Our mission
Vendor trust should be verifiable, not assumed.
TrustVendor is the evidence layer for vendor risk. Every claim about a vendor in our system — every certification, every subprocessor, every control assertion — is backed by a specific span in a specific document, timestamped and hashed. No assertion without a source.
Security rating products tell you how a vendor's internet footprint looks from the outside. That is a useful signal. But it does not tell you what changed in the SOC 2 you relied on last quarter, whether the subprocessor your DPA covers has been replaced, or whether the HIPAA BAA you signed still covers the entity now processing your patients' data.
TrustVendor was built to answer those questions — not with a grade, but with a citation. The grade compresses nuance. The citation is the thing itself.
How we operate
Agents produce claims, never numbers.
Our AI agents extract structured claims from vendor documents. Scoring is deterministic arithmetic over those claims — versioned and replayable. No model is ever involved in computing a score. This means every score movement can be explained from first principles.
Every claim cites a hashed snapshot.
No claim exists without an artifact_id and a character range pointing to the exact source. Snapshots are sha256-hashed before processing. You can verify the hash client-side — no trust required.
Evidence decays explicitly.
A SOC 2 from last month is stronger evidence than one from fourteen months ago. We model this explicitly with decay curves tuned per evidence type. Freshness is shown in the UI, not hidden behind a static rating.
The score reflects your relationship.
The same vendor poses different residual risk depending on what data you share with them. Residual risk is computed per relationship, not per vendor, based on the data classes and integration scope you configure.
Work with us or talk to us.
We are hiring across engineering, research, and GTM. And we always want to talk to compliance teams building programs with evidence at the center.