Third-party risk management
Every vendor risk.
One platform. One workflow.
Continuous assessment and management of your vendors' cyber, data protection, AI and compliance risk, without separate tools, spreadsheets or static questionnaires.
- GDPR
- NIS2
- DORA
- EU AI Act
| Vendor | Risk score | Status | |
|---|---|---|---|
| Lumen CRM | Critical | 78 | Action needed |
| Northwind Cloud | Critical | 34 | Assessed |
| Helix Payroll | High | 52 | Evidence due |
| Arcadia Analytics | Medium | 21 | Assessed |
Terms changed · Lumen CRM
Detected 2 days ago- New sub-processor added (outside the EU)
- AI features enabled on customer data by default
Illustrative vendors and scores.
The problem
Your vendors have access to your data and systems. Most organisations can't say what changed last month.
Vendor risk is still handled with email, Excel and one-off questionnaires. The picture is out of date the day it's finished.
It takes specialist knowledge
Cyber security, privacy, AI and contract law all meet in one vendor relationship. Few teams cover all four.
It's split across tools
Security, the DPO, legal and procurement each keep their own list, in their own format.
There is no continuous view
Vendors change their terms, sub-processors and AI features unilaterally, often mid-contract.
It costs too much time
With hundreds of vendors, simply tracking which terms currently apply becomes a job of its own.
Why it matters
The supply chain is now one of the main ways attackers get in.
- 65%
- of large organisations name third-party and supply-chain vulnerabilities as their biggest cyber-resilience challenge, up from 54% a year earlier.
- WEF Global Cybersecurity Outlook 2026
- 48%
- of analysed data breaches involved a third party or the supply chain, a 60% increase in one year.
- Verizon DBIR 2026
- 47%
- of organisations in critical EU sectors rank supply-chain and third-party attacks as their second-biggest cyber threat, after ransomware.
- ENISA NIS Investments 2025
- ~4×
- growth in major supply-chain and third-party compromises since 2020.
- IBM X-Force Threat Intelligence Index 2026
The platform
Vendor risk you can see and manage
Privatron brings the vendor register, assessment, evidence, risk scoring, remediation and reporting into one workflow and keeps watching after the contract is signed.
Vendor register
One list of every vendor, what they can access and how critical they are to your business.
Risk-based questionnaires
Standard assessments that adapt to each vendor's criticality and the data they process.
Evidence collection
Certificates, policies and audit reports collected and stored against each control.
Risk score
Comparable scores across cyber, privacy, AI and compliance, so the riskiest vendors come first.
Terms & change monitoring
Automated tracking of vendor terms: use of your data, new sub-processors, AI integrations and changed security measures.
Remediation tracking
Assign follow-up actions with owners and deadlines, and see what is still open.
Management reporting
A clear view for management and auditors of where the risk sits and what is being done about it.
Audit trail
Every change, decision and follow-up recorded and ready for an auditor or regulator.
How it works
From spreadsheet to a continuous process
- 1
Register
Bring your vendors into one register and classify them by criticality and access to data.
- 2
Assess
Send risk-based questionnaires, collect evidence and get a comparable risk score.
- 3
Act
Agree remediation actions with vendors and track them to completion.
- 4
Monitor
Get alerted when a vendor changes its terms, sub-processors, AI use or security posture.
Regulation
One assessment, mapped to every requirement
Regulators now hold you responsible for your supply chain. Privatron links each vendor's risk to the rules that apply to it.
GDPR
Reg. (EU) 2016/679Use only processors providing sufficient guarantees, and keep track of changes to sub-processors.
NIS2
Directive (EU) 2022/2555Supply-chain security, including security aspects of relationships with direct suppliers and service providers.
DORA
Reg. (EU) 2022/2554ICT third-party risk management, including a register of information on all ICT contractual arrangements.
EU AI Act
Reg. (EU) 2024/1689Know where vendors build AI into the services you use, and what that means for your obligations.
References identify the relevant EU legislation. They are not legal advice.
Who it's for
Built for the people who carry vendor risk
Designed for mid-sized and large organisations in regulated and data-intensive sectors.
Information & cyber security
CISOs, IT and risk managers
Prioritise high-risk vendors and see which security controls are actually evidenced.
Data protection & AI compliance
DPOs and AI governance leads
Track how vendors use personal data, which sub-processors they add and where AI is involved.
Legal & procurement
Lawyers and procurement
Know which terms apply to each vendor today, and when they last changed.
Leadership
Management board
A reliable overview of supply-chain risk for decisions, audits and regulators.
In development
What's coming next
Integrations
Automatic connections to the systems where vendor and contract data already lives.
External risk signals
Monitoring of vendor incidents and other external signals.
AI-assisted analysis
Summaries and recommendations for handling risk, based on parameters you define.
Team
Founders
Risto Hübner
Co-founder
Technology attorney specialising in data protection, AI and cybersecurity. Trained as a DPO and CISO.
Siim Schults
Co-founder
Full-stack and cloud engineer with experience leading development teams.
Pilot programme
Join the pilot
We are working with our first organisations to shape Privatron around real vendor portfolios. Tell us about yours.
- 30-minute platform demo
- Review of your current vendor process
- Pilot terms for early partners
Write to us: info@privatron.eu