Vendor questionnaires
From a vendor's page, send a fixed, 12-question security due-diligence questionnaire to a contact email, with a due date. The vendor answers directly, with no account on this platform.
Sending a questionnaire
Enter a contact email, an optional contact name, and a due date that is not in the past. This creates one record for that vendor and emails the contact a link containing a real, unguessable token, generated independently of the vendor or questionnaire id. Every questionnaire sent for a vendor is listed on that vendor's page, newest first.
The vendor's experience
The link opens a public page with no login. It shows your organization's name, the vendor's name, and the due date, and asks the same 12 questions of every vendor: current SOC 2 or ISO 27001 status, whether MFA is enforced, encryption at rest and in transit, subprocessors, data retention and deletion, incident response and notification, background checks, least-privilege access control, penetration testing, whether a Data Processing Agreement is in place, and business continuity planning. Every question requires a real, non-blank answer before the vendor can submit. A submission is one-shot: once completed, the same link cannot be answered again.
Where Verazo AI fits in
Nowhere in this flow. The 12 questions are fixed, and the vendor answers them directly. Verazo AI drafts a first-pass answer only in the separate Questionnaires feature, for a security questionnaire your own organization receives from a prospect or customer: that draft is grounded in your own configured controls, evidence, and published policies, and a person must review, edit, and approve it before it counts as your organization's real answer. It never sends automatically.
The auto-risk score
Every vendor carries two risk fields: riskRating, a human reviewer's judgment call, and autoRiskScore, a deterministic 0 to 100 number computed from the vendor's own record, recomputed on every save. The score is a suggestion. Every badge and filter in the product uses riskRating, the one a person set by hand.
The formula, applied in order:
- A base score by data sensitivity: no access 0, internal data 15, PII 40, sensitive PII 65, financial data 80.
- Subtract 10 points for a self-attested SOC 2 report, and 10 more for ISO 27001.
- Add 3 points per disclosed subprocessor, capped at 20 points total.
- Add 15 points if the Data Processing Agreement has expired, or 20 points if none was ever signed while the data sensitivity is PII or higher.
- Clamp the result to 0 through 100.
Below 40 is banded low risk, 40 to 69 medium, 70 and above high. Every factor that applies contributes every time. Nothing here is cited to a specific ISO 27001 or SOC 2 clause, since neither framework mandates a scoring formula: these are this platform's own published, fixed constants, not a black-box model output.