Skip to main content

Vendor Security Review

Conduct AI-powered vendor security assessments by uploading vendor documentation and evaluating it against your configured security requirements.

Overview​

Admins and members can create vendors, start and retry reviews, update findings, manage questions and responses, and make vendor decisions. Both read-only roles can view reviews but cannot modify them. These permissions apply equally to standalone organizations and each child organization. Only admins and read-only admins can view administrative Settings; child vendor settings follow the parent's governance choice.

The Vendor Security Review feature allows your organization to:

  • Upload SOC 2 reports, penetration test results, and other vendor security documents
  • Evaluate uploaded documentation against your configured vendor security requirements
  • Receive an AI-generated overall summary, per-requirement findings, and a recommendation
  • Send follow-up questions to vendors and re-analyze based on their responses
  • Track vendor approval status through a full lifecycle

Vendor Lifecycle Statuses​

StatusDescription
Pending AnalysisDocuments uploaded; AI analysis in progress
PendingAnalysis complete; questions may be outstanding
Pending ResponseQuestions sent; awaiting vendor answers
ApprovedVendor meets your security requirements
DeniedVendor does not meet requirements
Conditionally ApprovedVendor meets requirements with conditions
No Longer in UseVendor relationship ended

Starting a Vendor Review​

  1. Navigate to Vendors in the main menu
  2. Click Add Vendor and enter the vendor name and details
  3. Open the vendor and click Start New Review
  4. Set the data sensitivity level for this engagement
  5. Upload one or more vendor security documents (PDF, DOCX, TXT, etc.)
  6. Click Start Analysis — the AI begins evaluating the documents against your requirements

Analysis typically takes 1–3 minutes depending on document size. If initial analysis fails, the review page shows the failure instead of continuing to show a spinner. An organization administrator can select Retry analysis to reuse the documents already uploaded for that review. This does not create or charge for another review. The action is available only while the initial analysis has failed and its source documents remain stored. Earlier attempts cannot update the progress or results of a newer retry. Public breach research has a separate retry control.

PDF extraction uses an updated parser with protections against known resource-exhaustion issues in page labels, font data, embedded files, and appearance streams. A malformed document may still fail analysis; use the displayed failure and retry guidance rather than assuming that every PDF can be processed.

Document findings use the deployment's ANTHROPIC_MODEL. The overall summary and initial recommendation are synthesized with ANTHROPIC_IMPACT_MODEL, which also handles follow-up response analysis. For reviews with public breach research, the final recommendation is refreshed against the current research using ANTHROPIC_IMPACT_MODEL.

Reading Review Results​

After analysis completes, the review page shows:

Questions, recorded vendor responses, and public-research excerpts display HTML-like input literally. The platform's own review formatting remains available.

Recommendation Banner​

The top of the page displays the overall AI recommendation:

  • Approve — All deal-breaker requirements are met
  • Conditionally Approve — Most requirements met with minor gaps
  • Pending Further Information — More documentation or vendor answers needed
  • Deny — Critical requirements are not met

The banner also shows the AI's rationale, formatted with Markdown for clarity.

Findings​

Each configured vendor security requirement is assessed individually with a status:

  • Meets — Requirement is satisfied by the uploaded documents
  • Does Not Meet — Requirement is not satisfied
  • Partially Meets — Evidence is incomplete or conditional
  • Pending Vendor Response — Needs a direct answer from the vendor
  • Fails Requirement - Risk Accepted — Requirement is not met, but the risk has been formally accepted (human-only; the AI never sets this status)

Each finding links to the source document citation that supports the conclusion.

Editing Finding Status​

Any authenticated org member can manually override the status of any finding directly in the UI:

  1. Open the vendor review page and scroll to the Findings card
  2. Click the status dropdown in the Status column for any finding
  3. Select the desired status — the change saves automatically
  4. A brief "Saved" indicator confirms the update

The "Fails Requirement - Risk Accepted" option is available to all members and is never set by the AI. Use it when your organization decides to proceed despite a known gap.

AI Summary​

A markdown-formatted overall summary of the vendor's security posture based on all uploaded documents.

Document Downloads​

All documents uploaded for a review are listed in the Documents card. Click Download next to any document to open a time-limited secure link to the file.

Cited document names in the Findings section are also clickable. Supported PDF, DOCX, and TXT citations open as PDF in the inline viewer, which searches for the cited excerpt. Use Download original in the viewer if you need the source file outside the browser.

