pay for it |
| SaaS | Software you use over the internet, run by the provider | The provider | Provider controls timing. You adapt to their release schedule |
| Your own build | Scripts, reports and integrations your staff write | You | Depends on your documentation and on who still works there |

A useful habit is to label every component in your system map as first party, third party or your own build. When an upgrade is planned, the third-party and own-build rows are your test list. The [ERP add-ons and ISVs page](/first-and-third-parties/erp-add-ons-and-isvs/) goes deeper.

### An example

A mid-sized electrical distributor (invented) runs its ERP with four extras: a tax engine, an EDI provider, a sales-rep mobile app and a custom freight-quote screen a former consultant wrote. The ERP publisher supports none of the four. When the ERP moves to a new release, each vendor must confirm compatibility, and the freight-quote screen has no vendor at all. That last one is the item most likely to stop shipping on the Monday after an upgrade.

## Data: first party, second party and third party

Marketing and privacy writing uses the same labels for data, based on who collected it.

| Data type | Who collected it | Distributor examples | Main watch-outs |
|---|---|---|---|
| First-party data | You, directly from your customers and operations | Order history, pricing, customer contacts, web store behavior | Accuracy and consent at collection. You own the quality problem |
| Second-party data | A partner, shared with you directly | Supplier sell-through or rebate data, a customer's usage forecast, buying group purchase data | The sharing agreement: what you may use it for and for how long |
| Third-party data | A business that collected it elsewhere and sells or licenses it | Credit bureau reports, prospect lists, manufacturer product content through a syndication service | Licensing limits, freshness and privacy law on how it was gathered |

Privacy law uses its own definitions, and they do not line up exactly with the marketing ones. In paraphrase, the EU General Data Protection Regulation distinguishes a controller (who decides why and how personal data is processed), a processor (who processes it on the controller's behalf) and a third party (anyone else authorized to process it). Article 28 requires a written contract with each processor and the controller's authorization before a processor brings in a subprocessor. California's privacy law separately distinguishes service providers and contractors, which process personal information for a business under contract, from third parties. The California Privacy Protection Agency regulations set out what those contracts must contain.

:::caution[Not legal advice]
Whether a given vendor is a processor, service provider, contractor or third party under a privacy law depends on the facts and the contract. Involve counsel before relying on a classification, especially if you sell to consumers or hold data about EU or California residents.
:::

## Support: who you call, and who they call

Every third party adds a hop to the support path. In a familiar failure pattern, the ERP publisher says the add-on is the problem, the add-on vendor says the ERP changed and the partner who configured both is on another project.

| Symptom | First call | Likely owner |
|---|---|---|
| A native ERP screen errors after an update | ERP publisher support, or your partner if they front support | The publisher |
| Tax is wrong on an invoice | Your own admin, then the tax engine vendor | Your tax setup, the tax engine or the connector between them |
| An EDI order never arrives | EDI provider | The trading partner, the provider or the ERP import job |
| A custom report is blank | Whoever wrote it | You, if nobody is under contract for it |
| The hosted ERP is slow | Hosting or cloud provider | The host, the network or a runaway report of your own |

Write this table for your own business. It is the most useful single page an administrator can hand a new help desk hire.

## Cloud: the shared responsibility split

When you move to hosted or SaaS software, some layers move to the provider and some stay with you. CISA's Cloud Security Technical Reference Architecture (version 2, June 2022, retrieved 2026-09-28) describes this as a shared model for cloud adoption. The general split below is the common convention, and each provider publishes its own version.

| Layer | On premises | Infrastructure as a service | Platform as a service | Software as a service |
|---|---|---|---|---|
| Physical data center, hardware | You | Provider | Provider | Provider |
| Operating system, patches | You | You | Provider | Provider |
| Database and application runtime | You | You | Provider | Provider |
| Application configuration | You | You | You | Shared: provider builds it, you set it |
| Users, roles and access | You | You | You | You |
| Your data and its classification | You | You | You | You |

The bottom two rows never move. A SaaS provider will not notice that a departed employee still has a login, and no cloud contract makes the provider responsible for data you entered wrong.

