Concepts
Vendors, assessments, frameworks, controls and evidence
A short tour of the objects in the platform and the way they reference each other. Everything below belongs to exactly one organization.
Organization
The tenant. Users, vendors, adopted frameworks, questionnaires and evidence are all scoped to it. A user can belong to more than one organization and switches between them; nothing is shared across the boundary.
Vendor
A third party you rely on. The record carries contacts, the data the vendor processes, its criticality, and the agreements in place. Vendors accumulate assessments over time, so the record is also the history of your relationship.
Assessment
One questionnaire sent to one vendor at one point in time. It moves through:
| Status | Meaning |
|---|---|
Scheduled | Created and sent; the vendor has not opened it yet |
In progress | The vendor has opened the link and started answering |
Pending review | Submitted, waiting on your review |
Completed | Reviewed and closed out |
Cancelled | Abandoned before completion |
After completion, two further fields track the follow-up: a validation process (in process, implementing findings, done) and a closure status (in process, findings rejected by vendor, completed).
Token
The vendor's way in. A token is bound to one recipient, carries its own expiry,
and is pending, opened, completed, expired or revoked. Reissue it if a
contact changes; revoke it if someone leaves.
Finding
A problem surfaced by an answer. Findings are attached to the answer option that produced them, so a questionnaire encodes its own risk logic — no manual triage of every response.
Questionnaire
An ordered set of questions grouped into sections. Questions are single- or multi-select, carry a weight and a rating, and can be conditional on earlier answers. Options carry a numeric value, which is what makes an assessment scoreable.
Framework and controls
A framework is a published standard — ISO 27001, SOC 2, and so on. Adopting
one brings its framework controls into your organization. Each control gets
an owner, a status you set (not started, in progress, implemented,
not applicable) and a derived status computed from its evidence, which can also
land on failing or at risk.
Evidence
The proof behind a control: a policy document, a screenshot, an exported log, or a document written in the built-in editor. Evidence has a type, an expiry, and a review state, so stale evidence stops counting rather than quietly ageing.
Auditor engagement
Scoped access for an external auditor: a set of frameworks and a date range. The auditor sees what the engagement allows and nothing else.