Vendor oversight that gets a firm all the way to compliant.
Every vendor that touches your clients' information, in one register. A guided program walks the firm from inventory to a filed Reg S-P packet, vendors answer four questions through a link, and what one firm learns about a vendor saves the next one the work.
Free to use. Sign in with your firm's Microsoft account.
What it does
A vendor program your compliance team can stand behind, and finish.
A guided path to Reg S-P compliance
Six phases, in order, from inventory to the filed packet. Most steps are computed from your records; the rest you attest to with a name and a date. The next step is always on screen.
Questionnaires vendors actually answer
Four questions, sent as a link. The vendor answers online with no account, the reply is scored against the red flags, and the record is kept for your exam.
Facts established once, for everyone
When one firm confirms a vendor's SOC 2 or trust center, the next firm sees it. Vendors are offered their own last answers so they only confirm. Documents and firm identities are never shared.
Evidence with expirations
SOC 2 reports, bridge letters, and contracts on each vendor, read by AI to propose their dates, with alerts 90 days before anything lapses. Route them to Teams, Slack, or your own workflow.
Contracts and renewals, in order
Costs, terms, and renewal dates in one register, with notice before an auto-renewing agreement quietly rolls over.
Reports under your own name
Due diligence reviews and the Reg S-P packet print with your firm's logo and your CCO's signature line, designed for the file an examiner reads.
How it works
Six phases. The program tells you which one you are on.
- 1
Set up
Name the compliance owner, pull your team from Microsoft 365.
- 2
Inventory
Import the vendor list from a spreadsheet or add them one by one. Logos appear on their own.
- 3
Classify
Mark which vendors process or host customer information.
- 4
Diligence
Send the four-question check, collect evidence, confirm the 72-hour commitment.
- 5
Written program
Generate the incident response policy and adopt the oversight procedure.
- 6
Keep it running
Alerts route to your team, the packet prints each cycle, records are retained.
The Reg S-P compliance dates have passed. Most firms still keep this in a spreadsheet.
Import the spreadsheet, send the vendors a link, and let the program walk you to a filed packet. Free to use.