# API Authentication with Bearer Tokens
Source: https://docs.visotrust.com/api-reference/authentication
Authenticate requests to the VISO TRUST API with a bearer token generated from your user profile, including header format and base URL.
## About the API
VISO TRUST exposes a public **REST API** under `/api/v1/*` for custom integrations and automated workflows. Every endpoint in the sidebar is generated from the platform's **OpenAPI (Swagger)** specification, served at [`https://app.visotrust.com/v1/api-docs`](https://app.visotrust.com/v1/api-docs) — you can import that URL into Postman, Insomnia, or any OpenAPI-compatible client.
The same bearer token also authenticates the **MCP server** at `https://mcp.visotrust.com/mcp` for AI tool integrations. See [Available integrations](/integrations/available-integrations) for a broader list of ways to connect VISO TRUST to other systems.
## Authentication Overview
The VISO TRUST API uses bearer token authentication. Every request must include an API token in the `Authorization` header. Requests without a valid token are rejected.
## Base URL
All endpoints are served from:
```
https://app.visotrust.com
```
Each path in this reference is appended to that base URL — for example, `GET /api/v1/relationships` resolves to `https://app.visotrust.com/api/v1/relationships`.
## Generate an API Token
API tokens are tied to a user account. The public API requires program-level access, so generate the token from an **Admin** or **Program Manager** account.
Log in to the [Dashboard](https://app.visotrust.com) as the user the token should act as, then open your user profile.
Generate an API token from the profile. The token is shown only once at generation.
Copy the token and store it in a secrets manager or equivalent. You cannot retrieve it again later — if it is lost, generate a new one.
For automation and integrations, generate the token from a dedicated service account rather than a personal account. This keeps API access from being tied to an individual's employment status and makes token lifecycle easier to manage.
## Authenticate a Request
Send the token as a bearer token in the `Authorization` header:
```bash theme={null}
curl https://app.visotrust.com/api/v1/relationships \
-H "Authorization: Bearer YOUR_API_TOKEN"
```
The same token authenticates the [MCP server](https://mcp.visotrust.com/mcp) for AI tool integrations. Pass it as a bearer token there as well.
The interactive playground on each endpoint page sends real requests to `https://app.visotrust.com` using the token you enter. Use a token scoped to an account with the access you intend to exercise.
## Permissions
The public API requires program-level access. Tokens generated from an **Admin** or **Program Manager** account can call the `/api/v1/*` endpoints; tokens from Contributor or Viewer accounts cannot. If a request returns a permission error, confirm the token's account has Admin or Program Manager access. See [Roles and permissions](/getting-started/roles-and-permissions) for details.
# Download artifacts for an assessment as a zip
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/download-artifacts-for-an-assessment-as-a-zip
https://app.visotrust.com/v1/api-docs get /api/v1/assessments/{id}/artifacts
# Export the LLM assessment summary as a PDF
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/export-the-llm-assessment-summary-as-a-pdf
https://app.visotrust.com/v1/api-docs get /api/v1/assessments/{id}/summary/export
# Get an assessment
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/get-an-assessment
https://app.visotrust.com/v1/api-docs get /api/v1/assessments/{id}
# Get the summary for an assessment
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/get-the-summary-for-an-assessment
https://app.visotrust.com/v1/api-docs get /api/v1/assessments/{id}/summary
# Start an Assessment
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/start-an-assessment
https://app.visotrust.com/v1/api-docs post /api/v1/assessments
# Update the expiration date of an in-progress assessment
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/update-the-expiration-date-of-an-in-progress-assessment
https://app.visotrust.com/v1/api-docs put /api/v1/assessments/{id}/expiration-date
# Update the follow-up settings of an in-progress assessment
Source: https://docs.visotrust.com/api-reference/client-api-assessment-rest-resource/update-the-follow-up-settings-of-an-in-progress-assessment
https://app.visotrust.com/v1/api-docs put /api/v1/assessments/{id}/followup
# Get all user audit log events for your organization in the time frame, limited to 500 records
Source: https://docs.visotrust.com/api-reference/client-api-audit-log-rest-resource/get-all-user-audit-log-events-for-your-organization-in-the-time-frame-limited-to-500-records
https://app.visotrust.com/v1/api-docs post /api/v1/audit-log/user-events
# Get filtered audit log events based on specific types and categories for your organization, limited to 500 records
Source: https://docs.visotrust.com/api-reference/client-api-audit-log-rest-resource/get-filtered-audit-log-events-based-on-specific-types-and-categories-for-your-organization-limited-to-500-records
https://app.visotrust.com/v1/api-docs post /api/v1/audit-log/events
# Chat with VISO Agent
Source: https://docs.visotrust.com/api-reference/client-api-chat-rest-resource/chat-with-viso-agent
