Vendor trust should be
verifiable, not assumed.
TrustVendor is the evidence layer for vendor risk — every claim, every certification, every subprocessor backed by a specific span in a specific document, timestamped and hashed.
Security rating products tell you how a vendor’s internet footprint looks from the outside. That’s a useful signal. But it doesn’t tell you what changed in the SOC 2 you relied on last quarter, whether the subprocessor your DPA covers has been replaced, or whether the HIPAA BAA you signed still covers the entity now processing your patients’ data.
TrustVendor was built to answer those questions — not with a grade, but with a citation. The grade compresses nuance. The citation is the thing itself.
How we operate
Four operating
principles.
Agents produce claims, never numbers.
Our AI agents extract structured claims from vendor documents. Scoring is deterministic arithmetic over those claims — versioned and replayable. No model is ever involved in computing a score. Every score movement can be explained from first principles.
Every claim cites a hashed snapshot.
No claim exists without an artifact_id and a character range pointing to the exact source. Snapshots are sha256-hashed before processing. You can verify the hash client-side — no trust required.
Evidence decays explicitly.
A SOC 2 from last month is stronger evidence than one from fourteen months ago. We model this with decay curves tuned per evidence type. Freshness is shown in the UI, not hidden behind a static rating.
The score reflects your relationship.
The same vendor poses different residual risk depending on what data you share. Residual risk is computed per relationship, based on the data classes and integration scope you configure.
Get in touch
Work with us —
or talk to us.
We’re hiring across engineering, research, and GTM. And we always want to talk to compliance teams building programs with evidence at the center.