- The headline keeps production's best line ("You know where every vendor stands long before anyone asks") and drops "Zero risk", an absolute.
- The pairing line is production's: Codekeeper proves you can recover; this proves the vendor earned your trust. It sets the add-on beside the protections instead of competing with them.
- The visual rebuilds production's dashboard mock with fictional vendors. Production's mock names real companies with invented findings ("GitHub raised a critical issue: MFA not enforced", "Stripe moved to Needs review", plus AWS, Datadog, HubSpot and Snowflake) and shows a real reviewer's name, Jordan Adler, as the signing "Lead analyst". Both need fixing on the live page now.
- "Trusted by 3,500+ teams" is production's figure (MESSAGING §6), used unflagged as on the home page. Confirm it with the other production claims in to-confirm.md.
- Secondary CTA: the standard sample evidence pack. Production offers a "free sample vendor report"; if Product still has one, it could become this page's own offer later.
Know where every vendor stands. Before anyone asks.
Vendor Risk & Compliance keeps your third-party oversight current: each vendor assessed against the frameworks you report to, with a written verdict signed by an analyst. It runs alongside your Codekeeper protections.
- Runs alongside your account, nothing to migrate
- ISO/IEC 27001:2022 certified
- Trusted by 3,500+ teams
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- The fine: production's "€10M or 2% of revenue, whichever is higher" sat under "Without it: regulators find the gaps before you do", a fear line. Here it's stated as what Article 34(4) says (checked on EUR-Lex the same day): a floor that every Member State's maximum must reach, for essential entities that infringe Article 21 or 23. It's in a calm callout, not a headline.
- No DORA quote: I couldn't read DORA's articles on EUR-Lex from here (the page truncates before Article 28), so no DORA text is used beyond the brief. CRA is left out for the same reason.
- Legal review of the quotes, the fine wording and the disclaimer before launch.
Why now
Your suppliers are part of your risk.
NIS2 lists supply chain security among the measures entities must take, and asks them to take each direct supplier into account. Many teams still keep that record by hand, and it's out of date by the time anyone checks it.
“supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;”
“Member States shall ensure that, when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures.”
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
The shift
Vendor oversight that keeps itself current.
Your escrow is in order. The vendor records often aren't, and an auditor looks at both.
Vendor oversight by hand
- Assessments scattered across inboxes and folders
- A spreadsheet that goes stale between audits
- Questionnaires rebuilt from scratch for every audit
- Changes at a vendor found late, sometimes by the auditor
With Vendor Risk & Compliance
- Each vendor assessed on an ongoing basis, against the frameworks in your scope
- A written verdict for each vendor, signed by an analyst
- An evidence packet per vendor and per framework, versioned and dated
- Changes flagged as they're published, not at the audit
- Availability: production listed Software, SaaS and AI Escrow, Continuity Escrow and Software Backup, before Resilience and Continuity Pro existed. 16 Oct: Danny confirmed the add-on is available with every level (Escrow, Escrow Pro, Resilience, Resilience Pro, Continuity, Continuity Pro) and with Software Backup, so the copy says "any protection" and is no longer flagged.
- "Nothing to migrate" is production's claim ("Runs alongside your Codekeeper escrow, nothing to migrate"), flagged.
Alongside your protections
One proves you can recover. The other proves the vendor earned your trust.
An add-on to your Codekeeper account, on the same login, next to the applications you already protect.
Your protections
Proves you can recover
Escrow, Resilience, Continuity and Backup hold what it takes to bring each application back, and the certificates show it. See the protections
Vendor Risk & Compliance
Proves the vendor earned your trust
Each vendor assessed against the frameworks you report to, with a written verdict and the evidence behind it, kept current.
Available as an add-on to any protection: Escrow, Resilience and Continuity at either level, and Software Backup. Ask us about your plan.
What it does
Six gaps that manual vendor vetting leaves open.
Ongoing vendor vetting
Each vendor assessed against DORA, NIS2, CRA, ISO 27001, SOC 2 and GDPR, on an ongoing basis. When a framework changes, you hear about it then, not at the audit.
Verdicts signed by a person
Each vendor gets a written verdict, reviewed and signed by an analyst, so you can give your auditor a name, a date and a decision. Not a score: a verdict.
Evidence packets
Evidence per vendor and per framework, versioned, dated and traceable, ready to forward when the auditor asks.
Sub-processor tracking
Named sub-processors across your vendor portfolio are tracked, and changes are flagged within days of publication, so a yes today doesn't quietly become a no.
Change alerts
Breach disclosures, certification lapses, financial signals and changes to data processing agreements are monitored, so you hear about them before the audit does.
A library of vendors
10,000+ vendors are monitored already, and new ones are onboarded within five business days, so much of your stack may already be covered.
How it works
Three steps. Then vendor oversight runs itself.
Map your vendors once
List the vendors behind your applications and say which ones are critical. It's the one thing only you can do.
Each vendor gets a verdict
Assessed against your regulatory scope, kept up to date and signed by an analyst.
Forward the packet
When the auditor asks, you don't start a project. The evidence is already there.
The proof
A name, a date and a decision for every vendor.
Example verdict with fictional values. A verdict records an analyst's assessment of the vendor. It's evidence for your file, not a certification of the vendor.
Who it's for
For the people who answer for your vendors.
Risk and compliance teams
Keep a current, signed record of each supplier's standing for your DORA or NIS2 file.
Procurement
Bring a new vendor on board without starting a questionnaire from scratch.
Security leads
See sub-processor changes, certification lapses and breach disclosures across your vendors in one place.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
Before you add it.
Is this a separate product, or an add-on?
An add-on to your Codekeeper account. Nothing migrates: connect your vendor portfolio and the vetting runs alongside your protections. It's available as an add-on to any protection: Escrow, Resilience and Continuity at either level, and Software Backup.
Which frameworks does it cover?
Vendor assessments are mapped to DORA, NIS2, CRA, ISO 27001, SOC 2 and GDPR.
What if a vendor isn't in your library yet?
We add it. New vendors are onboarded within five business days.
How is this different from a point-in-time assessment?
A point-in-time assessment captures a vendor on one day. Vendor Risk & Compliance updates the record when the vendor changes, a framework shifts or a certification lapses, so the record your auditor sees reflects where each vendor stands now.
Does a verdict mean the vendor is compliant?
No. A verdict is an analyst's written assessment of the vendor, with the evidence behind it. It supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
What does it cost?
Talk to us. It's quoted as an add-on to your Codekeeper account.
Prove you can recover. Prove they earned your trust.
Book a demo and we'll show you vendor verdicts and evidence packets next to the applications you already protect.