The clean answer when the auditor asks.
Vittnor — Supply Chain Assurance for the mid-market. Scope your supplier portfolio. Assess what matters with structured questionnaires. Collect evidence with provenance. When the question comes, the answer is already there — each supplier's scope, risk tier, evidence and review decision, with a log of who did what. Not a spreadsheet reconstruction. Built in central Europe by a team led by a cybersecurity practitioner — for the buyers that enterprise GRC suites priced out and ignored.
Stored in the EU — Microsoft Azure, Sweden Central.
Read the long-formFull list, updated on every change. DPA template available before the deal.
Read the long-formHash-anchored, signed, decision-traced. Stands up six months later, unchanged.
Read the long-formThree angles into the same product.
The platform is the same regardless of who's using it. The framing changes depending on what you're trying to defend — to whom, and how fast. Pick the angle that matches; the rest of the product story flows below.
Audit defensibility, not framework gymnastics.
Review decisions and the evidence behind them stand up six months later, unchanged. Article-anchored gap reports map directly to the NIS2 control set your auditor will reference.
- Article 21(2)(d) gap reports anchored to the directive, not interpreted away from it
- Reviewer attribution + timestamp on every approval, immutable post-fact
- Hash-anchored evidence model — same artefact, same answer, six months later
A supplier graph you can query in minutes.
When a supplier discloses an incident, you need to know which of your services depend on them, which sub-suppliers are downstream, and what evidence you currently hold — fast.
- Tier 1 + sub-supplier lineage in a single graph, queryable by impact path
- Reviewer-flagged certificate expiries, with re-review prompts on the calendar
- NIS2 Article 21(2)(d) control mapping by design
Article 20 governance support, not jargon.
NIS2 makes management bodies personally accountable for cybersecurity oversight. The platform produces the board-ready evidence that lets you discharge that accountability.
- Structured monthly summary — supplier posture, open exposures, decisions taken
- Named accountability — your name appears on the documents the board signs
- Audit-readiness sign-off you can hand to the auditor without rebuilding
Four screens. Four stories.
Real product, redacted. Supplier names and numbers are placeholders; the workflow is real.
Risk scored by worst dimension.
Each in-scope subject — a whole supplier type or a single service — carries its own risk assessment, with a tier for each of six categories: availability, confidentiality, privileged access, supply chain, jurisdiction, resilience. Every tier is colour-coded, Low to Critical, and the supplier's tier is the worst category across active assessments — not an average. One weak category never hides behind five good ones.
EnlargeEvery customer request in one inbox.
Suppliers see every inbound customer request in one place — who is asking, what is due, and how far along each answer is. When a buyer requests changes, the request is flagged for attention the moment it comes back — not rediscovered in an email thread weeks later. The questionnaire back-and-forth scattered across inboxes stops here.
EnlargeThe chain doesn't stop at tier one.
Suppliers disclose the sub-processors behind the service — who runs the cloud, the telemetry, the endpoints — each with criticality, region, and the contract clause that declared it. Removing one requires a reason and leaves an archived entry, so historic dependencies stay discoverable. Captured at each review cycle, not reconstructed after the incident.
EnlargeEvery decision, stamped and exportable.
Every approval, rejection and resubmission is logged with the actor, the reason and the timestamp. Auditors get a chronological export that closes regulator questions in minutes, not hours.
EnlargeYour supplier list ends at one name. The risk doesn’t.
Most supplier-management tools audit who you’re paying. Vittnor maps the chain behind them — Tier 1, Tier 2, Tier 3 — and surfaces the supplier you didn’t know was a supplier. Because that’s where the risk actually lives, and that’s where it always has.
How: sub-suppliers captured from supplier-disclosed lists at each review cycle and held alongside the L1 record. Reviewers flag what changed since last cycle. Automated drift detection ships in V1.2 (2027). More on supply chain depth →
The answer is already on file.
When a regulator, an auditor, or your board asks "how did you decide on this supplier eighteen months ago" — most companies reconstruct the answer under pressure. With Vittnor, it is already recorded: a review decision for each supplier, for each period, and the evidence it rested on. Already prepared.
How: each review decision is recorded with who made it and when, and your organisation's audit log keeps a record of who did what. What NIS2 expects in your supplier files →
Vendor breach in the news. Supplier exposure mapped in one search.
An attack on a major vendor becomes your problem if your suppliers depend on them. Vittnor captures those dependencies at every supplier review — direct relationships and the sub-suppliers behind them — so when something happens, the answer is already structured and searchable in the file you maintain.
- Direct suppliers — Tier 1 relationships, current as of the last review.
- Sub-supplier disclosures — Tier 2 and Tier 3 dependencies, surfaced from supplier-provided lists.
- Searchable attributes — Query by vendor name, technology, country, or risk attribute.
