Today, your vendor compliance looks like this: providers send their ISO 27001 and SOC 2 by email, someone opens them one by one, copies info into 4 separate spreadsheets (GDPR Article 30, CSSF 22/806, DORA Register of Information, NIS 2 vendors), forgets reminders, and rediscovers everything 11 months later when audit approaches. Third Party Register reverses the logic: vendor uploads their ISO 27001 on a dedicated portal, AI reads it, identifies the type, extracts the fields, and your 4 registers fill in live in front of you. DPO and CISO no longer do daily work, they validate high-stake decisions.
Each vendor has their private space on the platform, with the list of documents you expect from them. They upload their ISO 27001: AI identifies the certifier, number, dates, scope, and fills the vendor record before their eyes. They upload their SOC 2 Type II: covered period, scope, exceptions are extracted. They upload their DPA: Article 28 clauses are verified against your internal template. No more manual copy-pasting.
All authorities ask the same information about your vendors, but in 4 different formats. GDPR Article 30 for the CNPD, CSSF 22/806 outsourcing register for the CSSF, DORA Register of Information in European authorities' ITS format, NIS 2 vendors for the ILR. With Third Party Register, you enter information once, generate each register in two clicks in the expected format. No more parallel spreadsheets going out of sync.
For each vendor, a 0-100 score aggregating 7 dimensions: data protection, cybersecurity, continuity, concentration, geopolitical, financial, contractual. Most importantly, it recalculates at every event: an expiring certification, a vendor-notified incident, a fresh adverse media mention, a European decision under NIS 2 Article 22, an update to the DORA CTPP list. The continuous monitoring required by law becomes reality, not an annual audit that misses things.
When a vendor uploads an ISO 27001, the tool records the expiry date and automatically schedules a 90-day reminder. If no renewal, escalation at D-60 (email to vendor), D-30 (DPO copy), D-15 (CISO notification), D-0 (score adjustment, non-compliance event), D+30 (automatic mitigation plan proposal). You can no longer forget a renewal.
You plan to outsource a critical or important function? CSSF wants 3-month advance notice, with a precise dossier (services rendered, location, scoring, exit plan). The tool builds this dossier from already-captured data, you review, e-sign, send. Same for vendor-related incident notifications (CNPD 72h GDPR, ILR 24h NIS 2, CSSF DORA).
The DPO sees their GDPR obligations: pending DPAs, DPIAs to complete, non-EU vendors with their safeguards. The CISO sees cybersecurity: certifications, incidents, vulnerabilities. Compliance officer sees CSSF and DORA. Management sees aggregates: top 10 risky vendors, concentration (alert if over X% critical functions at single provider), geographic data locations, decisions to make. Everyone sees what concerns them.
Product target: over 90% of recurring vendor management work executed without human intervention. Document collection, reading, filing, register feeding, reminders, score recalculation: automated. DPO and CISO step in on the 10% with stakes: validate a critical onboarding, approve a non-standard DPA, decide on termination when score exceeds 60, sign a CSSF notification.
When CSSF, CNPD, ILR or your auditor walks in: you give them read-only access to the platform. They browse your vendors, scores, decisions, proofs. If they want to take away a file, you generate a timestamped PDF export with cryptographic signature. No 3-week audit prep, no stress.
Banks, support PSFs, specialised PSFs: continuously maintained CSSF 22/806 + DORA Register of Information, traced CSSF prior notifications, inspection-ready dossier at any time.
Management companies (UCITS, AIFM, ManCo), funds (SIF, SICAV, SICAR, RAIF): ICT chain tracking with LEI, identification of CTPP providers designated by European authorities (DORA).
Insurance companies (CAA): compliance with circular 15/3, archiving, sector-specific GDPR register.
Hospitals, NIS 2 essential entities: continuous assessment of your critical IT providers, Article 21(2)(d) and (f) compliance.
Multi-client external DPOs: centralised supply chain management for all clients in a single platform, data isolated between them.
Module integrated with DPO Assistant platform: same technical base, same connectors, same configurable AI engine. Native connectors to existing TPRM platforms (TrustCenter, Whistic, OneTrust, ServiceNow GRC) if you already use one. REST API for IT integration. Luxembourg hosting, 100% on-premise mode possible for Article 41 LSF actors.
POC with no long-term commitment. Tailored quote within one business day.
Build my quote →
