BEFORE THE CONTRACT · DOCUMENTS · DECISION
Vendor due diligence software for third party and supplier due diligence before you sign
Request the documents, record the decision and set the re-review date before the contract is signed, in the same system your SOC 2 or ISO 27001 auditor already opens.
From $47/mo · Prices published · No sales call · Monthly billing
Audit readiness
0 %
Built for teams of 5 to 200
What vendor due diligence software does
Vendor due diligence software is the tool you use to check a supplier before you give it your data or production access: it sends the security questionnaire, collects the SOC 2 report or ISO 27001 certificate, the certificate of insurance and the signed DPA or BAA, records who approved the vendor and why, and schedules the next review. Third party due diligence software is the same job under the name larger companies use.
For a US company of 10 to 300 people the trigger is almost always outside pressure. A customer security review asks how you vet subprocessors, or a SOC 2 auditor tests criterion CC9.2 and asks for the file behind your newest critical vendor. ISO 27001 asks the same thing in A.5.19 to A.5.22, and PCI DSS v4.0.1 Requirement 12.8 asks for it on every service provider that touches cardholder data. The question is never whether you trust the vendor. It is whether you can show, with dates, that you checked.
Complies runs that check inside the compliance platform. Each new vendor gets a register entry, a tier based on the data and access it will hold, the documents that tier requires, an owner and a decision. The review evidence maps to the controls it proves, so the vendor file is already part of your audit pack. Pricing is published: vendor risk and due diligence are included from Growth at $119 a month billed yearly, with monthly billing available and no sales call.
The honest limit: Complies does not scan vendors from the outside, does not produce security ratings, and does not screen for sanctions, politically exposed persons or adverse media. If your due diligence is mostly integrity screening or continuous external monitoring, OneTrust Third-Party Due Diligence, UpGuard or Panorays is the better buy.
Complies assists with compliance workflows. It is not legal advice, and it does not certify you or guarantee audit outcomes. Your auditor decides; Complies gets you ready.
What a vendor due diligence file has to prove
You knew what the vendor would touch
Due diligence starts with scope, not paperwork. Customer data, employee data, payment data, PHI, production credentials or nothing sensitive at all: that answer sets the tier, and the tier sets how much evidence you ask for. A file without a scope statement is the first thing an auditor questions.
vendor risk managementYou asked for the right documents and read them
A current SOC 2 Type 2 report or ISO 27001 certificate, a completed questionnaire, a certificate of insurance, and a signed DPA or BAA where data processing or PHI is involved. Reading matters: the exceptions in the SOC 2 report and the complementary user entity controls change what your own team has to do.
evidence collectionSomeone owned the decision and the date
Approve, approve with conditions, or reject, with a name and a date on it, and a re-review date that sits on a calendar somebody watches. Auditors test A.5.22 and CC9.2 by asking for the second review, not the first, so the follow-up is where most programs fail.
compliance obligation trackingThree different products sold as due diligence software
Search for due diligence software and you get three unrelated categories in the same results. Buying the wrong one is an expensive way to discover the difference, so here is the map, including where Complies is not the answer.
| Question | Vendor security due diligence | Integrity and sanctions screening | M&A due diligence data room |
|---|---|---|---|
| What it checks | Whether a supplier can be trusted with your data and systems | Whether a third party is sanctioned, politically exposed or tied to bribery or adverse media | A company you plan to buy or invest in |
| Who buys it | Security, IT and compliance leads preparing for SOC 2, ISO 27001, HIPAA or PCI DSS | Legal, ethics and anti-corruption teams | Corporate development, private equity and deal counsel |
| Typical evidence | SOC 2 report, ISO certificate, security questionnaire, insurance, DPA or BAA | Watchlist hits, ownership records, adverse media results | Financials, contracts, cap table, legal documents in a virtual data room |
| Example tools | Complies, Whistic, Vanta, Drata, Venminder, ProcessUnity | OneTrust Third-Party Due Diligence and other screening services | DealRoom, Datasite, Intralinks, Ansarada |
| Does Complies do it | Yes, as part of the vendor register and audit evidence | No. Complies does not screen watchlists or adverse media | No. Complies is not a data room |
Most companies of 10 to 300 people searching for vendor due diligence software need the first column, because the request came from an auditor or a customer security review. If the request came from your general counsel and mentions sanctions or the FCPA, you need the second. If it came from a banker, you need the third. If you are comparing the compliance platforms that bundle vendor due diligence, see the detailed comparison on Vanta alternatives, OneTrust alternatives and Venminder alternatives.