https://app.visotrust.com/v1/api-docs post /api/v1/chat
# Get all business cases for your organization.
Source: https://docs.visotrust.com/api-reference/client-api-context-type-rest-resource/get-all-business-cases-for-your-organization
https://app.visotrust.com/v1/api-docs get /api/v1/business-cases
# Get all data types for your organization.
Source: https://docs.visotrust.com/api-reference/client-api-data-type-rest-resource/get-all-data-types-for-your-organization
https://app.visotrust.com/v1/api-docs get /api/v1/data-types
# Bulk create BitSight intelligence reports
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/bulk-create-bitsight-intelligence-reports
https://app.visotrust.com/v1/api-docs post /api/v1/external-intelligence-reports/bitsight/bulk
# Bulk create Recorded Future intelligence reports
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/bulk-create-recorded-future-intelligence-reports
https://app.visotrust.com/v1/api-docs post /api/v1/external-intelligence-reports/recorded-future/bulk
# Bulk create SecurityScorecard intelligence reports
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/bulk-create-securityscorecard-intelligence-reports
https://app.visotrust.com/v1/api-docs post /api/v1/external-intelligence-reports/security-scorecard/bulk
# Create a new BitSight intelligence report
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/create-a-new-bitsight-intelligence-report
https://app.visotrust.com/v1/api-docs post /api/v1/external-intelligence-reports/bitsight
# Create a new Recorded Future intelligence report
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/create-a-new-recorded-future-intelligence-report
https://app.visotrust.com/v1/api-docs post /api/v1/external-intelligence-reports/recorded-future
# Create a new SecurityScorecard intelligence report
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/create-a-new-securityscorecard-intelligence-report
https://app.visotrust.com/v1/api-docs post /api/v1/external-intelligence-reports/security-scorecard
# Get all intelligence reports for a specific vendor
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/get-all-intelligence-reports-for-a-specific-vendor
https://app.visotrust.com/v1/api-docs get /api/v1/external-intelligence-reports/vendor/{vendorDomain}
# Get the latest intelligence report for a vendor from a specific source
Source: https://docs.visotrust.com/api-reference/client-api-external-intelligence-report-rest-resource/get-the-latest-intelligence-report-for-a-vendor-from-a-specific-source
https://app.visotrust.com/v1/api-docs get /api/v1/external-intelligence-reports/vendor/{vendorDomain}/latest/{source}
# Get all questionnaires available for a relationship.
Source: https://docs.visotrust.com/api-reference/client-api-questionnaire-rest-resource/get-all-questionnaires-available-for-a-relationship
https://app.visotrust.com/v1/api-docs get /api/v1/relationships/{id}/questionnaires
Returns every active organization-level questionnaire alongside its effective enabled state for the given relationship. A questionnaire is enabled for the relationship when it has been explicitly enabled via `PUT /relationships/{id}/questionnaires`, or when no relationship-level configuration exists and the questionnaire is enabled at the organization level.
# Get all questionnaires available to your organization.
Source: https://docs.visotrust.com/api-reference/client-api-questionnaire-rest-resource/get-all-questionnaires-available-to-your-organization
https://app.visotrust.com/v1/api-docs get /api/v1/questionnaires
Returns the active questionnaires configured for your organization. Use `GET /relationships/{id}/questionnaires` to see which questionnaires are enabled for a particular relationship, and `PUT /relationships/{id}/questionnaires` to enable or disable them per relationship before passing their ids to the Start Assessment endpoint via the `questionnaires` field.
# Update which questionnaires are enabled for a relationship.
Source: https://docs.visotrust.com/api-reference/client-api-questionnaire-rest-resource/update-which-questionnaires-are-enabled-for-a-relationship
https://app.visotrust.com/v1/api-docs put /api/v1/relationships/{id}/questionnaires
Replaces the relationship's enabled-questionnaire list with the provided ids. Any active organization questionnaire not included in `enabledQuestionnaireIds` is disabled for the relationship.
