Yes, if you correctly encrypt it to the vendors PGP key then only they can decrypt it.