## Why the label matters

The table sets out what changes when a component is first party or third party.

| Concern | Why first or third party changes the answer |
|---|---|
| Accountability | You cannot outsource accountability (see the banking guidance below) |
| Contracts | Each third party is a separate contract with its own terms for service levels, liability caps, data rights and exit. First-party features ride on your main license |
| Risk | Each third party is another place data lives, another login, another company that can fail |
| Upgrade path | Native features move with the platform. Third-party pieces must be recertified, and your own builds must be retested by you |
| Cost | Third-party cost is visible on invoices. First-party cost is hidden in salaries and time, which is why build-versus-buy comparisons often understate it |
| Exit | Leaving a native feature means leaving the platform. Leaving a third party means data export, a replacement and a cutover |

Banking regulators state the accountability point plainly. The 2023 Interagency Guidance on Third-Party Relationships (Federal Reserve SR 23-4, June 7, 2023, retrieved 2026-09-28) says that using a third party does not reduce a bank's responsibility for an activity compared with doing it in-house. The same logic applies to your customers' view of you. On risk, NIST CSF 2.0 (February 2024) puts cybersecurity supply chain risk management, category GV.SC, inside its Govern function for the same reason.

## Questions to ask about any component

- Is this first party, a third party or our own build?
- Who do we call when it breaks, and who do they call?
- Which contract covers it, and when does that contract renew?
- What data does it hold or see, and who else (fourth parties) touches that data?
- What happens to it at our next ERP upgrade?
- If the provider disappeared tomorrow, how would we get our data and keep shipping?

## Red flags

- Nobody can say whether a feature is native or an add-on.
- A "partner-certified" or "marketplace" label is treated as support from the publisher.
- Customizations with no named owner and no documentation.
- A vendor that will not name its own hosting provider or subprocessors.
- Support tickets that bounce between two vendors for more than a week.

## Map your own components

- [ ] **List every component.** One line per system, add-on, integration, service and outsourced function.
- [ ] **Label each one.** First party, third party or own build, plus the contract and the owner inside your business.
- [ ] **Write the support path.** Who you call and who they escalate to, for your top ten failure points.
- [ ] **Mark the upgrade exposure.** Every third-party and own-build row is on the test plan for your next release.

The rest of this section follows a third-party relationship from decision to exit.

| Group | Pages |
|---|---|
| Foundations | [Build, buy or partner](/first-and-third-parties/build-buy-or-partner/); [The third-party landscape for distributors](/first-and-third-parties/the-third-party-landscape-for-distributors/); [Lessons from other industries](/first-and-third-parties/lessons-from-other-industries/) |
| Lifecycle | [Choosing a vendor](/first-and-third-parties/choosing-a-vendor/); [Contracts, SLAs and data rights](/first-and-third-parties/contracts-slas-and-data-rights/); [Managing vendors after go-live](/first-and-third-parties/managing-vendors-after-go-live/); [Leaving a vendor](/first-and-third-parties/leaving-a-vendor/) |
| Risk and security | [Third-party risk management](/first-and-third-parties/third-party-risk-management/); [Security and data sharing with vendors](/first-and-third-parties/security-and-data-sharing-with-vendors/); [Fourth parties and concentration risk](/first-and-third-parties/fourth-parties-and-concentration-risk/); [Vendor due diligence checklist](/first-and-third-parties/vendor-due-diligence-checklist/) |
| Relationship types | [ERP add-ons and ISVs](/first-and-third-parties/erp-add-ons-and-isvs/); [Implementation partners and consultants](/first-and-third-parties/implementation-partners-and-consultants/); [Logistics providers and 3PLs](/first-and-third-parties/logistics-providers-and-3pls/); [Outsourced business services](/first-and-third-parties/outsourced-business-services/); [Selling through others](/first-and-third-parties/selling-through-others/) |

## Sources

- [Regulation (EU) 2016/679, General Data Protection Regulation, Articles 4 and 28 (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [California Consumer Privacy Act (California Attorney General)](https://oag.ca.gov/privacy/ccpa)
- [California Privacy Protection Agency, regulations](https://cppa.ca.gov/regulations/)
- [Cloud Security Technical Reference Architecture, version 2, June 2022 (CISA, USDS, FedRAMP)](https://www.cisa.gov/resources-tools/resources/cloud-security-technical-reference-architecture)
- [Interagency Guidance on Third-Party Relationships: Risk Management, SR 23-4 (Federal Reserve, June 7, 2023)](https://www.federalreserve.gov/supervisionreg/srletters/SR2304.htm)
- [Interagency Guidance on Third-Party Relationships: Risk Management (Federal Register, June 9, 2023)](https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)
- [The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024)](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)

---

Epicor, Prophet 21, P21 and DynaChange are trademarks or registered trademarks of Epicor Software Corporation registered in the United States and other countries. Kinetic is a trademark of Epicor Software Corporation. Lumina ERP is an independent consultancy and is not affiliated with, sponsored by or endorsed by Epicor.