Vendor due diligence software compared, with the prices each vendor publishes
Pricing in this category is mostly hidden. The table shows what each vendor publishes on its own site, read in October 2026, plus a Vendr benchmark where one exists. Where a vendor publishes nothing, the table says so rather than guessing.
| Platform | What it is | Published pricing (October 2026) | Best for |
|---|---|---|---|
| Complies | Compliance platform with vendor due diligence inside the vendor register | $119 a month billed yearly on Growth, where vendor risk starts. Monthly billing available | Teams of 10 to 300 whose due diligence exists for an audit or a customer review |
| Whistic | Vendor assessment and trust center platform with a catalog of shared vendor profiles | No figures. Request Pricing. Core plan lists unlimited vendors and users and 25 assessments | Security teams that assess many vendors and also publish their own trust center |
| OneTrust | Third-Party Management suite with risk, risk exchange and due diligence products | No figures. Contact sales. Vendr OneTrust-wide media $12,300 a year across 311 purchases, not module-specific | Large organizations that also need sanctions, PEP and adverse media screening |
| UpGuard | Security ratings plus vendor questionnaires | Standard $1,750 a month billed annually for 50 vendors, extra vendors $79 a month | Teams that want an outside-in security score on every supplier |
| Panorays | Questionnaires combined with external cyber posture monitoring | No figures. Custom quote by inventory, assessment and monitoring bundle | Security teams that want assessment and monitoring in one tool |
| Venminder | TPRM platform with outsourced document review, owned by Ncontracts | No figures. Vendr median $10,790, no sample shown | Banks and credit unions with examiner-driven due diligence |
| ProcessUnity | Configurable enterprise third party risk workflow suite | No figures. Quote-only | Dedicated third party risk teams with hundreds of suppliers |
| Vanta | Compliance automation with TPRM standalone or as an add-on | No figures. Vendr median $20,000 a year across 374 purchases, February 2026 | Funded startups running a sales-led compliance rollout |
Vendr medians come from a company that brokers real software contracts. They are budgeting anchors, not quotes, and the OneTrust figure covers every OneTrust module, not third party due diligence alone. Every other figure was read off the vendor's own pricing page in October 2026. Re-check before you build a business case.
What due diligence looks like when it lives next to your controls
A tier before a questionnaire
Each new vendor is scoped first: what data it holds, what access it gets, which frameworks it touches. The tier sets the evidence list, so a payroll processor gets the full file and a design plugin gets one line and a reason.
The documents that matter, with expiry dates
SOC 2 report, ISO 27001 certificate, questionnaire, certificate of insurance and DPA or BAA each sit on the vendor record with an owner and an expiry date. A SOC 2 report older than twelve months is flagged before the auditor finds it.
A recorded decision
Approved, approved with conditions, or rejected, with who decided and when. Conditions such as enabling SSO or signing a BAA become tasks with owners instead of a line in an email.
Evidence mapped once, counted everywhere
The completed review counts as evidence for SOC 2 CC9.2, ISO 27001 A.5.19 to A.5.22 and PCI DSS Requirement 12.8 at the same time, so a company carrying two frameworks does the vendor work once.
Re-reviews the calendar chases
Annual reviews for critical vendors and longer cycles for low tiers land on the compliance calendar with reminders that fire early. The second review is what auditors ask for, and it is the one spreadsheets lose.