# Archive a relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/archive-a-relationship
https://app.visotrust.com/v1/api-docs put /api/v1/relationships/{id}/archive
# Create a Relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/create-a-relationship
https://app.visotrust.com/v1/api-docs post /api/v1/relationships
# Create a Relationship by domain
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/create-a-relationship-by-domain
https://app.visotrust.com/v1/api-docs post /api/v1/relationships/domain
# Create tags
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/create-tags
https://app.visotrust.com/v1/api-docs post /api/v1/tags
# Download active artifacts for a relationship as a zip
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/download-active-artifacts-for-a-relationship-as-a-zip
https://app.visotrust.com/v1/api-docs get /api/v1/relationships/{id}/artifacts
# Get a list of all relationships and their assessment details
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/get-a-list-of-all-relationships-and-their-assessment-details
https://app.visotrust.com/v1/api-docs get /api/v1/relationships
# Get a relationship and its assessment details
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/get-a-relationship-and-its-assessment-details
https://app.visotrust.com/v1/api-docs get /api/v1/relationships/{id}
# Get assessment history for a relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/get-assessment-history-for-a-relationship
https://app.visotrust.com/v1/api-docs get /api/v1/relationship/{id}/assessments
# Mark a relationship as not onboarded
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/mark-a-relationship-as-not-onboarded
https://app.visotrust.com/v1/api-docs put /api/v1/relationships/{id}/offboard
# Onboard a relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/onboard-a-relationship
https://app.visotrust.com/v1/api-docs put /api/v1/relationships/{id}/onboard
# Partially update a relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/partially-update-a-relationship
https://app.visotrust.com/v1/api-docs patch /api/v1/relationships
# Search for relationships by domain/name (deprecated)
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/search-for-relationships-by-domainname-deprecated
https://app.visotrust.com/v1/api-docs get /api/v1/relationships/search
# Search for relationships by filter criteria
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/search-for-relationships-by-filter-criteria
https://app.visotrust.com/v1/api-docs post /api/v1/relationships/search
# Update a relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/update-a-relationship
https://app.visotrust.com/v1/api-docs put /api/v1/relationships
# Update third party contact details for a relationship
Source: https://docs.visotrust.com/api-reference/client-api-relationship-rest-resource/update-third-party-contact-details-for-a-relationship
https://app.visotrust.com/v1/api-docs put /api/v1/third-party-contact
# Get all risk advisories for a vendor by relationship ID
Source: https://docs.visotrust.com/api-reference/client-api-risk-advisory-rest-resource/get-all-risk-advisories-for-a-vendor-by-relationship-id
https://app.visotrust.com/v1/api-docs get /api/v1/relationships/{id}/risk-advisories
# Get all risk advisories for a vendor by vendor ID
Source: https://docs.visotrust.com/api-reference/client-api-risk-advisory-rest-resource/get-all-risk-advisories-for-a-vendor-by-vendor-id
https://app.visotrust.com/v1/api-docs get /api/v1/vendors/{id}/risk-advisories
# Get all users in your organization
Source: https://docs.visotrust.com/api-reference/client-api-user-rest-resource/get-all-users-in-your-organization
https://app.visotrust.com/v1/api-docs get /api/v1/users
# Get user by email
Source: https://docs.visotrust.com/api-reference/client-api-user-rest-resource/get-user-by-email
https://app.visotrust.com/v1/api-docs get /api/v1/users/{email}
# Post apiv1users
Source: https://docs.visotrust.com/api-reference/client-api-user-rest-resource/post-apiv1users
https://app.visotrust.com/v1/api-docs post /api/v1/users
# Get apiv1directorysearch
Source: https://docs.visotrust.com/api-reference/client-api-vendor-directory-rest-resource/get-apiv1directorysearch
https://app.visotrust.com/v1/api-docs get /api/v1/directory/search
# Get vendor risk summary by vendor ID
Source: https://docs.visotrust.com/api-reference/client-api-vendor-risk-summary-rest-resource/get-vendor-risk-summary-by-vendor-id
https://app.visotrust.com/v1/api-docs get /api/v1/vendors/{id}/risk-summary
# Get vendor risk summary by vendor name or domain
Source: https://docs.visotrust.com/api-reference/client-api-vendor-risk-summary-rest-resource/get-vendor-risk-summary-by-vendor-name-or-domain
https://app.visotrust.com/v1/api-docs get /api/v1/vendors/risk-summary
# Get all webhooks for your organization
Source: https://docs.visotrust.com/api-reference/client-api-webhook-rest-resource/get-all-webhooks-for-your-organization
https://app.visotrust.com/v1/api-docs get /api/v1/webhooks
# Get webhook by id for your organization
Source: https://docs.visotrust.com/api-reference/client-api-webhook-rest-resource/get-webhook-by-id-for-your-organization
https://app.visotrust.com/v1/api-docs get /api/v1/webhooks/{webhookId}
# Register a webhook
Source: https://docs.visotrust.com/api-reference/client-api-webhook-rest-resource/register-a-webhook
https://app.visotrust.com/v1/api-docs post /api/v1/webhooks
# Un-register a webhook
Source: https://docs.visotrust.com/api-reference/client-api-webhook-rest-resource/un-register-a-webhook
https://app.visotrust.com/v1/api-docs delete /api/v1/webhooks/{webhookId}
# Update a webhook configuration
Source: https://docs.visotrust.com/api-reference/client-api-webhook-rest-resource/update-a-webhook-configuration
https://app.visotrust.com/v1/api-docs put /api/v1/webhooks
# Inviting Your Team
Source: https://docs.visotrust.com/getting-started/inviting-your-team
Invite users to VISO TRUST, assign Admin, Program Manager, Contributor, or Viewer roles, designate business owners, and set default notification routing.