Deleted Source Documents​

If your organization enabled Delete source documents after initial analysis before this review was created, the files remain available until the initial results and questions have been saved. The Documents card then reports the source lifecycle truthfully as Deletion pending, Deletion retry pending, or Deleted after analysis. Deleted or pending documents cannot be downloaded, and their citations remain visible as evidence metadata without a source-file link.

Deletion retries are bounded. If the storage provider still cannot confirm deletion after 12 attempts, the document changes to Unavailable and automatic retries stop. Contact your RepoRisk administrator so the bucket permissions, Object Lock retention, or MFA Delete configuration can be checked; Unavailable does not claim that every stored version was deleted.

warning

Source deletion is permanent. Follow-up processing uses the saved findings, questions, responses, organization context, and summary without re-reading the original documents, so follow-up question and response-analysis quality may be degraded.

See Vendor Review Document Retention for administrator setup and prospective-scope details.

You can also opt into Public Breach Research when starting a review or re-review. Public incident candidates remain separate from document findings until a reviewer accepts them for a subsequent response assessment. Research does not run between review cycles.

Follow-Up Questions​

If the AI determines that additional information is needed, it generates follow-up questions for the vendor.

Copying and Sending Questions​

In the Questions card:

  1. Click Copy All Questions to copy the full list to your clipboard, formatted as a numbered list ready to paste into an email
  2. After sending, click Mark All as Sent to update the question status

Recording Vendor Responses​

Each question row has a two-column layout:

  • Left column: The question text
  • Right column: A text area to record the vendor's response

Each response field auto-saves as you type. Changes are saved automatically after a short pause; a brief "Saved" indicator confirms the update. No manual Save button click is required, though a Save button is still available if you prefer.

Submitting for Re-Analysis​

Once responses are recorded:

  1. Click Submit All Responses in the questions card
  2. The AI re-evaluates the relevant requirements based on the recorded answers
  3. A new review round is created with updated findings

For reviews whose source documents were deleted after initial analysis, re-analysis is based only on retained review context and the recorded vendor responses. The review page displays a warning when this applies.

warning

If any response failed to save (shown in red), submission is blocked until those fields are successfully saved. Retry by clicking the Save button on the failed field again.

Audit Log​

Every change to a vendor review — including finding status updates, question text edits, and vendor response edits — is captured in the Audit Log displayed at the bottom of the review page.

What the Audit Log Shows​

ColumnDescription
TimestampWhen the change was made
ActorWho or what made the change: a specific user name, or "AI" for AI-generated changes
FieldWhich field was changed (status, question_text, or vendor_response)
Old ValueThe value before the change
New ValueThe value after the change

Who Can See the Audit Log​

All authenticated members of your organization can view the audit log. Admin access is not required to read it.

Vendor AI Instructions​

You can provide organization-specific context to guide AI analysis for all vendor reviews. This is configured in Settings → Vendor AI Instructions.

Examples of useful context:

  • Your organization's risk tolerance or compliance framework (SOC 2, ISO 27001, HIPAA)
  • Vendor categories that require stricter scrutiny
  • Specific clauses or certifications your procurement policy requires

See Organization Settings for configuration steps.

Vendor Security Requirements​

The AI evaluates documents against requirements you configure in Settings → Vendor Security Requirements. Each requirement has a severity level:

  • Deal Breaker — Must be met for approval
  • Highly Desired — Important but not blocking
  • Preferred — Nice to have
  • Optional — Informational only

See Organization Settings for how to add, edit, and import requirements.

Troubleshooting​

Analysis Stuck at "Analysis in Progress"​

If the review stays at "Analysis in progress" for more than 5 minutes:

  1. Check that your Anthropic API key is configured in Settings (BYOK or platform key)
  2. Contact Support if the issue persists

All Documents Failed Extraction​

If you see "All documents failed text extraction":

  1. Ensure documents are not encrypted or password-protected
  2. Try re-uploading the document in a different format (e.g., PDF → DOCX)
  3. Check that the document contains selectable text (not a scanned image without OCR)

Auto-Save Failed​

If a "Save failed" indicator appears on a response field or status dropdown:

  1. Check your network connection
  2. Make another edit to the field to trigger a retry, or click the Save button if visible
  3. The indicator will clear once the save succeeds

Inline PDF Viewer Failed​

If a cited document cannot be displayed inline, click Download original in the viewer. Confirm that the downloaded source file opens normally, then contact Support if inline viewing continues to fail.