Skip to content

Your vendors are your attack surface.

Strac Comply finds your vendors and scores each one with fixed rules you can check. It reminds you before reviews are due and reuses one review across every framework you run. With Security-First, it also finds the AI tools your team signed into last week.

Start free trialBook a demo

14-day free trial. No credit card.

Every vendor is a way in. The breach probably won't start with you.

Most teams track SaaS tools, sub-processors and app grants in a spreadsheet, and chase reviews by email once a year. That’s a hope, not a program.

  • ~30%

    of breaches involve a third party

    Verizon’s 2025 breach report found third-party involvement roughly doubled in a year.

  • 98%

    of orgs use a breached vendor

    Nearly every organization works with a third party that has had a breach (SecurityScorecard).

  • 1 in 5

    breached orgs hit through shadow AI

    In IBM’s 2025 breach study, 1 in 5 organizations had a breach that involved AI tools nobody approved. It added about $670K to the cost.

How it works. Discovery to offboarding, in one place.

Strac Comply takes each vendor through four steps, with data it already collects.

  1. Step 1

    Discover

    Every tool you connect to Strac Comply becomes a vendor. With Security-First, Shadow IT and AI discovery adds the apps your team granted access in Google Workspace or Microsoft Entra ID. Strac Comply checks each one against the vendors you already have.

  2. Step 2

    Assess

    Strac Comply scores each new vendor automatically and marks it not yet reviewed until a person looks. You see inherent and residual risk, driver by driver.

  3. Step 3

    Review

    Keep SOC 2 reports, DPAs and BAAs with their expiry dates. Admins get a reminder 30 days before a vendor review is due. Move a high-risk vendor into your risk register in one click.

  4. Step 4

    Offboard

    Record the revoked access and the confirmed data deletion, with who did it and when.

Fixed rules, not an AI guess. A risk score your auditor can reproduce.

A score an AI model writes can change each time you ask. Strac Comply uses fixed rules instead. Same inputs, same band, every time.

Strac Comply scores each vendor from the data the vendor handles and the access it holds. The documents on file and the reviews you've done count too.

  • Every band shows the inputs that produced it
  • Inherent and residual risk, as impact × likelihood on a 1 to 5 scale
  • Know more than the engine? Change one driver. The engine value stays beside yours
  • Your auditor can see “engine said 4, you chose 2, here’s why” in the auditor portal

The new shadow IT. Which AI tools can reach your company data?

Included in Security-First. See the plans

Every ChatGPT, Perplexity or Copilot sign-in with a work account is a vendor that can reach your data. Nobody assessed it. Strac Comply finds these tools from the app grants in Google Workspace and Microsoft Entra ID, with no endpoint agent or proxy.

  • Strac Comply tags AI tools by name, so they sort to the top of the list
  • See what each app can reach, like Drive or Gmail, and how many people granted it
  • Strac Comply checks each app against your vendor list, so an approved tool and an unknown one never look the same
  • Approve it, mark it not approved, or accept the risk, with your reason on record. Remove a Google Workspace grant in Strac Comply, too

Explore Strac AI Data Governance

One place for your vendors. Everything a third-party program needs.

Find and score vendors, keep their documents current, and show your auditor. It’s all part of Strac Comply.

  • Risk scores from fixed rules

    Same inputs, same band, every time. Every score shows its drivers: inherent and residual risk, impact and likelihood.

  • Shadow IT and AI discovery

    Find the apps and AI tools your team granted access in Google Workspace or Microsoft Entra ID. Strac Comply matches each one to your vendor list. Included in Security-First.

  • Changes stay on record

    Change a single driver when you know something the engine can’t see. The engine value, your value and your reason stay side by side.

  • Vendor documents in one place

    Store SOC 2 reports, DPAs, BAAs and pen test summaries with their expiry dates. See which agreements are still missing.

  • Shared with your auditor

    Your vendor register shows up in the auditor portal as a dated snapshot, with each vendor’s risk band.