A price you can read first
Growth is $119 a month billed yearly and includes vendor risk, control mapping and evidence collection. You can sign up the same afternoon without booking a demo.
Vendor due diligence in four steps
Log the request and scope it
Add the vendor to the register when someone asks to buy it, not after the contract. Record the data it will hold, the access it needs and which frameworks are in scope.
Request the evidence the tier needs
Send your security questionnaire and ask for the SOC 2 Type 2 report or ISO 27001 certificate, the certificate of insurance and the DPA or BAA. Low tiers get a shorter list, written down.
Review and decide
Read the SOC 2 exceptions and complementary user entity controls, note any gaps, and record approve, approve with conditions or reject with a name and a date.
Schedule the next review
Set the re-review date by tier and let reminders chase it. At audit time the vendor section of the evidence pack exports with every decision already dated.
Who this is for, and who it is not
A GOOD FIT WHEN
- A customer security review asked how you vet the vendors that touch their data.
- Your SOC 2 or ISO 27001 auditor wants a due diligence file for every critical vendor.
- New tools get bought on a card and nobody checks them until the audit.
- You want vendor due diligence in the same system as your controls and evidence.
- You want to see the price before a sales call.
LOOK ELSEWHERE WHEN
- You need sanctions, PEP or adverse media screening on third parties.
- You need continuous external security ratings on every supplier.
- You want analysts to review vendor documents for you as a managed service.
- You need M&A due diligence or a virtual data room.
- You need automatic vendor discovery from network or expense data.
Questions buyers ask about vendor due diligence software
Vendor due diligence software is a tool that checks a supplier before you hand it data or access. It scopes the vendor, collects the security questionnaire, SOC 2 report or ISO 27001 certificate, insurance certificate and DPA, records who approved it and why, and schedules the next review so the evidence never goes stale.
It is the same category under a broader name. Third party due diligence software covers vendors, suppliers, resellers and partners, and in large companies it often adds sanctions and adverse media screening. For a SOC 2 or ISO 27001 program, the security review of vendors is the part auditors test.
Most vendors are quote-only. UpGuard publishes $1,750 a month billed annually for 50 vendors. Whistic, Panorays, ProcessUnity and OneTrust publish no figures; Vendr reports a $10,790 median for Venminder and $20,000 for Vanta. Complies includes vendor due diligence from $119 a month billed yearly.
For a critical vendor, request a current SOC 2 Type 2 report or ISO 27001 certificate, a completed security questionnaire, a certificate of insurance, and a signed DPA, plus a BAA if it will touch PHI. Ask for a bridge letter if the SOC 2 period ended more than a few months ago.
Nearly. Due diligence usually means the check before you sign, while a vendor risk assessment can happen at onboarding or at any later review. In practice the same file serves both, which is why Complies keeps the onboarding check and the periodic reviews on one vendor record.
Yes in substance. SOC 2 criterion CC9.2 covers assessing and managing risk from vendors and business partners, and auditors test it by sampling vendors and asking for the review behind each one. A critical vendor with no review on file is a common first Type 2 finding.
For a low-risk SaaS tool it can be a same-day check. For a critical vendor it usually takes one to three weeks, and most of that is waiting for the vendor to return the questionnaire and documents. Tracking requests with owners and dates is what keeps it from stalling.
For a handful of vendors, yes. It breaks when SOC 2 reports expire, owners leave and re-reviews pass without anyone noticing, which tends to happen somewhere past thirty vendors. If you cannot say when a vendor was last reviewed and by whom in under a minute, the spreadsheet has already failed.
Frameworks and guides
SOC 2 compliance software
ISO 27001ISO 27001 compliance software
TPRMOneTrust Third-Party Risk Alternatives Compared With Prices
VRMBest Vendor Risk Management Software for Midsize Firms
VENDORSVendor Risk Assessment Template and Risk Rating Method
TPRMThird-Party Risk Management Software Pricing by Vendor
Check the next vendor before the contract is signed
Prices published, $47 to $299 a month. Monthly billing. Start today, no sales call.