Getting your team into VISO TRUST early means better coverage, clearer ownership, and fewer gaps in your risk program. This page covers how to invite users, assign roles, and set up default notification behavior.
## Inviting a User
In the left sidebar, select **Settings**, then select **Users**.
Enter the user's name and email address, check **Invite to VISO TRUST**, and select their role: **Admin**, **Program Manager**, **Contributor**, or **Viewer**.
Not sure which role to assign? See [Role-Based Access](/getting-started/roles-and-permissions).
The user receives an email with a link to set up their account. If they don't receive it, ask them to check their spam folder or contact [support@visotrust.com](mailto:support@visotrust.com).
If your organization uses SSO, users will be redirected to your identity provider when they log in. An Admin must configure SSO before users can authenticate this way. See [SSO / Okta Configuration](/organization-settings/sso).
## Assigning Business Owners and Assessment Leads
Once a user is in the platform, you can designate them as the **Business Owner** or **Assessment Lead** of specific relationships. These are not roles — they are per-relationship designations that grant a Contributor edit access on that relationship. See [Role-Based Access](/getting-started/roles-and-permissions#relationship-designations) for how each designation affects permissions.
To assign a Business Owner or Assessment Lead:
1. Open the relationship from the Relationships page
2. Open the **Relationship configuration** dialog using the gear icon
3. Select a user from the **Business Owner** or **Assessment lead** field
You can also set these designations when creating a new relationship. To assign them across many relationships at once, use the **Assign assessment lead** and **Assign business owner** bulk actions on the Relationships list page. Each relationship can have a different person in each designation — the two are fully independent.
## Default Subscribers
A **Default Subscriber** is a user who is automatically subscribed to every relationship in the platform — existing and future. This is useful for centralized risk or compliance teams who need full visibility across the vendor portfolio.
To enable Default Subscriber for a user:
Find the user you want to configure.
Select the three-dot menu next to the user and select **Edit**.
Check the **Default Subscriber** box and select **Save**.
Once enabled, that user is immediately subscribed to all existing relationships and any new ones going forward.
A Default Subscriber cannot be removed from an individual relationship without first disabling the Default Subscriber setting on their user profile.
You can have multiple Default Subscribers. Good candidates include:
* Centralized risk or compliance teams
* Security operations centers (SOCs)
* Audit and governance teams
## Managing Subscribers on Individual Relationships
Outside of Default Subscribers, you can manually add or remove subscribers on any relationship. Open the relationship, open the **Relationship configuration** dialog using the gear icon, and manage the **Subscribers** list there. To update subscribers on many relationships at once, select them on the Relationships list page and use the **Manage subscribers** bulk action to add or remove users across the selection.
Subscribers receive notifications for:
* Assessment status changes
* Risk advisories and breach alerts
* Remediation requests
* Lifecycle events (expiring documentation, upcoming recertifications)
Think of Subscribers like "watchers" on a ticket — they stay informed without being responsible for the relationship. Use them to give stakeholders visibility without granting edit access.
# Key Concepts
Source: https://docs.visotrust.com/getting-started/key-concepts
Learn the core VISO TRUST concepts: relationships, assessments, artifacts, risk scoring, business cases, and the AI that powers the platform.
Understanding how VISO TRUST is structured helps you get more out of the platform. Everything in VISO TRUST is built around a small set of core concepts.
