For banks, credit unions and mortgage lenders
Walk into your next exam with your vendor program in order.
VendorRisk is third-party risk management software built for regulated financial institutions. Every vendor, contract, review and approval is documented, current and ready to hand to an examiner, with no IT project required.
- Plans from $8,000 per year
- Unlimited users
- No long-term contract
Not a financial institution? See how other industries use VendorRisk →
The complete third-party risk lifecycle, documented at every stage
From pre-contract due diligence to offboarding, VendorRisk gives you the structured workflows and audit trail your regulators expect at every phase of the vendor relationship.
Onboarding
Complete risk assessments, collect required documentation, and route for approval before a vendor goes live — so nothing is missed and everything is on record.
Ongoing oversight
Monitor performance, track contracts and expirations, collect annual due diligence, and maintain continuous oversight across your entire vendor portfolio.
Offboarding
Document every vendor offboarding — data return, access termination, and contract closure — with a complete examiner-ready record.
Assess and review risk
Due diligence your examiners can't fault
Build structured questionnaires, collect vendor responses through a secure guest portal, score submissions automatically, and route them for committee approval.
- Rules flag answers that need follow-up, and your reviewer can turn any of them into a remediation item
- AI drafts answers from the vendor's documents; your reviewer decides what to keep
- Launch reviews in bulk from any filtered report
How a review runs
Build the questionnaire
Unlimited questionnaires, with skip logic, tiered to vendor risk.The vendor responds
In the guest portal, with save and resume.Score and flag
Scoring grades the submission; rules flag what needs follow-up.Approve and document
Committee sign-off, with the decision on the record.
Know your third parties
Contracts, documents and deadlines that don't slip
Track agreements, 40+ contract provisions, SLAs and insurance certificates in one place. Email alerts arrive at 8 AM each weekday in your site's time zone.
Report to your board and examiners
See where your program stands before an examiner does
Turn on vendor grading and each vendor record gets a letter grade from A to F, updated nightly, with a list of exactly what to fix. Reports export to Excel or PDF.
AI, where it helps
AI does the reading. Your team makes the decisions.
Everything above works without AI. Add the AI module and it takes the slow parts off your team's desk: reading long documents, drafting answers and pulling details onto records. Review suggestions are marked as AI suggested, with the source when one is found, and nothing is saved until a person keeps it.
The AI reads only what the person asking can already see. Content goes to the AI provider through its API, not a public chat tool, and isn't used to train models.
Reads the long documents
Hand it a SOC report, contract or insurance policy and get a written analysis of what matters.
Drafts, never decides
On a diligence review it drafts answers from the documents you choose. Each is marked AI suggested, with the source when one is found, and nothing is saved until your reviewer keeps it.
Fills in records for you to check
Contract provisions, dates and insurance details can be copied from an analysis onto the record, after you review each value.
Keeps a record of every run
Each request is stamped with who ran it and when, and stored with the files and instructions it used.
Published pricing. No per-user fees.
Pay for the modules your program requires, not a feature-bloated enterprise license. See exactly what your setup will cost before you ever talk to us.
Starting price
$8,000 per year · up to 50 vendors
Vendor management · Contract management · Due diligence reviews · Risk assessments
Vendor management teams that rely on it every day
“I came from a large bank environment where the tools were cumbersome and changes took days to weeks: now I can customize or extend a report or dashboard in minutes.”
“Cherry Creek Mortgage has been relying on VendorRisk since 2013 to manage risk and due diligence reviews of our vendors. I find the email alerts very helpful in keeping me on top of key due dates for vendors.”
“We use the system on a daily basis to monitor key performance indicators, contract deadlines, and document expiration dates for more than 800 vendors.”
Security you can put in your own vendor file
We are a vendor to you, too. Here is what your due diligence on us will find.
Hosted on AWS in the United States
Infrastructure runs in the AWS US-East-2 region. AWS SOC reports are available on request.Encrypted in transit, documents encrypted at rest
Every request requires TLS. Uploaded documents are private and encrypted at rest.SSO and multi-factor authentication
Tested with ADFS, Azure, Okta, PingOne and OneLogin. MFA through Google Authenticator.Weekly vulnerability scanning
Weekly scans with Intruder, alongside manual, AI-driven analysis of our source code.99.5% monthly uptime SLA
Measured by a public third-party uptime report, with an extra month of service if we miss it.Backups, and a copy of your data
Database backed up several times a day; documents copied to a second AWS region; optional weekly backups of your site information (Excel) and uploaded files (ZIP).Managed services
Don't have the bandwidth to run the program in-house?
Don't have the bandwidth to run your TPRM program in-house? Our partners can handle it for you — with the regulatory knowledge to do it right.
Vendor lifecycle management
How onboarding, ongoing oversight and offboarding fit together in one program.
VendorRisk vs. spreadsheets
Spreadsheets weren't built for vendor management. See what changes when you move off them.
Questions, answered
Hosting, security, support, contracts and setup, in plain language.
Your Next Exam Starts Today
Build the vendor oversight program your regulators expect — before they ask for it.