First party and third party, explained

First party means you: your own people, systems and capabilities. In software it also means the publisher of the platform and what that publisher ships itself. Third party means any outside business you rely on, from a supplier or a carrier to a tax engine or an ERP add-on. Fourth party means the businesses your third parties rely on, which you usually never sign a contract with. The same words shift across purchasing, software, data, support and the cloud. In every context the label tells you who is accountable, under which contract, when something goes wrong.

The parties at a glance

Party	Who it is	Your relationship	Example for a distributor
First party	You, or the platform publisher when the context is software	You control it directly	Your warehouse team, your ERP database, a feature the ERP publisher ships and supports
Second party	The other side of a direct deal	A direct contract or transaction	A customer buying from you, a supplier selling to you
Third party	An outside business that serves you or sits between you and the second party	A contract you sign with them	A 3PL, a payment processor, an EDI provider, an add-on vendor
Fourth party	A business your third party relies on	Usually none. You depend on them through your third party's contract	The cloud host behind your add-on, the carrier your 3PL books
Nth party	Everyone further down the chain	None	The data center power provider behind that cloud host

"Second party" is the least used term. In most business writing, "third party" means anyone outside your own company who is not the customer or supplier on the other side of the deal, and "vendor" is used loosely for any of them.

The same word in five contexts

The labels move depending on whether you are talking about purchasing, software, data, support or the cloud. This table is the one to keep.

Context	First party	Second party	Third party	Fourth party
Vendors and suppliers	Your own purchasing, receiving and stock	The manufacturer or supplier you buy from	Anyone helping the deal happen: a manufacturer rep, a buying group, a freight carrier, a factor	The supplier's own suppliers, the carrier's subcontracted driver
Software platform	Native features of the ERP, shipped and supported by the publisher	You, the licensee (rarely called this)	An independent software vendor (ISV) add-on, a marketplace app, a connector built by someone other than the publisher	The libraries, hosting and APIs the add-on depends on
Data	Data you collect directly: orders, invoices, customer contacts, web activity on your own site	Data a partner shares with you directly, such as a supplier's sell-through or a customer's forecast	Data you buy or receive from a business that collected it elsewhere: credit reports, prospect lists, product content feeds	The original sources a data broker compiled from
Support	Your own help desk and super users	The ERP publisher's support desk	The implementation partner, the add-on vendor, your managed service provider	Whoever those providers escalate to
Cloud	Your own servers and staff	The cloud or SaaS provider you contract with	Anything that provider runs on or ships you through (often called a subprocessor)	The subprocessors' own providers

One question fixes the ambiguity

When someone says "third party" in a meeting, ask "third party to whom, and who signs the contract with them?" Much vendor confusion comes from two people using the same word from different seats.

Software: native, add-on, ISV, marketplace and SaaS

In ERP work the first party is the software publisher, and "first-party" features are the ones the publisher builds, documents, tests with each release and supports through its own help desk. Everything else is third party, however tightly it is integrated.

Term	What it means	Who supports it	Upgrade risk
Native feature	Built and shipped by the ERP publisher	The publisher	Lowest. Tested with each release
Publisher-built integration	A connector or module the publisher sells separately	The publisher	Low, but check it is on the same release cycle
ISV add-on	A product from an independent software vendor that extends the ERP	The ISV	Medium. The ISV must certify each new ERP release
Marketplace app	An ISV product listed in the publisher's app marketplace	The ISV, sometimes with a publisher review at listing	Medium. A listing is not the same as support by the publisher
Partner-built customization	Code, reports or rules a consultant writes for you	The partner, under a services contract, or you once it is handed over	Highest. Nobody tests it with the next release unless you pay for it
SaaS	Software you use over the internet, run by the provider	The provider	Provider controls timing. You adapt to their release schedule
Your own build	Scripts, reports and integrations your staff write	You	Depends on your documentation and on who still works there

A useful habit is to label every component in your system map as first party, third party or your own build. When an upgrade is planned, the third-party and own-build rows are your test list. The ERP add-ons and ISVs page goes deeper.

An example

A mid-sized electrical distributor (invented) runs its ERP with four extras: a tax engine, an EDI provider, a sales-rep mobile app and a custom freight-quote screen a former consultant wrote. The ERP publisher supports none of the four. When the ERP moves to a new release, each vendor must confirm compatibility, and the freight-quote screen has no vendor at all. That last one is the item most likely to stop shipping on the Monday after an upgrade.

Data: first party, second party and third party

Marketing and privacy writing uses the same labels for data, based on who collected it.

