Contacts

Contacts are Openlane's directory of external people: the security lead at a vendor, the point of contact at a subprocessor, the recipient of a questionnaire campaign. They are distinct from personnel, which is your own workforce roster, and from Openlane users, which are platform accounts.

Keeping these people as records serves two purposes. Questionnaires, incident notifications, and renewal conversations need a current, named recipient at each vendor. And vendor review controls are partly communication records: an auditor testing your third-party program looks for evidence of who you engaged and when, which is only retrievable if outreach history lives on the record rather than in individual inboxes.

How Contacts Work

A contact record carries the person's details plus a status, so the directory can distinguish current points of contact from historical ones without deleting anything.

Synced contact records stay tied to their upstream source, so repeat ingests update the existing record instead of creating duplicates or drifting into hand-maintained copies.

What makes a contact useful is what it connects to. A contact relates to the vendor entities they represent, and to the campaigns that target them, including the per-recipient campaign target records that track each send and its completion. That means outreach history accumulates on the contact: which questionnaires they received, when, and what happened. For the complete field list, see the GraphQL object reference.

Working with Contacts

Attach Contacts to Vendor Records

For each vendor entity, record the people who matter to the relationship: the security contact for questionnaires and incident notifications, and the account contact for commercial questions. Capturing titles matters more than it looks; when a questionnaire stalls, "Security Lead" versus "Account Manager" tells the analyst who to escalate to. A contact can relate to more than one entity, which handles consultants and agency staff who represent several vendors. To load a vendor's contacts in one go, open the vendor's Contacts tab and select Bulk Upload. To load contacts across vendors, use Import contacts. See Import data from CSV.

Target Campaigns at the Right People

When a vendor review comes due, target the assessment campaign at the vendor's contact rather than a generic address. Each recipient gets a campaign target record tracking their individual status, so you can see who has responded, resend to whoever has not, and keep the completion record attached to both the campaign and the contact. Next year's review can then start from last year's engagement history.

Keep the Directory Honest

Contacts go stale faster than any other registry record because you do not control the churn. Build a habit into your vendor review cadence: when a review runs, confirm the contact still holds the role. When someone leaves the vendor, set their record to Inactive or Deactivated and add their replacement rather than editing the old record into a new person; overwriting a contact rewrites your outreach history, while retiring it preserves who you actually corresponded with.

FAQ

When is someone a contact versus an identity holder?

Use a contact for people outside your organization whom you correspond with: vendor security leads, subprocessor points of contact, questionnaire recipients. Use an identity holder for people in your workforce, including contractors, because they are subject to your access, training, and offboarding controls. The same campaign machinery can target both, but they answer different audit questions: "who did we engage at the vendor" versus "who works in our environment".

Can one contact belong to several vendors?

Yes. Contacts relate to entities as a many-sided relationship, so a consultant or agency representative who speaks for multiple vendors is one contact related to several entities, and their outreach history stays consolidated on that single record.

What should I do when a vendor contact leaves?

Set the contact's status to Inactive or Deactivated and create a new record for the replacement. Do not repurpose the old record with a new name and email: campaign targets and correspondence history reference that record, and editing it into a different person quietly falsifies who you engaged during past reviews.

Examples

CSV

# Create
FullName,Email,Title,Company,Status
Dana Whitmore,[email protected],Security Lead,Stripe,ACTIVE
Sam Okafor,[email protected],Account Manager,Amazon Web Services,ACTIVE

# Update
ID,Title,Status
CTC01J9ABCD111111111111111,Head of Security,ACTIVE

GraphQL

mutation {
  createContact(
    input: {
      fullName: "Dana Whitmore"
      email: "[email protected]"
      title: "Security Lead"
      company: "Stripe"
    }
  ) {
    contact {
      id
      fullName
    }
  }
}

mutation {
  updateContact(
    id: "CTC01J9ABCD111111111111111"
    input: {
      title: "Head of Security"
    }
  ) {
    contact {
      id
      title
    }
  }
}

Go Client

ctx := context.Background()

fullName := "Dana Whitmore"
email := "[email protected]"
title := "Security Lead"

_, err := client.CreateContact(ctx, graphclient.CreateContactInput{
	FullName: &fullName,
	Email:    &email,
	Title:    &title,
})
if err != nil {
	return err
}

CLI

openlane contact create \
  --name "Dana Whitmore" \
  --email "[email protected]" \
  --title "Security Lead" \
  --company "Stripe"

openlane contact update \
  --id "CTC01J9ABCD111111111111111" \
  --title "Head of Security"