- Refresh cadence — Updated on every supplier review — not just when something goes wrong.
From scoping to next year's review.
Six stages, one cycle. The capabilities above (decision trace, supplier graph, Article 21(2)(d) mapping) are what makes each stage hold up — this is the flow they sit inside.
Scope your portfolio
Add suppliers — Tier 1 and below where visibility allows. Tag each by the service they provide and the data classification they touch. Sub-suppliers recorded separately as they are disclosed.
Risk-tier each supplier
Score by data sensitivity × service criticality × replaceability. Top-tier gets full assessment; lower tiers lighter-touch. Either way the tier choice is recorded and timestamped, not implicit.
Request the evidence that matters
When residual risk warrants it, send a tailored questionnaire. You pick which artefacts — SOC 2 Type II, sub-processor list, incident history, BCP test results, contract clauses on file. Supplier receives it via the supplier-side surface; you see what they have already uploaded to their evidence library and what is new.
Record the answers
Answer each requirement from your own records — contracts, documents on file, public information. When the supplier answers in Vittnor, you approve or reject what they send.
Decide and record
Record the review decision, with who made it and when. Future you, the auditor, and the regulator all see the same answer. The file is closed for this cycle.
Watch for change. Re-review on signal.
Annual cadence sits on top — every supplier file knows when it is due. Reviewers flag out-of-cycle re-reviews when something material changes: an incident the supplier reports, certificate expiry, sub-supplier addition, ownership change. Automated trigger detection — and the half-prepared file that comes with it — ships in V1.2 (2027).
Stage 06 feeds back into Stage 03 (or 02 if the change is material enough to re-tier). The cycle is the point — supplier assurance is not a one-off audit, it is the continuous practice the audit trail depends on.
This is what the lifecycle leaves behind.
One supplier review, rendered as the record it produces — scope, risk, questionnaire, decisions, closure. Scroll it the way an auditor would read it back: every entry carries its reason.
Cirrus Edge Networks
The following is the record of a supplier review. Every section below was authored in sequence — scope, risk, questions, decisions, closure — and each entry carries the reason behind it.
Illustrative record — buyer, supplier, and data are fictional.
Scope of review
Three services were enumerated on the supplier's register. Each was triaged against the five-question scoping policy. Of the three, one carried regulated traffic and was placed in scope; one was a public-only asset and exempted under §3.2; one is awaiting triage.
- SVC-001IN SCOPEEdge ingress and DDoS protection“Production traffic for regulated services.”
- SVC-002OUT OF SCOPEStatus page hosting“Public assets only — exempt under scoping policy.”
- SVC-003PENDINGInternal monitoring API“Awaiting triage.”
Risk assessment
Twelve scored questions were answered against the in-scope service. The normalised score is reported alongside the four highest-contributing drivers; the tier follows from the score and the category gates.
- Q1How critical to your operations?→Production traffic, regulated services+6
- Q6Privileged inbound access?→Yes — admin, persistent+6
- Q2Acceptable recovery time?→< 24 hours+4
- Q4Records exposed if breached?→1k–100k+4
Questionnaire assembled and sent
Nine questions are required by the Tier-2 pack. Of these, four were already satisfied by evidence on file in the buyer's library — those questions were skipped to save the supplier's time. The remaining five were dispatched to the supplier's designated security contact on 26 Apr 2026, 14:08 CET; a receipt was logged the same minute.
Decisions and reasons
The supplier returned nine evidence items, each attached to the question it answered and bound to a submission attestation. Every item was reviewed; the reviewer's verdict and the reason behind it are recorded below. The full record is the audit trail — no decision in this register stands without its reason.
- T2Information security policyAPPROVED— Signed v2.4 — covers in-scope service.
- T1ISO 27001 + SoAAPPROVED— Current cert; scope covers production.
- T1SOC 2 Type II reportAPPROVED— NDA-bound copy on file; last 12 months.
- T3Privileged access reviewAPPROVED— Quarterly cadence; service-scoped.
- T2Sub-processor declarationAPPROVED— Matches register; no new processors.
- T3Incident response runbookREJECTED— Missing notification SLA per contract Annex 3.
- T2Data processing addendumAPPROVED— SCC mappings present and current.
- T3Acceptable use policyAPPROVED— Public summary acceptable for service tier.
- T4Data protection / privacy policyAPPROVED— Self-attested OK for T4 evidence.
Closure
The review for the in-scope service is closed. On this cycle's score the reviewer raised the supplier's tier from MEDIUM to HIGH; one item carries an outstanding rejection for which a remediation request has been opened. The review cadence tightens accordingly — twelve months becomes six.
Not enterprise procurement. Not a consumer tool. The segment in between.
