Vendor risk management
Track third parties by criticality, send security questionnaires, and profile a vendor from just its URL with AI.
| Vendor | Tier | Data access | Risk | Review |
|---|---|---|---|---|
| Cloud hosting | Critical | Customer data | High | Current |
| Payroll provider | Important | Employee PII | Medium | Due |
| Email delivery | Important | Contact data | Medium | Current |
| Design tool | Low | None | Low | Current |
The vendors you depend on are part of your attack surface and your auditor knows it. Keel gives you a real third-party inventory: rank each vendor by criticality, set review cadences so nothing goes unreviewed, draft a risk profile from the vendor’s own website with AI, and send security questionnaires that score themselves.
Your vendor list lives in three places and none are current
A procurement spreadsheet, a shared inbox of SOC 2 reports, and someone’s memory of “who we use for what.” When a vendor has an incident (or an auditor asks how you vet suppliers), there’s no single, current source of truth.
What vendor risk management does
Inventory by criticality
Catalog every third party with a criticality tier and status, so the vendors that matter most get the scrutiny they deserve and the review cadence they need.
Review cadences
Set how often each vendor should be reviewed and Keel surfaces what’s due, turning “we’ll get to it” into a tracked, evidenced cadence auditors credit.
AI vendor profiles from a URL
Paste a vendor’s website and Keel drafts the risk profile: what they do, the data they touch, their certifications and sub-processors, so your inventory fills itself in instead of starting blank.
Security questionnaires that self-score
Assemble a structured assessment from a curated library of 100+ questions, send it, and let Keel auto-score responses, consistent and on-brand, ready to send in a click.
Collaborative vendor portal
Vendors respond in a portal and can invite their own colleagues to help answer, so the security questionnaire isn’t bottlenecked on one contact.
Turn a vendor into risks
Draft concrete, scored risks straight from a vendor profile and add the ones you choose to your risk register, closing the loop between third-party and enterprise risk.
Why it matters
- One current inventory of every third party and how critical it is
- Never miss a vendor review with tracked cadences
- Profile a new vendor in seconds instead of an afternoon of research
- Send and score security questionnaires without building them by hand
Get audit-ready, and prove it
Vendor risk management is one module of a full GRC platform: controls crosswalked across every framework, so you collect evidence once and comply everywhere. Start free, no credit card, no sales call.
Start freeFrequently asked questions
Can vendors collaborate on a questionnaire?
Yes. The vendor portal supports multiple collaborators, so a vendor can invite colleagues to answer the sections they own instead of funnelling everything through one person.
How does the AI vendor profile work?
You paste the vendor’s URL and Keel drafts a profile (what they do, the data they handle, certifications and sub-processors) as an editable starting point you review before saving.
Do the questionnaires score themselves?
Assessments built from Keel’s question library are auto-scored as responses come in, so you get a consistent risk read without hand-grading every answer.
Does vendor risk connect to my risk register?
Yes. Draft risks directly from a vendor profile and promote the ones you pick into your central risk register.
Related features: Security questionnaire automation · Risk register · AI tools
Works with: SOC 2 · ISO/IEC 27001