Third party risk
Assess the vendors you depend on.
Vigilr is the workspace a security team uses to keep vendors, evidence, and open questions in one place. VendorID by Vigilr™ is where a vendor keeps one profile and sends it, signed, when a customer asks.
The same questions, asked a little differently, by every customer.
A vendor security review still starts as a spreadsheet. The vendor fills it in, attaches last year’s report, and the buyer files it. Next quarter another customer asks for almost the same thing. The first review is already out of date.
Vigilr is for the team that has to decide whether to rely on a company. It keeps the vendors, the evidence, and the open questions in one place, and it notices when something outside that file changes.
VendorID is for the vendor. They keep a profile once: who the company is, which questions it can answer, and which claims it can stand behind. They send a signed package to the customer who asked. They do not rebuild it for every spreadsheet.
What we are trying to do
One profile, kept by the vendor
Company, questionnaires, and claims live in VendorID. A customer receives a package, not another blank form.
The assessment, kept by the buyer
Vigilr holds the assessment after it arrives, and the monitoring that annual questionnaires never did.
Your cloud, or ours
The enterprise product runs in your environment or in Vigilr’s. The work is the same. Who operates it is the choice.
What the buyer’s workspace holds
Vendors, evidence, and the questions still open. The point is work someone can pick up six months later.
01
A scorecard on the vendor
Critical, High, Medium, or Low across seven areas, from security posture and privacy through resilience and supply chain.
02
Signals from outside the file
Breach reports, known exploited vulnerabilities, and public filings can sit next to the questionnaire, not in a separate feed.
03
Questionnaires and evidence
Send the questions that match the vendor. Keep the reports and the answers on the same record, including what a signed VendorID package already contains.
04
Open API
Documented REST API with workspace keys. Automate vendors, surveys, and scorecards from your own tooling.
API05
You host it, or we do
The enterprise product runs in your cloud or in Vigilr’s. Same assessments, different operator.
06
Start from the list you have
Bring in the vendors you already track. The first useful file is the one you already keep, not a rollout that takes months.
From the list you have to the next review
Onboard the vendors, keep a score, ask for what is missing, and come back to the same record.
Vigilr
Onboard
Monitor
Score
Alert
Review
Iterate
Step 1 of 6
Import Vendors
Bring in the vendors you already track, from a list or through the API.
How Vigilr compares
A traditional TPRM product already keeps the vendors, the questionnaires, the evidence, and the findings. Vigilr does that work too. Here is where it differs from that, and from legacy GRC.
Partial means some products in that category offer it, often as an extra. Vigilr scores seven risk areas as Critical, High, Medium, or Low. Enterprise sign in uses your identity provider, including OIDC and SAML.
One enterprise product. Two places it can run.
Deploy Vigilr in your cloud, or have us run it in ours. Either way it is the enterprise product, including sign in with your identity provider. Pricing follows the deployment.
You host it
Your cloud
The enterprise product, deployed in the cloud environment you already operate.
Custom
- Runs in your accounts and your network
- Data stays on infrastructure you control
- You keep the operational boundary
- Vendor records, surveys, evidence, and scorecards
- Monitoring between reviews, not only the annual file
- External intelligence on the vendors you track
- Scorecards across seven risk areas, from security posture through supply chain
- Questionnaires, and signed VendorID packages from the vendor
- Open API and assistant access
- Sign in with your identity provider, including OIDC and SAML
- A deployment and support plan scoped with you
Hosted
Vigilr’s cloud
The same enterprise product, operated by us in Vigilr’s cloud.
Custom
- We run the service. There is no cluster for you to patch
- A workspace for the team assessing vendors
- The same product as the deployment you host
- Vendor records, surveys, evidence, and scorecards
- Monitoring between reviews, not only the annual file
- External intelligence on the vendors you track
- Scorecards across seven risk areas, from security posture through supply chain
- Questionnaires, and signed VendorID packages from the vendor
- Open API and assistant access
- Sign in with your identity provider, including OIDC and SAML
- Support scoped with you
API and MCP
Query vendor risk from your tools
Automate with the REST API, or ask Claude, Cursor, Codex, or any MCP assistant in plain language. Answers come from your Vigilr data, with a link back to the page that was used.
OpenAPI
Workspace API keys for vendors, surveys, scorecards, evidence, and more.
MCP assistant
Early access. A personal token lets the assistant act as you: it sees only what your role allows. VendorID uses the same idea, with nothing extra to install.
BYOK enrichment
Bring your own OpenAI compatible or Ollama endpoint. Keys stay in your workspace.
# REST, workspace API key
GET /api/v1/vendors
Authorization: Bearer <workspace-api-key>
# MCP, personal token, early access
# Ask: "Which certificates expire in 60 days?"
# Ask: "Write a risk brief for Acme Payments."Early access. @vigilr/mcp is not on npm yet, and there is no hosted connector yet. Your admin shares the server, and you connect with a personal access token.
Questions we actually get
Can't find your answer? Email us at hello@vigilr.xyz
Data & privacy
Security
Product
Deployment
If you assess vendors
We can walk through Vigilr on the vendors you already have, in your cloud or in ours.
If you are the vendor
Create a VendorID profile, answer what you can, and send a signed package when a customer asks.