# Vendorapp

> Vendorapp is a vendor and third-party risk management platform: instant vendor screening, dual risk ratings, contract tracking and audit-ready evidence for SOC 2, ISO 27001, NIS2 and DORA programmes.

Vendorapp is built for startups and SMEs that need enterprise-grade third-party risk management without enterprise overhead. The guides below are long-form, self-contained answers to the compliance and buying questions vendor-risk teams actually ask.

## Compliance and buying guides

- [What is vendor management?](https://vendorapp.co/vendor-management/): the definition, the six-stage vendor management lifecycle, how vendor management differs from procurement, VRM and TPRM, what an audit-ready programme contains, and how to set one up in a week.
- [Vendor management software: how to choose](https://vendorapp.co/vendor-management-software/): the three kinds of product sold as "vendor management systems" (contingent-workforce VMS, procurement suites, vendor risk platforms), the features that matter for audits and customer due diligence, questions to ask before buying, published pricing, and where Vendorapp fits and where it does not.
- [Vendor management for SOC 2](https://vendorapp.co/vendor-management-soc2/): what SOC 2 auditors look for in vendor management, the most common startup mistakes, and how to build a compliant vendor programme.
- [ISO 27001 supplier management](https://vendorapp.co/vendor-management-iso27001/): what Annex A controls A.5.19–5.22 require, the most common audit failures, and how to comply.
- [Third-party risk management for startups](https://vendorapp.co/third-party-risk-management/): why audits, bank deals and SOC 2 force startups to manage third-party risk properly, and how to do it without the overhead.
- [Selling into financial services](https://vendorapp.co/selling-into-financial-services/): the vendor risk information banks and financial institutions require before onboarding a technology partner, and how to be ready before the questionnaire arrives.
- [Vendor management for fintech](https://vendorapp.co/vendor-management-for-fintech/): what FCA, PRA, DORA and banking partners expect from a fintech's third-party risk management.
- [Fourth-party risk management](https://vendorapp.co/fourth-party-risk-management/): the vendors behind your vendors — why subprocessor and concentration risk is where supply chain incidents start, what DORA, NIS2, GDPR and ISO 27001 expect, and how to build an evidence-linked fourth-party register.
- [Vendor contract management](https://vendorapp.co/vendor-contract-management/): auto-renewals, missed cancellations, contracts buried in email — and how to stop the chaos costing money.
- [Vendor offboarding](https://vendorapp.co/vendor-offboarding/): why incomplete offboarding is one of the most overlooked security and compliance risks, and what auditors look for.
- [Vendor management for Series A startups](https://vendorapp.co/vendor-management-series-a/): what changes about vendor risk after the first funding round, and how to get ahead of it.
- [NIS2 supply chain security guide](https://vendorapp.co/nis2-vendor-risk-guide/): who NIS2 applies to, the ten Article 21 measures, what 21(2)(d) and 21(3) demand of supplier relationships, the 24-hour incident clock, management liability under Article 20, how NIS2 maps to DORA, ISO 27001 and SOC 2, and the ten areas a regulator examines.
- [NIS2 vendor risk readiness checklist](https://vendorapp.co/nis2/): 35 actionable items covering the NIS2 Article 21 supply-chain security requirements.
- [Best third-party risk management software](https://vendorapp.co/best-third-party-risk-management-software/): thirteen TPRM and vendor risk tools grouped by the job each was built for — enterprise platforms, security-ratings services, compliance suites with vendor modules, contract-lifecycle tools, and SMB tools with published pricing — with facts from the vendors’ own sites and a disclosed placement for Vendorapp.

## Comparisons

Each compares Vendorapp with one tool using that vendor's own published information, and says when the other tool is the better choice.

- [Vanta alternative for vendor risk management](https://vendorapp.co/alternatives/vanta/): Vendorapp vs Vanta's third-party risk module — scope, pricing, free plans, and how the two work together.
- [Drata alternative for vendor risk management](https://vendorapp.co/alternatives/drata/): Vendorapp vs Drata's third-party risk module — scope, pricing, free plans, and how the two work together.
- [Venminder alternative for smaller teams](https://vendorapp.co/alternatives/venminder/): Vendorapp vs Venminder (Ncontracts) — who each is built for, pricing, outsourced services and frameworks.
- [OneTrust third-party risk alternative](https://vendorapp.co/alternatives/onetrust/): Vendorapp vs OneTrust's third-party risk module — scope, pricing and time to start.

## Product

- [Features](https://vendorapp.co/features/): Smart Lookup, Vendorapp Intelligence risk ratings, global screening lists, smart contract management, breach tracking and subprocessor detection.
- [Pricing](https://vendorapp.co/pricing/): four public plans, from a free-forever Basic tier to Expert at $599/month.
- [Trust centre](https://vendorapp.co/trust-centre/): how Vendorapp protects customer data and maintains its own security and compliance posture.
- [Blog](https://vendorapp.co/blog/): positions on vendor trust, screening, ESG and contract automation.

## Optional

- [About us](https://vendorapp.co/about-us/)
- [Partner programme](https://vendorapp.co/partners/)
- [Environmental impact report](https://vendorapp.co/environmental-impact-report/)