Skip to content
vendorvett.

Vendor due diligence, without the spreadsheet sprawl.

Send questionnaires vendors actually finish, and keep a record your auditor can recompute by hand.

Start freeSee pricing

Free for three vendors, no card. Or try the free OFAC sanctions check.

app.vendorvett.com/vendors

Vendor portfolio

3 of 24
  • CloudHost LLCcritical60highactive
  • DataPipe Inchigh41mediumunder review
  • PrintRight Comedium12lowprospective

Monitoring

TLS certificate for datapipe.io expires in 5 days

Review brought forward to today

The VendorVett vendor portfolio, with illustrative sample data.
to start
$0to start
vendors free
3vendors free
trial
14-daytrial
vendor logins
0vendor logins

Between a spreadsheet and a six-figure suite

Most small teams run vendor risk in a spreadsheet until a customer or an auditor asks for more. The next step should not need a procurement cycle.

  • The person who inherited vendor risk

    Head of IT, ops lead or founder: own the register, the evidence and the review cadence in a few hours a month.

  • Teams heading into an audit

    Stand up a defensible vendor programme before your first SOC 2, ISO 27001 or ISO 9001 cycle.

  • Regulated suppliers and buyers

    DORA, NIS2, HIPAA and PCI DSS packs for the customer contract that just raised the bar.

Questionnaire packs for

  • NIST CSF
  • SOC 2
  • ISO/IEC 27001
  • GDPR Art. 28
  • ISO 9001
  • DORA
  • NIS2
  • HIPAA
  • PCI DSS

Everything in one defensible record

From the first vendor to the audit, and the questionnaires your own customers send you.

Questionnaires vendors finishEvery plan

A private link instead of an account, and packs for US onboarding on every plan, ISO 9001 from Starter and DORA, NIS2, HIPAA and PCI DSS from Growth. Automatic chasing on every plan.

  • Nothing to sign up for: the link is the credential
  • Reminders on a schedule that ends, not forever
  • Vendors can save answers to reuse with their next customer

From Acme Co · no account needed

DORA ICT Third-Party Questionnaire

11 of 17 answered

Will you notify us of any ICT incident affecting our services within 24 hours?

YesNo
  1. Mon 2 SepQuestionnaire sent
  2. Thu 5 SepReminder 1
  3. Mon 9 SepReminder 2
  4. Wed 11 SepSubmitted and scored
The vendor's view on a phone, and the chase behind it. Sample data.

Monitoring between reviewsGrowth and up

Certificates, email authentication, breaches, news and new CVEs, with an off-cycle reassessment when something serious changes.

  • Passive checks only; nothing scans a vendor's network
  • Every signal is written to the audit trail
  • Signals never change a score, they bring the next review forward
app.vendorvett.com/monitoring
  • CriticalCVE-2026-1234 in nginx, known exploitedDataPipe Inc
  • HighTLS certificate for datapipe.io expires in 5 daysDataPipe Inc
  • Mediumprintright.co publishes no DMARC policyPrintRight Co

DataPipe Inc: next review brought forward to today. Recorded in the audit trail.

Open signals across the portfolio. Sample data.

Your own trust centerEvery plan

Publish your security posture and share documents under NDA on every plan. Draft answers to customers' questionnaires from your own evidence from Starter.

  • Public and NDA-gated documents, with every download logged
  • Drafted answers cite the exact line they came from
  • Nothing is sent until a person approves it
app.vendorvett.com/trust-center

Questionnaire from Buyer Inc

14 of 40 approved

7. Is customer data encrypted at rest?

Draft with sources

Yes. We encrypt all customer data at rest with AES-256.

security-policy.pdf: “All customer data is encrypted at rest using AES-256”

A customer's questionnaire, drafted from your own documents. Sample data.

A risk score is arithmetic, and we show it

The same answers give the same number, every time, and a reader can recompute it by hand. AI can summarise evidence for a person to review; it never sets the score. See how a receipt is verified

  • Each answer's weight and residual risk, line by line
  • Every change written to a hash-chained, append-only audit trail
  • Signed evidence receipts a third party can verify without an account (Business and up)
app.vendorvett.com/assessments/1284

Score working · CloudHost LLC

Deterministic
Example of a score's working
ControlWeightAnswerResidual
MFA on remote and admin access8Yes0
Encryption at rest8Yes0
Incident notice within 24 hours10No10
Tested disaster recovery8No8
Subprocessors with data access6Yes6
Residual risk24 ÷ 40 = 60 / 100
Illustrative example · audit event #1,284 · sha256 9f2c…e41a

And the rest of the toolkit

Each one is marked with the plan it starts on. Compare plans

Risk-tiered inventoryEvery plan
Classify every third party by criticality, and bring in the list you already keep with a CSV import.
Vendor discoveryGrowth and up
Find the apps your people already use from Google Workspace, Entra or an expense export, with a suggested criticality for each.
Scores you can recomputeEvery plan
Deterministic scoring with the working shown, written to a hash-chained audit trail you can browse and verify from Starter.
Shared dependenciesBusiness and up
Subprocessors read from the SOC 2 reports you already hold, and a map of where your vendors rely on the same ones.
Slack, Jira and LinearGrowth and up
Alerts in the channel your team already reads, and a ticket for every finding that needs an owner.
SSO, SCIM, an API and MCPBusiness and up
SAML single sign-on, SCIM provisioning, a REST API and an MCP server for your AI tools.

