Vendor Due Diligence
Manage supplier risk from initial assessment to ongoing oversight
Connect supplier context, requirements, evidence, human review and decisions in one auditable workflow.
- Set the scope and requirements for each supplier review
- Review supplier evidence against the requirements that matter
- Record findings, decisions and next actions in one report
AI supports the analysis. Your people review the evidence and decide.
- Security
- Privacy
- Legal
- Operational
- AI use
Supplier review
Acme Cloud Services
Acme Identity Platform (SaaS)
Evidence mapped to requirements
5 / 8
- Evidence found
- 5
- Partial evidence
- 1
- Evidence requested
- 1
- Manual review
- 1
| Requirement | Evidence status |
|---|---|
REQ-01 Vendor must hold a current independent security certification (SOC 2 / ISO 27001). | Covered |
REQ-02 All customer data must be encrypted at rest and in transit. | Covered |
REQ-03 Multi-factor authentication enforced for all administrative access. | Covered |
REQ-04 Customer data processed within EU/EEA boundaries. | Missing |
REQ-05 Security incidents notified to customers within agreed SLA. | Unclear |
AI-assisted recommendation · human decision required
Request written confirmation of EU data residency from vendor before contract sign-off.
From start to decision
The Governli process
Assess suppliers using evidence. Review findings. Record a decision and next actions.
- 1
Scope the review
Capture the supplier service, intended use and access context before reviewing evidence.
- 2
Set your requirements
Choose the requirements that matter for this supplier assessment.
- 3
Collect supplier evidence
The supplier provides documents and responses in the assessment workspace.
- 4
Map evidence & find gaps
AI suggestions help reviewers see what is supported, missing or needs clarification.
- 5
Review & decide
Your reviewers check the findings and record a decision and next actions.
- 6
Report & follow up
Keep the evidence, findings, decision and recorded actions together in the report.
Designed for IT Governance, Information Security and Vendor Risk Management
Helping organizations assess vendors faster while maintaining governance, compliance and risk oversight.
Supplier documents → Governli → Reviewable decision
See what Governli does with the documents
Governli does the document work and prepares traceable findings. Your organisation reviews the evidence and makes the decision.
Input · Supplier evidence
- SOC 2 Type II
- ISO 27001 certificate
- DPA
- Security policy
- BCP / DR plan
- Penetration-test report
Governli · Analysis
- Reads the evidence
- Maps evidence to requirements
- Identifies missing evidence
- Detects conflicting information
- Creates reviewable findings
Evidence is analysed against the requirements your organisation chooses.
Output · Human review
- Supported
- 31
- Need attention
- 7
- Evidence requested
- 4
Decision ready for human review
Illustrative workflow and fictional sample counts. Not a real supplier assessment.
Completed sample assessment
Don't take our word for it. Inspect the evidence.
Explore a complete fictional vendor assessment. Open the findings, follow the evidence and see exactly why each conclusion was reached.
The sample uses fictional supplier data and the same evidence-first structure as a real assessment.
Finding
Partial evidenceIncident notification
A notification process is documented, but no committed notification timeframe is evidenced.
Evidence reviewed
- Incident-Response-Policy.pdf
- SOC2-Type-II.pdf
Follow-up: Request contractual notification SLA
Fictional finding · illustrative product excerpt.
The Governli model
Requirement → Evidence → Finding → Decision
Every Governli assessment follows the same traceable path. You start from your requirements, supplier documentation is reviewed against them, gaps become explicit findings, and a named reviewer records the decision.
- 01RequirementsDefine what matters
- 02EvidenceConnect supplier sources
- 03FindingsMake gaps visible
- 04Human decisionRecord the reasoning
- 05Follow-upKeep actions in view
- 01Requirement
Customer data must remain within approved regions
Requirements come from the Recommended Enterprise Baseline or your own policy set — fully editable.
- 02Evidence
Vendor documentation is mapped to the requirement
Supplier documents are reviewed against each requirement, with source citations retained.
- DPA.pdf
- SOC2-Type-II.pdf
- Subprocessor-list.xlsx
- 03Finding
Hosting location documented, support access unclear
Where evidence is incomplete or conflicting, Governli records a finding instead of a score you cannot trace.
Partial evidence - 04Decision
Review required before approval
AI assists the analysis. A named reviewer records the decision, and the rationale stays with the assessment.
Human decision
Findings you can act on, across the whole portfolio
A finding states what the evidence does and does not support, and what needs to happen next. Across your vendors, the Attention Center surfaces the assessments that need a human — awaiting supplier evidence, open findings or a pending review.
