Use case: vendor and third-party review
A vendor review is a decision about what a company outside your control may hold, for how long, and on whose accountability. Bring the vendor's answers, the artifacts behind them, the contract that binds them, and the person who will carry whatever risk survives.
Request accessAccess is limited. A person reviews every request.
The occasion
Nobody opens a vendor review because it is interesting. It opens because a renewal is due, because a new data class is about to cross a boundary, or because someone asked a question the last review cannot answer. The occasion sets the deadline, and the deadline is usually why a review gets settled on the strength of a questionnaire.
A review that opens without these can still produce a decision. It cannot produce one that survives being read six months later.
Contested claims
A questionnaire is a list of assertions written by the party with the most to gain from them. The review is the work of putting each one against the artifact that would support it, and marking the ones where no artifact exists. The claims below recur in almost every vendor review, and the last one is not the vendor's.
01As stated
What the room asks of it
A certificate names a scope and a period. The question is whether the systems that will hold your data sit inside that scope, and whether the period has lapsed.
What would settle it
The scope section of the report itself, read against the systems named in the integration, with the report date visible beside it.
02As stated
What the room asks of it
Residency answers usually describe primary storage. Backups, support tooling, and subprocessors are where the answer quietly stops being true.
What would settle it
A dated subprocessor list with regions, plus the contract clause that makes residency enforceable rather than aspirational.
03As stated
What the room asks of it
Remediated by whom, verified how, and are the findings that were accepted rather than fixed written down anywhere the buyer can read them?
What would settle it
A remediation summary with dates and an owner, or an explicit acceptance from someone with the authority to accept it.
04As stated
What the room asks of it
The date is usually real. The absence of an alternative usually is not. A review that cannot say what the fallback costs is not weighing anything.
What would settle it
A named fallback with its cost and its date, or a statement on the record that no fallback was examined.
The room
A vendor review fails when the person who wants the vendor is also the person who clears it. The room makes the separation explicit and keeps it visible in the record. Agents participate on the same terms as the people: each is answerable for a specific part of the evidence, including for reporting what it could not reach.
Accepting or declining the residual risk under their own name, and the date that acceptance expires.
The business need, the deadline, and the fallback if the vendor is declined.
Reading the artifacts against the claims, and marking every claim no artifact supports.
The vendor's public record, prior incidents, and current disclosures, with the sources it could not reach reported rather than omitted.
Locating the contract and report passages each claim depends on, and quoting them with their source location.
Settled or held
Either the decision is settled, with an owner and a date attached to it, or it is held, with the proof that is missing named. The second state is the one most tools cannot represent, and it is the one that keeps a deadline from deciding on the evidence's behalf.
Example of a settled decision. Not a customer record.
Cleared for the two data classes named, with regional processing restricted by contract.
Example of a held verdict. Not a customer record.
Held. The vendor cannot be cleared on the questionnaire alone.
Missing proof
What to bring: Bring the completed questionnaire and the artifacts behind it, the contract or the draft, the data classes actually in scope, and the name of the person who will carry the residual risk. Share only material you are authorized to bring into this review.
Access
Request access for a bounded cohort settling vendor clearances with the artifacts, the contested claims, and the named acceptance held in one place.
An account is the door to the product as it stands today. Availability of the limited alpha is a separate question: a request is reviewed by a person and does not grant admission, an invitation, an account, a Room, entitlement, or payment access.