How it compares

How VendorVett compares with a spreadsheet and an enterprise suite
QuestionSpreadsheetEnterprise TPRM suiteVendorVett
PriceFree, until the auditQuoted; commonly five figures a yearPublished: $0 to $599 a month
Time to first assessmentSame dayAn implementation projectSame day
Vendor needs an accountNo, it is an email threadUsuallyNever: a private portal link
Can an auditor recompute the score?Only if the formula survivedOften a model-written rationaleYes, with every step shown
Tamper-evident historyNoVaries by tierHash-chained on every plan, viewable from Starter

Up and running the same day

Nothing to install and no implementation project.

  1. 110 minutes

    Add your vendors

    Type them in or import a CSV on any plan, or discover the apps already connected to your identity provider from Growth.

  2. 21 click

    Send a questionnaire

    Pick a pack. The vendor answers through a private link, uploads evidence, and is reminded automatically.

  3. 3On demand

    Decide, and prove it

    Review the scored answers, sign off, and export an audit-ready PDF with the full trail behind it.

Priced in public. No sales call.

Start free and stay free for three vendors. Paid plans run from $49 to $599 a month, each with a 14-day trial.

  • Free

    Vendor onboarding and sanctions screening, free for good.

    $0 forever

    1 seat · 3 vendors

    Start free on the Free plan

    No card required

    Includes

    • Vendor onboarding pack
    • Sanctions screening
    • Automated vendor chasing and reminders
    • CSV export
    • Trust center

  • Starter

    For the first handful of vendors a customer asked you to vet.

    $49 /month

    3 seats · 15 vendors

    Start 14-day trial on the Starter plan

    Card required · cancel any time

    Everything in Free, plus

    • ISO 9001:2015 supplier evaluation pack
    • Audit-ready PDF report
    • Hash-chained audit trail
    • AI document analysis

  • Growth

    Most popular

    A real vendor programme, run by one person part-time.

    $199 /month

    8 seats · 40 vendors

    Start 14-day trial on the Growth plan

    Card required · cancel any time

    Everything in Starter, plus

    • Continuous monitoring (lite)
    • Slack alerts
    • Jira and Linear tickets
    • Regulatory packs (DORA, NIS2, HIPAA, PCI DSS)
    • Vendor discovery (Google Workspace, Microsoft Entra)

  • Business

    SSO, API and supply-chain depth for a portfolio in the hundreds.

    $599 /month

    15 seats · 150 vendors

    Start 14-day trial on the Business plan

    Card required · cancel any time

    Everything in Growth, plus

    • SAML single sign-on
    • SCIM provisioning
    • Public API keys
    • Nth-party and concentration risk
    • MCP server
    • Verifiable evidence receipts

Need more vendors? +25 vendors for $50/month on any paid plan.

Enterprise

Custom limits, procurement paperwork and a named contact. Invoiced annually, from $12k/yr.

Talk to usBook a call (opens in a new tab)

On every plan

  • Deterministic, reproducible scoring
  • Account-less vendor portal
  • SOC 2, ISO 27001, NIST CSF and GDPR Art. 28 framework mapping
  • Evidence uploads with antivirus scanning
Compare every feature

Where your vendor data lives

You are being asked to centralise sensitive third-party records. Here is how they are handled.

  • Your data stays yours

    Vendor records, responses and evidence belong to your organisation. We never sell them or train models on them.

  • Scoped to your organisation

    Every record is bound to your workspace, and a vendor answering a questionnaire sees only their own portal link.

  • Encrypted, scanned, verifiable

    TLS in transit, encrypted storage and antivirus-scanned uploads, plus signed evidence receipts anyone can verify without an account (Business and up).

Full detail on our trust page, in the privacy policy and the subprocessor list. If you assess a processor under the GDPR, the Article 28 checklist covers the DPA clauses, standard contractual clauses and sub-processor checks.

Questions worth asking first

What does the free plan include?

One seat and three vendors, with the vendor onboarding pack, sanctions screening, automated chasing, CSV export and your own trust center. No card and no time limit. The audit-ready PDF report, the audit trail viewer and ISO 9001 supplier evaluation start on Starter.

How does the paid trial work?

Starter, Growth and Business start with a 14-day trial. A card is required up front; cancel before it ends and you are not charged. Annual billing gets 2 months free.

Do my vendors need an account?

No. Vendors answer through a private portal link, with no sign-up, no password and no seat to pay for. They can save their answers to reuse with the next customer.

Is the AI metered, and does it decide scores?

Neither. AI document analysis is a flat feature from Starter up. Scores come from a deterministic engine; AI can describe a score for a person to review, never produce one.

Which frameworks do the assessments map to?

NIST CSF, SOC 2, ISO/IEC 27001 and GDPR Art. 28 on every plan, plus packs for vendor onboarding, ISO 9001, DORA, NIS2, HIPAA and PCI DSS.

Can I get my data out?

Yes. Owners export everything as a ZIP with a checksum manifest at any time, and deleting the organisation removes documents from storage after a 30-day grace window.

Guides for the team doing the vetting

All guides

Ready to vet your vendors?

Add your first vendor and send a questionnaire before lunch. Free for three vendors, for good. Paid plans include a 14-day trial.

Get started freeAsk a question