Data type	Who collected it	Distributor examples	Main watch-outs
First-party data	You, directly from your customers and operations	Order history, pricing, customer contacts, web store behavior	Accuracy and consent at collection. You own the quality problem
Second-party data	A partner, shared with you directly	Supplier sell-through or rebate data, a customer's usage forecast, buying group purchase data	The sharing agreement: what you may use it for and for how long
Third-party data	A business that collected it elsewhere and sells or licenses it	Credit bureau reports, prospect lists, manufacturer product content through a syndication service	Licensing limits, freshness and privacy law on how it was gathered

Privacy law uses its own definitions, and they do not line up exactly with the marketing ones. In paraphrase, the EU General Data Protection Regulation distinguishes a controller (who decides why and how personal data is processed), a processor (who processes it on the controller's behalf) and a third party (anyone else authorized to process it). Article 28 requires a written contract with each processor and the controller's authorization before a processor brings in a subprocessor. California's privacy law separately distinguishes service providers and contractors, which process personal information for a business under contract, from third parties. The California Privacy Protection Agency regulations set out what those contracts must contain.

Not legal advice

Whether a given vendor is a processor, service provider, contractor or third party under a privacy law depends on the facts and the contract. Involve counsel before relying on a classification, especially if you sell to consumers or hold data about EU or California residents.

Support: who you call, and who they call

Every third party adds a hop to the support path. In a familiar failure pattern, the ERP publisher says the add-on is the problem, the add-on vendor says the ERP changed and the partner who configured both is on another project.

Symptom	First call	Likely owner
A native ERP screen errors after an update	ERP publisher support, or your partner if they front support	The publisher
Tax is wrong on an invoice	Your own admin, then the tax engine vendor	Your tax setup, the tax engine or the connector between them
An EDI order never arrives	EDI provider	The trading partner, the provider or the ERP import job
A custom report is blank	Whoever wrote it	You, if nobody is under contract for it
The hosted ERP is slow	Hosting or cloud provider	The host, the network or a runaway report of your own

Write this table for your own business. It is the most useful single page an administrator can hand a new help desk hire.

Cloud: the shared responsibility split

When you move to hosted or SaaS software, some layers move to the provider and some stay with you. CISA's Cloud Security Technical Reference Architecture (version 2, June 2022, retrieved 2026-09-28) describes this as a shared model for cloud adoption. The general split below is the common convention, and each provider publishes its own version.

Layer	On premises	Infrastructure as a service	Platform as a service	Software as a service
Physical data center, hardware	You	Provider	Provider	Provider
Operating system, patches	You	You	Provider	Provider
Database and application runtime	You	You	Provider	Provider
Application configuration	You	You	You	Shared: provider builds it, you set it
Users, roles and access	You	You	You	You
Your data and its classification	You	You	You	You

The bottom two rows never move. A SaaS provider will not notice that a departed employee still has a login, and no cloud contract makes the provider responsible for data you entered wrong.

Why the label matters

The table sets out what changes when a component is first party or third party.

Concern	Why first or third party changes the answer
Accountability	You cannot outsource accountability (see the banking guidance below)
Contracts	Each third party is a separate contract with its own terms for service levels, liability caps, data rights and exit. First-party features ride on your main license
Risk	Each third party is another place data lives, another login, another company that can fail
Upgrade path	Native features move with the platform. Third-party pieces must be recertified, and your own builds must be retested by you
Cost	Third-party cost is visible on invoices. First-party cost is hidden in salaries and time, which is why build-versus-buy comparisons often understate it
Exit	Leaving a native feature means leaving the platform. Leaving a third party means data export, a replacement and a cutover

Banking regulators state the accountability point plainly. The 2023 Interagency Guidance on Third-Party Relationships (Federal Reserve SR 23-4, June 7, 2023, retrieved 2026-09-28) says that using a third party does not reduce a bank's responsibility for an activity compared with doing it in-house. The same logic applies to your customers' view of you. On risk, NIST CSF 2.0 (February 2024) puts cybersecurity supply chain risk management, category GV.SC, inside its Govern function for the same reason.

Questions to ask about any component

• Is this first party, a third party or our own build?
• Who do we call when it breaks, and who do they call?
• Which contract covers it, and when does that contract renew?
• What data does it hold or see, and who else (fourth parties) touches that data?
• What happens to it at our next ERP upgrade?
• If the provider disappeared tomorrow, how would we get our data and keep shipping?

Red flags

• Nobody can say whether a feature is native or an add-on.
• A "partner-certified" or "marketplace" label is treated as support from the publisher.
• Customizations with no named owner and no documentation.
• A vendor that will not name its own hosting provider or subprocessors.
• Support tickets that bounce between two vendors for more than a week.

Map your own components

• List every component. One line per system, add-on, integration, service and outsourced function.
• Label each one. First party, third party or own build, plus the contract and the owner inside your business.
• Write the support path. Who you call and who they escalate to, for your top ten failure points.
• Mark the upgrade exposure. Every third-party and own-build row is on the test plan for your next release.

The rest of this section follows a third-party relationship from decision to exit.

Group	Pages
Foundations	Build, buy or partner; The third-party landscape for distributors; Lessons from other industries
Lifecycle	Choosing a vendor; Contracts, SLAs and data rights; Managing vendors after go-live; Leaving a vendor
Risk and security	Third-party risk management; Security and data sharing with vendors; Fourth parties and concentration risk; Vendor due diligence checklist
Relationship types	ERP add-ons and ISVs; Implementation partners and consultants; Logistics providers and 3PLs; Outsourced business services; Selling through others