Most supplier-assurance platforms target the global procurement team running 5,000-vendor audits. We built ours for the businesses inside the supply chain — the 50–500-person manufacturer, the regional MSP, the medical device company — that suddenly need to prove their security posture to three different customers asking three slightly different questions, and answer for their own supplier risk under NIS2.
What you can use today, what ships, what comes after.
We claim the present accurately and name the future honestly — no feature marketed before it exists, and no hiding the line between what pilot members test now and what general availability brings.
What design partners test now
- Process-driven supplier scoping
- Risk assessment with a tier for each of six categories
- Evidence records with reviewer attribution
- Review decisions per supplier and period, with an audit log of who did what
- In English and Slovak
What ships at general availability
- Microsoft Marketplace listing + procurement-friendly billing
- SLA commitments published at GA
- Decision trace and an auditor export
What ships next
- Review-trigger engine — automated re-review on cert expiry, sub-supplier change, contract amendment
- Sub-supplier change notifications
- Source drift detection — trust-center page changes, posture shifts
What the platform grows into
- Cross-framework crosswalks — NIS2 evidence reused across ISO 27001, DORA, SOC 2
- Shared assurance pools (buyers + suppliers in the same regulated chain)
- Sector-specific evidence templates per Annex I/II category
- Czech and German UI translations
- Single-tenant deployment as an option
Led by a practitioner. Built by a team.
Pavel spent eight years in banking, then managed a global security services team in pharma. He was the person filling in the supplier spreadsheets and preparing the evidence packs for auditors — the work this product now organises. Backend and frontend engineers build Vittnor, with operations, cyber compliance and sales working alongside them.
The full storyCISSP · CISM · Microsoft Partner
Common questions
Is the product available today?+
The pilot is open today — Vittnor is in pre-launch and we are onboarding the first cohort of design partners now. The live production version (V1) is planned for Q4 2026 via the Microsoft Marketplace. Apply via the /pilot page to join the first cohort.
Do I need to be NIS2-regulated to use it?+
No. Many pilot conversations are with suppliers to NIS2-regulated firms who want to demonstrate posture quickly when assurance requests arrive — and with mid-market buyers who are themselves in scope.
How is this different from the NIS2 Supplier Exposure Assessment?+
The Assessment is a fixed-scope advisory engagement: a practitioner walks your supplier portfolio, produces an audit-ready exposure report and a prioritised remediation list, and hands it over. Vittnor is the SaaS — the platform you operate after that initial picture is in your hands. Many buyers do the Assessment first, then onboard the platform.
Does Vittnor replace our audit?+
No. Vittnor produces the structured, attributable evidence an audit draws on — the audit itself still happens with your auditor. What changes is how much of the preparation is already in place when they arrive.
How does the lineage tracing work?+
Where a supplier discloses its sub-processors and downstream providers, we capture the chain from supplier-disclosed lists at each review cycle, so the riskiest path is visible in one place. Most supplier lists only show your direct (Tier 1) relationships; the real risk often hides two or three hops deeper.
How is evidence reused across requests?+
Once a supplier uploads policies, certificates or attestations to their library, future requests from that buyer pull the existing evidence forward. Re-keying the same answers across spreadsheets stops.
What’s your data residency posture?+
Stored in the EU — Microsoft Azure, Sweden Central. Traffic to and from Vittnor passes through Cloudflare’s network, which can handle it outside the EU. Single-tenant deployment is a future option.
Do you offer a Data Processing Agreement?+
Yes. Standard DPA template available on request, GDPR Article 28-compliant. We’ll sign yours if it’s standard, or work through redlines.
Who are your sub-processors?+
Our sub-processor list is published and updated on every change. Currently: Microsoft (Azure hosting, database and file storage in Sweden Central; Entra ID for sign-in) and Cloudflare (network protection for all traffic).
What happens to my data when the pilot ends?+
Export on request, free of charge, in a machine-readable format. At least 30 days to take your data after you leave, then erasure, confirmed in writing on request.
How does this differ from OneTrust, Vanta, or Diligent 3rdRisk?+
Those are enterprise procurement-side tools, priced and configured for global teams running thousands of vendor audits. Vittnor is built for the mid-market — companies that need defensible NIS2 supplier assurance without a six-figure platform contract or a six-month implementation. We have 30–40% fewer features than enterprise GRC suites, at a price that reflects that. Honest tradeoff.
What’s a typical onboarding timeline?+
Pilot customers start with their most important suppliers: add them, run the scope check and the risk assessment, and start collecting evidence. The rest of the portfolio follows from there, at the pace your team sets.
Join the pilot — open today.
The pilot is open now. A small first cohort of mid-market buyers and their key suppliers — members join free or at compute cost and shape the roadmap. Production-ready V1 ships Q4 2026 via the Microsoft Marketplace. Mutual exchange — we help you, you help us.
Nothing to install, no credit card, no procurement cycle. See the plans →