Vendor Risk
The TPRM workspace where agent-produced evidence meets human judgment — portfolio view, per-relationship residual risk, and a signals inbox that only fires when something material changes.
What it is
Vendor Risk — in detail.
Vendor Risk is TrustVendor's third-party risk management workspace. The portfolio view ranks every monitored vendor by residual risk — a deterministic score computed from agent-produced claims filtered to the data classes, integration scope, and geography you actually share with that vendor. Two customers of the same vendor can hold very different residual risk scores because the score is relationship-scoped, not global. Score movements are always explainable: every component traces to a specific agent-produced claim with an artifact ID and a sha256-verified snapshot.
The signals inbox surfaces what the Extractor and Triage agents flagged as material since your last review. A SOC 2 scope reduction that strips the Confidentiality criterion from a vendor processing your PII is critical. The same change for a vendor you share no data with is informational. The Triage agent makes that distinction automatically from your relationship configuration — severity and SLA are deterministic outputs, not editorial judgments. Every signal row carries the artifact ID and extractor version that produced it, so you can open the evidence drawer from the inbox and see the exact source sentence the agent read.
The evidence viewer is embedded in every vendor profile. When you open a certification claim, you see the source text with the supporting sentence highlighted, the artifact ID, the sha256 of the stored snapshot, and the extractor version that produced the claim. Verification runs client-side in one click — the computation runs in the browser against the live storage backend, not against a value TrustVendor supplies. When your auditor asks for primary evidence, you present a hash-linked snapshot that is reproducible from the sha256 alone.
How it works
Three steps,
fully auditable.
Add a vendor by domain name. The Resolver agent builds the identity graph, links to existing public evidence, and initiates monitoring. Import your whole register by CSV or sync from your GRC platform. Identities below 0.8 confidence enter the human review queue before any claims are written.
Set data classes, integration criticality, and geographic scope for each relationship. These parameters feed the Triage agent's materiality decisions and the deterministic residual risk computation. The same vendor can carry different risk levels across different parts of your organization.
Continuous evidence collection, signal delivery, and score updates run automatically. Your team engages when agents flag something for human review — a low-confidence identity, an unverified critical claim, or a score threshold breach. Reviews are driven by agent output, not by calendar.
What you get
Built for teams that
have to prove things.
Portfolio by residual risk
Every vendor ranked by the risk it poses to your specific data exposure. Score badges show posture and assurance from agent-produced claims. The signals inbox shows what the Triage agent flagged as material today.
Embedded evidence viewer
Every claim in a vendor profile links to the exact character span in the hashed, immutable snapshot that backs it. Hash verification runs client-side — your auditors compute the result themselves, no trust in TrustVendor required.
Human-in-the-loop review queue
Entity resolutions below 0.8 confidence, unverified critical claims, and Verifier-flagged findings enter a review queue. Your team decides — and the decision is logged against the agent version that raised the flag.
What the agents will never do
Agent guarantees,
in plain terms.
Agents produce claims, never numbers. Scoring is deterministic Go arithmetic over those claims — models never run in the scoring path.
Every claim cites a hashed, immutable snapshot span. No claim is written to the database without an artifact_id and a validated quote hash.
Extractor agents are prompt-versioned. Every claim records the prompt file, model, and schema version that produced it. A regression is a rollback, not a data loss.
The Analyst agent's system prompt forbids it from asserting a fact it cannot cite. Warnings surface in the response envelope when tool results are incomplete — the answer is never silently filtered.
Sample
What it looks
like in practice.
Common questions
Answered plainly.
How does residual risk differ from the posture score?
How do signals get routed to my team?
Can I send evidence requests to vendors directly from the workspace?
What happens when a vendor relationship ends?
How do you handle vendors that are subsidiaries of other monitored vendors?
See it live
Vendor Risk
on your vendors.
Book a 30-minute demo. We’ll run it live on vendors from your register — not demo data.