Make a defensible vendor risk decision before the vendor replies.

It investigates a vendor using evidence the vendor doesn't control — whether their certifications appear in the issuing registries, whether they show up on sanctions lists, how their domain and infrastructure are configured, whether there's adverse media or breach history, and who their own subprocessors are. It documents what it found, cites every source, pre-fills the security questionnaire answers the evidence supports, and lists what's still unresolved. What it does not do is decide whether the vendor is acceptable to you. That call, and the record of it, stays with your team.

Often, yes — and that's the point of running the assessment first. Some things are only knowable from the vendor: their current SOC 2 report, contractual commitments, specific data-handling details. ThirdProof answers what public and independent evidence can answer, so the questions you send are short, specific, and hard to deflect, rather than a 133-row spreadsheet the vendor sits on for three weeks.

No, and it isn't trying to be. There's no contract lifecycle tracking, no multi-stage approval chains, no procurement orchestration, and no formal issue-management module with owners and SLAs. ThirdProof does one job: investigate a vendor, document the evidence, and support a defensible decision. If you need program-wide orchestration across hundreds of vendors, an enterprise TPRM platform is the right purchase.

Start with the vendors that would hurt most if they were breached — usually the ones holding customer data, moving money, or sitting inside your production stack. That's typically five to ten companies, not your whole spend list. Assess those, document what you found, and you have the beginning of a defensible program. You do not need a policy, a platform, or a full vendor inventory before you can start.

Yes. The hard part of vendor risk was never judgment, it was legwork — finding the evidence, verifying it, and writing it up in language an auditor recognises. ThirdProof does that part and hands you an assessment that explains what it found and why it matters. You bring the business context: how much data this vendor touches and how much that matters to you.

Vanta and Drata are broad compliance platforms — they automate evidence collection across your whole SOC 2 or ISO 27001 program, with vendor risk as one module inside an annual contract. ThirdProof does vendor risk only, and goes deeper on it. If you already run Vanta or Drata, teams commonly use ThirdProof for the vendor investigations themselves and keep the suite for everything else. If you don't, you can start here without buying a platform.

That's their determination, not ours, and anyone promising otherwise is overselling. What ThirdProof provides is documentation in the form auditors ask for: findings written against the control being tested — SOC 2 CC9.2, HIPAA, PCI-DSS 12.8 — with every finding citing its source, plus the assessment date and methodology version on the record. Where evidence couldn't be retrieved, the assessment says so plainly rather than papering over it.