## Relationships
A **relationship** is your record of a business connection with a third-party vendor. It's the central object in VISO TRUST — every assessment, risk score, advisory, and piece of documentation lives under a relationship.
When you create a relationship, you define:
* **Who the vendor is** (selected from the VISO TRUST directory or created as a new entry)
* **How you use them** (data types they access, systems they touch, business purpose)
* **Who owns the relationship internally** (the Business Owner)
Relationships persist over time. As you run new assessments, receive advisories, and update vendor context, the relationship record captures the full history.
## Assessments
An **assessment** is how VISO TRUST evaluates a vendor's security posture. There are three ways an assessment can happen:
| Type | How it works |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Instant Assessment** | Runs automatically when you create a relationship. Uses publicly available data — certifications, security pages, audit reports — to generate an immediate risk profile. No vendor involvement required. |
| **Artifact Upload** | You upload security documents directly (SOC 2, ISO 27001, penetration test reports, etc.). VISO TRUST analyzes them using AI and maps findings to your risk framework. |
| **Vendor Collection** | VISO TRUST sends the vendor a collection request. The vendor submits documentation through a secure portal. VISO TRUST analyzes submissions and, optionally, routes them through an expert auditor review. |
Assessments move through defined phases — from creation through collection, review, and completion. See [Assessments](/third-parties/assessments) for the full lifecycle.
## Risk Scoring
VISO TRUST calculates two risk scores for every vendor:
**Inherent Risk** — the level of risk before accounting for the vendor's security controls. Driven by two factors:
* **Impact**: how sensitive the data the vendor handles is
* **Likelihood**: how exposed the relationship is (what systems they touch, what access they have)
**Residual Risk** — the level of risk after factoring in the vendor's actual security controls. A vendor with strong, verified controls will have a lower residual risk than their inherent risk suggests.
Risk scores are expressed as **No Context**, **Low**, **Medium**, **High**, or **Extreme**, backed by numeric values on a consistent scale.
Residual risk is what you should act on. A vendor with high inherent risk but strong controls may be lower priority than a vendor with medium inherent risk and few verified controls.
## Control Framework
VISO TRUST maps all vendor evidence to a **control framework** — a structured set of security requirements. The default framework is grounded in NIST 800-53 and covers:
* Security
* Privacy
* Artificial Intelligence
* Resilience
* Product Security
* Cyber Insurance
* Service Locations
* Subservicers
Controls are populated by evidence from assessments: a SOC 2 report might satisfy a set of security controls; a DPA might satisfy privacy controls. You can customize which control domains apply to your assessments and build custom frameworks if your program requires it.
## Artifact Intelligence
**Artifact Intelligence** is VISO TRUST's AI document analysis engine. When a security document is uploaded — whether by you or a vendor — Artifact Intelligence:
1. Reads and classifies the document
2. Extracts risk-relevant information
3. Maps findings to controls in your framework
4. Flags gaps, anomalies, or areas of concern
Work that takes a human analyst hours is completed in under a minute.
## Risk Advisories
**Risk Advisories** are alerts generated when a vendor in your portfolio experiences a security incident, breach, certification change, or other risk-relevant event. VISO TRUST monitors your vendors continuously and surfaces advisories in real time — so you don't have to track industry news manually.
## VISO Chat Agent
**VISO Chat Agent** is an AI assistant built into the platform. It can answer questions about your vendor portfolio, surface insights from assessments, and help you understand risk data — in natural language, without writing queries or navigating reports.
## Trust Profiles
A **Trust Profile** allows a vendor organization to proactively share their security documentation with VISO TRUST customers. If a vendor has a trust profile, their documents are pre-loaded when you assess them — reducing the need to chase artifacts.
***
Ready to see these concepts in action? Follow the [Quick Start Guide](/getting-started/quick-start) or jump into [Relationships](/third-parties/relationships) to add your first vendor.
# Navigating the Platform
Source: https://docs.visotrust.com/getting-started/navigating-the-platform
A tour of the VISO TRUST interface: the relationships list, vendor directory, assessments view, risk advisories, insights dashboards, and settings.
VISO TRUST is organized around the main areas of your third-party risk program. Here's an overview of each section and what you'll find there.
## Main Navigation
The left sidebar gives you access to all primary sections of the platform.
### Relationships
Your vendor portfolio lives here. The Relationships page shows every third-party connection in your organization, along with their current risk scores, assessment status, and any active advisories.
