Vendors
Build your third-party register, tier vendors by risk, send assessments and track reports and expiry dates.
Updated 2026-10-21
The Vendors module is your third-party register.
Set up your vendor register
- Collect the list. Start from finance (who you pay) and IT (what you have SSO or API connections to).
- Import or add vendors. For each, record what they do for you, what data they touch, which systems they connect to and who owns the relationship.
- Tier each vendor by data and access.
- Send assessments to the highest tiers first.
Here is our vendor list: <paste names>. Suggest a risk tier for each based on typical data access, and tell me which assessments to send first.
Risk tiering
| Tier | Typical profile | Review cadence |
|---|---|---|
| Critical | Processes sensitive data or is core to service delivery. | Yearly, with report review. |
| High | Access to internal systems or personal data. | Yearly. |
| Medium | Limited data, replaceable. | Every two years. |
| Low | No data access. | At onboarding. |
These are common defaults; adjust them to your policy.
Assessments
Send security questionnaires, store reports such as SOC 2 or ISO certificates, and track expiry dates. Findings become tasks or remediation items.
Draft a security questionnaire for <vendor>, scaled to their access: they process <data types> and connect to <systems>. Keep it under 30 questions.
Summarize the SOC 2 report I uploaded for <vendor>: audit period, scope, exceptions, and the complementary user entity controls we need to implement.
Contracts
Record DPAs, BAAs and security addenda on the vendor. For HIPAA, every business associate needs a signed BAA.