Data lake
TrustVendor + BigQuery
TrustVendor exports vendor risk data to BigQuery for organizations in the Google Cloud ecosystem, enabling analysis alongside product usage data, financial data, and other business signals.
How data flows
TrustVendor uses the BigQuery Storage Write API to stream vendor risk events in real time and batch-export scores daily to a dataset in your GCP project.
How to set up
- 1 Create a GCP service account with BigQuery Data Editor role.
- 2 Download the JSON key and upload it in TrustVendor under Settings > Data Export > BigQuery.
- 3 Specify your GCP project, dataset, and table prefix.
- 4 Configure real-time streaming for signals and daily batch for scores.
Common questions
Can I query TrustVendor data in Looker via BigQuery?
Yes. The BigQuery export is designed to be queryable via standard SQL. A reference LookML model is available from TrustVendor support.
What is the delivery model — streaming or batch — and how does that affect my BigQuery costs?
TrustVendor uses the BigQuery Storage Write API to stream signal events in real time as they occur, and batches score and certification data once daily via a scheduled export job. Streaming inserts incur BigQuery's per-row streaming cost; at typical signal volumes for a 200-vendor program this is negligible. If you want to reduce streaming costs, you can switch the signals table to batch-only delivery in TrustVendor's export settings, accepting up to a 24-hour delay on signal data in BigQuery.
How does TrustVendor prevent PII in evidence payloads from landing in BigQuery?
The BigQuery export contains only structured claim metadata — predicates, scores, certification fields, signal titles and summaries — not raw crawled document content. TrustVendor's extraction pipeline stores full artifact text in private blob storage accessible only to authorized tenant users via signed snapshot URLs. Nothing from the text_content field in the artifacts table is included in the export.
What GCP permissions does the TrustVendor service account need?
The service account requires the BigQuery Data Editor role on your target dataset and the BigQuery Job User role on the project. TrustVendor does not need viewer access to other datasets or project-level admin permissions. If your organization uses VPC Service Controls, you will need to add the TrustVendor service account to an access policy that permits BigQuery API calls from outside your perimeter.
Can I replay or backfill TrustVendor data into BigQuery if a delivery fails?
Yes. TrustVendor retains event data for 30 days in its internal Kafka topics and claim history indefinitely in its database. If a BigQuery export fails — for example because the service account key expired — you can trigger a manual replay from TrustVendor support covering any window within the retention period. The replay writes events with their original timestamps so time-series analysis in BigQuery remains accurate.