This policy governs how Ctrl ("the Company") acquires goods, services, hardware, software, and subcontracted work. It applies to all purchases made by or on behalf of the Company, by any employee or contractor, in every jurisdiction we operate. Its objectives are value for money, supply-chain integrity, operational security, legal compliance, and fair treatment of suppliers.

• Best value: total cost of ownership — price, quality, lead time, support, and lifecycle cost — not lowest price alone.
• Fair competition: suppliers are selected on objective criteria; no favoritism, kickbacks, or undisclosed conflicts of interest.
• Integrity: zero tolerance for bribery or corruption, consistent with the UK Bribery Act, U.S. FCPA, and the Corruption of Foreign Public Officials Act (Canada).
• Ethical supply chains: all suppliers must comply with the Company's Anti-Slavery & Human Trafficking Policy.
• Security: hardware, software, and data suppliers are screened for supply-chain security, data residency, and export-control implications.
• Sustainability: preference for suppliers with credible environmental practices where quality and cost are comparable.

All amounts in CAD, per transaction or committed contract value:

• Up to $1,000 — team-level purchase; retain receipt and record purpose.
• $1,000 – $10,000 — requires approval from the budget owner; at least one written quote.
• $10,000 – $50,000 — requires leadership approval; minimum two competitive quotes or documented sole-source justification.
• Over $50,000 — requires executive approval; formal RFQ/RFP with minimum three bids, or documented sole-source justification signed by an executive.
• Any recurring subscription or multi-year commitment is valued at total contract value for threshold purposes.

• Suppliers are evaluated on capability, quality, price, delivery, financial stability, security posture, and ethics.
• New suppliers complete onboarding: legal entity verification, banking verification (call-back to a known contact to prevent payment fraud), tax documentation, and acceptance of the Supplier Code of Conduct.
• Hardware and connected-device suppliers (drones, docks, sensors, comms) undergo additional review for firmware provenance, data handling, and applicable procurement restrictions in government and defence markets.
• Sanctions and restricted-party screening is performed against applicable UK, U.S. (OFAC), Canadian, and UN lists before engagement.

Competitive bids are the default above $10,000. Sole-source procurement is permitted only where documented: a single supplier can meet a technical or interoperability requirement; urgent operational need where delay creates safety or mission risk; or continuation of existing warranty/support. Sole-source justifications are recorded and retained for audit.

• All purchases above $10,000 require a written contract or purchase order before work begins or goods ship.
• Standard terms include: anti-slavery and anti-bribery warranties, confidentiality, data protection, audit rights, insurance requirements, and termination for cause.
• Only authorized signatories may execute contracts on behalf of the Company.
• Government and defence-related purchases must flow down applicable contract clauses (e.g., FAR/DFARS where relevant, Canadian ITB obligations) to subcontractors.

Personnel involved in procurement must disclose any personal, family, or financial relationship with a current or prospective supplier and recuse themselves from the decision. Gifts or hospitality from suppliers above nominal value (CAD $100) must be declined or disclosed to leadership. Cash or cash equivalents are never acceptable.

• Payments are made only against valid invoices matched to a purchase order or approved authorization (three-way match for goods: PO, receipt, invoice).
• Standard payment terms are net 30 unless otherwise contracted; prompt-payment terms for small suppliers are encouraged.
• Procurement records — quotes, justifications, contracts, approvals, invoices — are retained for a minimum of seven years.
• Procurement activity is subject to periodic internal review; irregularities are escalated to leadership.

Key suppliers are reviewed at least annually against delivery, quality, support, and compliance criteria. Persistent underperformance or any ethics, sanctions, or forced-labour breach triggers a corrective-action plan or termination. Offboarded suppliers have access, data, and credentials revoked promptly.

Exceptions to this policy require written executive approval and are logged. This policy is reviewed annually and updated to reflect changes in law, markets, and Company operations.