  • One review, every framework

    A vendor review is evidence for SOC 2 CC9.2, ISO 27001 A.5.19 to A.5.23, NIST CSF GV.SC, PCI DSS 12.8 and HIPAA 164.308(b).

6 stages. One place.

Third-party risk isn’t a one-time onboarding form. It’s a loop, and offboarding is the step most teams skip.

  1. Discover

    Connected tools and app grants become vendors

  2. Classify

    Data handled and access held, on record

  3. Assess

    Inherent and residual risk, same rules every time

  4. Approve

    Who approved the vendor, and when

  5. Review

    A reminder before each review is due

  6. Offboard

    Access revoked, data deletion confirmed

Why this beats a spreadsheet.

Most teams track vendors in a spreadsheet and chase reviews by email once a year. Here's what changes when Strac Comply tracks them.

Capability
Spreadsheet + email
Strac TPRM
Vendor list
Typed in by hand
Found from your connected tools and app grants
AI tools
Missed unless someone mentions one
With Security-First, tagged as AI, with the data each one can reach
Risk scores
A guess per row
Same inputs, same band, every driver shown
Score changes
Overwritten, no history
Engine value kept beside your change and reason
Vendor documents
Scattered across inboxes
One place, with expiry dates
Review dates
Remembered, or not
A reminder 30 days before each review
Multiple frameworks
Re-entered for each one
One review, evidence for all five
Your auditor
Gets an exported file
Sees the register in the auditor portal

Straight answers

How is the risk score different from an AI questionnaire grade?

Strac Comply uses fixed rules. It sets impact and likelihood on a 1 to 5 scale from what it knows about the vendor. That’s the data the vendor handles, the access it holds, its SOC 2 report or DPA, and your past reviews.

The same inputs always give the same band, and you see every driver. When an admin changes a driver, Strac Comply keeps the engine value it replaced. So your auditor sees “engine said X, admin chose Y, here’s why.”

How do you find the AI tools my employees use?

Strac Comply reads the third-party app grants in Google Workspace and Microsoft Entra ID. You don’t install an endpoint agent or a proxy. Apps whose names match known AI tools, like ChatGPT, Claude, Perplexity or Copilot, get an AI tag and sort to the top.

You see what each app can reach and whether it matches a vendor you already manage. Then approve it, mark it not approved, or accept the risk, with your reason on record. For a Google Workspace app, you can remove its access in Strac Comply.

Shadow IT and AI discovery comes with Security-First.

How do you find vendors we didn’t tell you about?

Two ways. First, every tool you connect to Strac Comply becomes a vendor on its own. Second, with Security-First, Shadow IT and AI discovery reads the app grants in Google Workspace and Microsoft Entra ID.

Strac Comply checks each app against your vendor list. It looks for an exact match by name or web address, or a close match for you to confirm.

Anything new waits in a review queue. Move it to your vendors in one click, or set it aside with a reason.

Does a vendor review count toward our SOC 2 or ISO 27001 audit?

Yes, as evidence. A vendor review maps to SOC 2 CC9.2, ISO 27001 A.5.19 to A.5.23, NIST CSF 2.0 GV.SC, PCI DSS 12.8 and HIPAA 164.308(b).

You do the review once, and it shows up on every framework you run. Your auditor sees the vendor register in the auditor portal.

What happens when a vendor’s risk changes?

Strac Comply scores each new vendor automatically. When something changes, like a new SOC 2 report or an open issue, re-run the assessment in one click. Strac Comply saves the new band and keeps the old one in the history.

Admins also get a reminder 30 days before each vendor review is due, so no vendor goes years without a look.

Is Strac TPRM a separate product?

No. Vendor risk management is part of Strac Comply, in the Platform plan with every framework, the risk register and access reviews. Shadow IT and AI discovery comes with Security-First.

Start a 14-day free trial, no card needed.

See every vendor. Score each one by the same rules.

Keep every review current, and reuse it across every framework you run.

Start free trialBook a demo

14-day free trial. No credit card. Plans from $4,995 per year. See pricing