Third-party risk management
The vendor risk answer your biggest customer is waiting for.
Enterprise buyers and auditors ask how you manage third-party risk. Vetrail gives you a real answer: a tiered vendor register, security questionnaires vendors complete through a link, reproducible scoring, and an exportable risk register you can hand to anyone who asks.
No credit card. Set up your register in an afternoon.
The problem isn't that you don't care about vendor risk
It's that the work is real and nobody on the team owns it. A spreadsheet goes stale the week it's built. The questionnaire you sent in March never came back. Then a deal reaches security review, or an auditor asks for your register, and the scramble starts.
A register that tiers itself
Add a vendor with what you already know — data access, business impact, annual spend — and Vetrail assigns a criticality tier. Tier 1 vendors get deeper assessments and tighter review cycles, without you deciding case by case.
Questionnaires vendors actually finish
Vendors answer through a tokenized link with no account to create. Choose the 24-control Lite screen or the 54-control Standard assessment covering governance, access, data protection, secure development, cloud, endpoints, incident response, continuity, privacy, subprocessors, compliance, and physical security.
Scoring an auditor can follow
Every rating is computed the same way, every time — weighted controls, defined bands, and critical-control failures that cap a rating no matter how strong the rest looks. Same answers always produce the same score, which is what makes it defensible.
Evidence you can hand over
Export the whole portfolio as a CSV for your own analysis or a formatted PDF risk register for a board pack, a security review, or an auditor's request. Your data stays yours: a full JSON backup is one click away, always.
Built to run itself
The goal is a risk function that operates without a hire. Assessments go out on a cadence, vendors get chased automatically, and you hear about it only when something genuinely needs a decision. That automation is being built now — the register, questionnaires, scoring, and exports are live today.
Pricing
Up to 10 vendors. Full register, both questionnaire templates, scoring, CSV and PDF export, unlimited assessments.
Get startedFor portfolios beyond 10 vendors, with automated assessment cadence, reminder chasing, and escalation. We'll announce pricing before anyone needs to pay.
In developmentA note on what this is, and isn't
Vetrail provides templates, self-assessments, and structure. It does not give compliance or legal advice, and it never tells you that something satisfies a regulation or standard — those conclusions are yours to make. That boundary is deliberate: it's the honest description of what software can responsibly do.