Illustrative sample data from a fictional example workspace.
Vendor portfolio · fictional example
Illustrative supplier overview · not customer data
- In review
Northstar Cloud AB
31 of 42 requirements evidenced
- Attention
Example SaaS Ltd
2 open findings awaiting clarification
- Evidence requested
Sample Vendor AB
Awaiting supplier documentation
- Approved
Fjord Analytics AB
Decision recorded with rationale
What Governli changes
Concrete outcomes for teams reviewing supplier evidence.
Stop reading the same evidence manually
Governli maps supplier documentation against the requirements that matter.
See what's actually missing
A document being uploaded doesn't mean a requirement is satisfied.
Find contradictions before approval
Conflicting statements across policies, contracts and reports become explicit findings.
Keep the reasoning behind the decision
Requirements, evidence, findings and reviewer rationale remain connected.
How It Works
Manage supplier risk from initial assessment to ongoing oversight — supplier context, requirements, evidence, human review, decisions and follow-up in one auditable workflow.
1. Scope the review
Describe the supplier's service, what access it will have and how your organisation intends to use it. Start from the available assessment baseline or add your own requirements for the review.
2. Review evidence
Review documents against each requirement, including evidence suppliers choose to share from their private library. Suppliers can withdraw a share. AI-supported findings show what is covered, missing, conflicting or needs human review.
3. Review together and decide
Reviewers check the evidence and findings, then record a human decision. Where required, one reviewer proposes and another approves. The rationale stays in the assessment history.
4. Report and follow up
The report and PDF connect requirements, evidence, findings and the recorded decision, with next actions and their owners when recorded.
Governli supports your review; it does not certify suppliers or guarantee compliance. The decision stays with your organisation. Request a free vendor evaluation.
View Sample Assessment Report
See exactly what you will receive before uploading any documents. The sample report shows the structure, findings, risk rating and recommended actions delivered for every vendor assessment.
- Executive summary for management review
- Risk rating with rationale
- Identified findings and missing controls
- Recommended actions before approval
- Evidence-based decision support summary
Security & Privacy
We understand that vendor assessments often involve sensitive documentation. Protecting customer information is a core design principle.
Encryption
All communication is encrypted in transit and uploaded documents are encrypted at rest.
Data Handling
Documents are processed solely for assessment purposes and customer data remains under customer control.
EU Storage
Primary database and file storage are hosted within the EU. AI analysis is a separate processing path documented on the Sub-processors page.
No Model Training
Customer documents and uploaded information are never used to train AI models.
Data Retention
Uploaded documents and generated reports are retained while your account is active, so your assessments remain auditable.
Deletion is performed on request. Automatic, configurable retention schedules are not yet available.
Transparent Pricing
Every customer receives the exact same Governli platform. Upgrade for greater assessment capacity — never for feature access.
Single Assessment
1 vendor assessment
Assessment Pack
5 vendor assessments
Professional
Up to 15 per month
About Governli
Governli helps organizations evaluate SaaS and IT vendors faster through structured, consistent and audit-friendly risk assessments.
The platform is designed to support IT, Information Security, Compliance and Procurement teams by transforming vendor documentation into clear decision support material.
By combining governance best practices with AI-assisted analysis, Governli helps organizations reduce manual effort, improve consistency and accelerate vendor onboarding without compromising risk management.
Governli is built on practical experience from enterprise IT, cloud services, vendor management, information security and governance processes.
Frequently Asked Questions
Where is data stored?+
Primary database and file storage are hosted within the EU. AI analysis is a separate processing path with no EU residency currently configured; processing locations and sub-processors are documented on the Sub-processors page.
How is my data protected?+
Uploaded documents are encrypted in transit and at rest. Access is restricted to the processing required for your assessment. Documents are retained while your account is active and deleted on request.
Is customer data used to train AI models?+
No. Customer documents and uploaded information are never used to train AI models.
How accurate are the assessments?+
Governli is decision support. Every conclusion is traceable to the underlying evidence, framework version and AI model version. Results are reviewed by appropriate stakeholders before any vendor is approved.
Can reports be exported as PDF?+
Yes. Every Decision Report can be exported as a PDF and attached to procurement tickets, change management records or audit trails.
Is Governli legal advice?+
No. Governli provides decision support for governance, risk and compliance teams. Final decisions should be reviewed by your information security, legal and procurement stakeholders.
Talk to the team behind Governli
Have a procurement deadline, security review or compliance question? We're happy to help.