Registry

Vendors

Every supplier, subprocessor, and service provider your organization depends on — tiered, reviewed on a schedule that matches the risk, and tracked from first review through offboarding.

Tier and risk, tracked separately

Spend your review time where the stakes are, and never confuse how important a vendor is with what an assessment found. Tier each vendor by how much scrutiny it warrants, and let its risk rating move on its own as assessments come in.

Tier drives review depth, so a low-stakes vendor doesn't get a critical-vendor workload
Risk rating reflects findings and changes without touching the tier

Google CloudINFRASTRUCTUREAPPROVED

TIERCriticalSets scrutiny level

RISKINDEPENDENTModerateLowFrom assessments

REVIEW CADENCEQuarterly · next Nov 12LAST ASSESSMENTAug 04 · no findings

A lifecycle that matches reality

No one starts using a vendor before it clears review, and no offboarded vendor vanishes from the audit trail. A vendor stays unapproved for use until the relationship is cleared, and keeps its full record after it ends.

Unvetted vendors stay unapproved for use until review clears them
Offboarded vendors keep their full record for audit coverage

ResendTRANSACTIONAL EMAILFOR USE · OFFFOR USE · ON

DraftJUL 02ReviewJUL 18ApprovedAUG 06OffboardSEP 30TerminatedOCT 14

Record retained after terminationHistory stays available to auditors

Feed the Trust Center

If you publish a trust center, build your public subprocessor list from the vendors you already manage instead of maintaining the same list twice. Keep vendor records current in the registry, and your public disclosures stay current with them.

No second subprocessor list to maintain by hand
Update a vendor once and your public disclosure follows

VENDOR REGISTRY42 VENDORS Stripe

StripeSUBPROCESSOR Cloudflare

CloudflareSUBPROCESSOR Google Cloud

Google CloudSUBPROCESSOR Figma

FigmaINTERNAL ONLY

PUBLISHED FROM THE REGISTRY

PUBLIC SUBPROCESSOR PAGELIVE Stripe

StripePayment processor Cloudflare

CloudflareEdge & storage Google Cloud

Google CloudInfrastructure

Vendor Management

Know who you depend on

Every vendor and subprocessor your platforms rely on stays tiered, current, and audit-ready, from first review through renewal.

Vendor directory

Import your vendor list via CSV and assign a tier to each one based on the data it touches and the blast radius if something goes wrong.

Risk tiering

Tier and risk rating track separately — tier sets your review cadence, risk rating reflects what assessments find, and the two can move independently.

Contract & renewal tracking

See a renewal or auto-renewal coming before it commits you, with the SOC 2 reports and questionnaire responses your due diligence needs on the same record.

Trusted By