Eleven frameworks.
One evidence graph.
SOC 2, ISO 27001/27017/27018, HIPAA, PCI DSS, FedRAMP Moderate & High, and GDPR — monitored continuously with agent-produced, span-cited evidence for every claim.
Supported frameworks
Every framework
your vendors hold.
SOC 2
AttestationThe baseline vendor qualification for enterprise SaaS procurement. TrustVendor monitors SOC 2 report currency and extracts exception tables from Type II reports automatically.
Learn moreSOC 2 Type I
AttestationPoint-in-time control design assessment. TrustVendor tracks report date and flags when a Type I has not been followed by a Type II within 12 months.
Learn moreSOC 2 Type II
AttestationOperating effectiveness over a 6–12 month audit period — the gold standard for SaaS vendor attestation. TrustVendor extracts exceptions relevant to your data classes.
Learn moreISO 27001
CertificationInternational standard for information security management systems. Certificates are valid for three years with annual surveillance audits — TrustVendor tracks all three milestones.
Learn moreISO 27017
CertificationCloud-specific security controls extending ISO 27001. Increasingly required for multi-tenant SaaS vendors alongside their primary ISO 27001 certification.
Learn moreISO 27018
CertificationProtection of PII in public clouds. Maps closely to GDPR processor requirements and is commonly required by data protection officers evaluating cloud vendors.
Learn moreHIPAA
RegulatoryUS federal law governing protected health information. TrustVendor tracks BAA availability, HIPAA attestation status, and any disclosed OCR enforcement actions.
Learn morePCI DSS
StandardPayment card data security standard. TrustVendor tracks PCI DSS level, last validation date, and ROC publication for Level 1 merchants.
Learn moreGDPR
RegulatoryEU data protection regulation. TrustVendor monitors DPA availability and subprocessor additions that may affect international transfer compliance.
Learn moreFedRAMP Moderate
Authorization325 NIST 800-53 controls — required for cloud vendors handling moderately sensitive federal data. TrustVendor tracks FedRAMP Marketplace listing and authorization expiry.
Learn moreFedRAMP High
Authorization421 NIST 800-53 controls — required for DoD, law enforcement, and emergency services use cases. Very few commercial SaaS vendors hold this authorization.
Learn moreHow monitoring works
Continuous, cited,
always current.
The Extractor agent reads trust centres, ISO registry lookups, and FedRAMP Marketplace listings on a continuous schedule. Certifications are stored as structured claims with predicate, object, expiry date, and artifact citation.
Every claim carries an evidence half-life. A SOC 2 Type II decays more slowly than a HIPAA self-attestation. Assurance scores reflect evidence age, not just certification presence.
Signals fire 90, 60, and 30 days before any certification in your portfolio lapses. Changes — scope reductions, new exceptions, lapses — are routed within the severity SLA for that framework.
Common questions