- contact@verticalserve.com
Platform
The whole vendor lifecycle, with agents doing the work
One product from the first request to the exit: one-sentence intake, tiering and routing, parallel review lanes, document and contract intelligence, assessments with a vendor portal, explained risk, continuous monitoring, renewals with a recommendation, offboarding and the record of every decision.
1 · Intake
Requests in the requester’s own words
Anyone can ask for a tool by describing it: “We want Quill AI to draft customer support replies from our ticket history — about 25 seats, roughly $30k a year, needed by end of month.” The Intake agent drafts the request — vendor, website, category, purpose, data types, systems, spend, seats, deadline — and lists the questions it could not answer, so the requester fills in only those.
Before anything is reviewed it checks your vendor list, your contracts and your approved alternatives, and says so when you already have something that does the job.
- Request types — new vendor, new use of an existing vendor, renewal, offboarding
- Duplicates — an existing vendor, an active contract or an approved alternative in the same category
- Where — the console and the API today; email-in, Slack and Teams are planned
2 · Triage & reviews
Parallel lanes, each with an owner, an SLA and a reason
The Risk agent sets the tier and the inherent score. Then routing rules — yours, evaluated in order — add the lanes and the evidence each one needs, and every rule that fired is recorded on the request with its reason: personal data adds privacy, an integration adds IT, an AI vendor requires the AI questionnaire.
Security, privacy, legal, finance, IT and the business owner review at the same time. Each lane approves, approves with conditions, rejects or sends back, from the console or a signed, single-use email link. The request decides itself when every lane has.
- Workflow templates — Standard SaaS, Critical / regulated, Low-risk fast track, Renewal, Offboarding
- SLAs per lane in business days, with the owner and the due date on every lane
- Conditions become findings with an owner and a due date, so “approved if…” is followed up
3 · Document & contract intelligence
The reading is done before the reviewer opens the file
The Document agent extracts the facts each document type exists to prove and raises findings that quote the text and name the page. The Contract agent checks every clause against your playbook and proposes redlines.
SOC 2 & SOC 1
Type, period, opinion, exceptions
Plus the complementary user entity controls you must operate yourself, the subservice organisations and the bridge-letter gap.
ISO certificates
Scope and expiry
ISO 27001, 27701 and 42001: certification body, what the scope actually covers, and when it ends.
Penetration tests
Open criticals, retests
Date, tester, open critical and high findings, and whether a retest shows them fixed.
Insurance
Limits against your minimums
Cyber, E&O and general liability limits checked against the minimum you set for the vendor’s tier, and the expiry.
DPAs
Subprocessors and data
Breach-notification window, data location, transfer mechanism, deletion — and the subprocessors, which become fourth parties.
Contracts
Your playbook, clause by clause
Liability cap, indemnity, data location, subprocessors, deletion, audit rights, termination, auto-renewal, notice period.
4 · Assessments
Pre-filled from evidence, sent only for what is missing
The Assessment agent chooses the questionnaire the tier calls for, pre-fills every answer the documents on file already prove — marking the source of each — and prepares the invitation. The vendor answers the rest in a portal reached by a signed link, with no account. Answers are checked for weak, evasive or contradictory responses.
- Library — InsightVendors Core (SIG-Lite aligned), Privacy / GDPR & DPA, AI vendor (ISO 42001 / NIST AI RMF), Business continuity, Financial health
- Outbox — the invitation and every reminder wait until a person releases them
- Every question maps to a risk domain and a weight
5 · Risk
A score with its reasons, per domain, over time
Risk is scored in eight domains — security, privacy, operational, financial, compliance, reputational, concentration and AI. Inherent risk comes from what the vendor touches: data types, system access, business criticality, spend, subprocessing. Residual risk subtracts what the vendor has proven — a current SOC 2 Type II, an ISO certificate in date, a clean pen test, adequate insurance — and adds back every open finding.
The arithmetic is deterministic and the weights are yours; the agent writes the explanation, never the number. The tier sets how often the vendor is reassessed.
- Tier 1 Critical · Tier 2 High · Tier 3 Moderate · Tier 4 Low, by rules you own
- Risk history kept for the trend on every vendor
- Findings with severity, domain, source, owner, due date and accepted-risk expiry
6 · Monitoring
Signals that turn into the right amount of work
Breaches, sanctions, adverse media, financial news, certificate and domain changes, expiring documents and vendors that stop answering arrive as signals — from InsightPulse company intelligence, from the API, or added by hand. The Monitoring agent decides the reaction for the vendor’s tier: a note, a finding, a re-assessment or an escalation to the owner.
- A tier 4 design agency in the news is a note; a tier 2 vendor holding customer data that confirms a breach is a re-assessment
- Expired SOC reports and certificates raise their own signals
- Additional feeds and ratings connectors (bring your own subscription) are planned
7 · Contracts, renewals & offboarding
Decide before the notice date, not after the invoice
Contracts carry value, term, auto-renewal and notice period, and the calendar is sorted by the last day you can still give notice. Ninety, sixty and thirty days before it, the Renewal agent brings together spend, the risk trend, open findings and the contract terms and recommends renew, renegotiate or offboard — with its reasons.
Offboarding is a checklist with evidence: access revoked, data returned or deleted with a certificate of destruction, the contract terminated, the supplier closed.
The renewal that comes with a recommendation
Agents
Ten agents. Each on a dial you control.
Every agent is governed: it gathers only what the record supplies, reasons with a model or its rule-based path, proposes a structured change, and the autonomy level decides what happens next. Every action is an agent run with its input, output and citations.
Intake · L3
Drafts the request
Vendor, category, data, spend, duplicates.
Research · L3
Builds the profile
From InsightPulse and the vendor’s public trust pages.
Risk · L4
Scores and tiers
Arithmetic; the agent writes the explanation.
Assessment · L2
Prepares the questionnaire
Pre-filled from documents, invitation held.
Document · L3
Reads the evidence
Findings with page citations; CUECs mapped.
Contract · L2
Checks the clauses
Deviations and proposed redlines.
Monitoring · L3
Reacts to signals
Note, finding, re-assessment or escalation.
Renewal · L1
Recommends
Renew, renegotiate or offboard, with reasons.
Remediation · L2
Chases the vendor
Follow-ups on overdue findings, held in the outbox.
Copilot
Answers questions
From the records, with links. Read-only.
Rails
Grounded, budgeted, reversible
A number not in the source throws the answer away; kill switch per agent; pull-back at L3.
No model? Still works.
A real rule path
Every agent works without an AI model; the model makes it better, never makes it work.
Integrations
What it connects to today, and what is next
Available
InsightPulse
Company profiles, news and adverse-media signals for vendor research and monitoring.
Available
InsightAssure
Approved vendors, SOC report reviews and CUEC mappings exported as compliance evidence.
Available
Email & portal
Signed email approval links for reviewers; a signed portal link for vendors; messages held in the outbox.
Available
Import & API
Vendors, contracts and documents through the API; signals posted by your own tools.
Available
Your identity provider
Sign-in through OIDC from Okta, Entra ID or Google, with their MFA.
Available
Your AI model, or none
Agents use the model you configure; every agent also has a rule-based path.
Okta · Google · Entra discoverySlack & Teams approvalsEmail-in intakeJira
NetSuite & CoupaDocuSign & IroncladThe vendor networkSecurityScorecard & BitSight
DORA register of informationOCC / DORA / NYDFS templates