From the Relationships page you can:
* Add new vendors individually or via bulk import
* Filter and search across your portfolio
* Access individual relationship detail pages
Each **relationship detail page** is the hub for a specific vendor — containing their risk profile, assessment history, artifacts, activity log, and more.
### Directory
The **Directory** is VISO TRUST's catalog of known third-party organizations. When you add a new relationship, you search here first. Directory entries include pre-populated company information that helps VISO TRUST build an instant risk profile faster.
### Assessments
The **Assessments** view shows all active and historical assessments across your portfolio. Use it to track status, follow up on outstanding collection requests, and review completed assessments in one place — without navigating into each relationship individually.
### Risk Insights
**Risk Insights** provides portfolio-level dashboards powered by Metabase. Use it to analyze risk distribution across your vendor base, track program metrics over time, and surface trends that inform strategic decisions.
Risk Insights is available to all roles — Admins, Program Managers, Contributors, and Viewers. Data may be scoped to the relationships each user can access.
### Monitoring
The **Monitoring** section surfaces alerts for vendors in your portfolio — security incidents, breach notifications, certificate expirations, and more, across the **Risk Advisories** and **Vulnerabilities** tabs. Advisories are generated automatically as VISO TRUST monitors your vendors continuously.
### VISO Chat Agent
**VISO Chat Agent** is the AI assistant, available from the assistant button in the top navigation bar. Ask questions about your vendor portfolio, get summaries of assessment findings, or explore risk data in plain language.
### Trust
The **Trust** section contains tools for artifact and evidence management:
* **Artifact Intelligence** — AI-powered document analysis
* **Questionnaires** — create and manage questionnaires
### Settings
**Settings** covers everything at the organization level:
* User management and roles
* Organization profile and branding
* Risk model configuration
* Notification preferences
* Integrations and SSO
* Tags
***
## Key Pages at a Glance
| Where you're going | How to get there |
| ----------------------------------- | ------------------------------------------------- |
| Add a new vendor | Third Parties → Relationships → Add relationship |
| Check a vendor's risk score | Third Parties → Relationships → select any vendor |
| See all active assessments | Assessments (left nav) |
| Review an advisory | Monitoring (left nav) |
| Upload a document for AI analysis | Relationship → Add information |
| Invite a team member | Settings → Users → Add User |
| Configure your risk model | Settings → Your Framework → Risk calculations |
| Ask a question about your portfolio | VISO Chat Agent (top nav) |
***
The search bar at the top of the platform searches across relationships and vendors. It's the fastest way to jump to a specific vendor.
# Quick Start Guide
Source: https://docs.visotrust.com/getting-started/quick-start
A 30-day setup plan for new VISO TRUST customers: configure your org, invite your team, add vendors, run assessments, and turn on monitoring.
This guide walks you through the recommended setup sequence for a new VISO TRUST deployment. By the end of week four, you should have a functioning risk program with active relationships, completed assessments, and continuous monitoring in place.
## Before You Begin
Make sure you have:
* An active VISO TRUST account (check your email for your setup link)
* Admin access — you'll need it for the initial configuration steps
* A list of your top third-party vendors to start with
If you haven't received your account setup email, contact your Customer Success Manager or reach out to [support@visotrust.com](mailto:support@visotrust.com).
***
## Week 1 — Set Up Your Foundation
### 1. Log In and Explore the Platform
Navigate to [app.visotrust.com](https://app.visotrust.com) and log in. If your organization uses SSO, you'll be redirected to your identity provider automatically.
Take a few minutes to explore the main sections: Relationships, Assessments, Monitoring, and Settings. The [Navigating the Platform](/getting-started/navigating-the-platform) guide has a quick overview of each area.
### 2. Configure Your Organization Profile
Go to **Settings → Org Profile** and fill in your organization name, logo, and primary contact information.
### 3. Invite Your Team
Go to **Settings → Users** and invite the people who will manage your vendor risk program. At minimum, invite your primary risk team members as **Contributors** and designate any stakeholders who need visibility as **Viewers**.
See [Inviting Your Team](/getting-started/inviting-your-team) for step-by-step instructions.
### 4. Add Your First Vendors
Go to **Third Parties → Relationships** and select **Add relationship** to add your highest-priority vendors. Start with 10–20 vendors so you have enough data to validate your setup without being overwhelmed.
For each relationship:
* Search the VISO TRUST directory for the vendor
* Assign a Business Owner
* Leave **Predict relationship context and instantly assess** selected — VISO TRUST immediately analyzes the vendor using public data
If you have a large vendor list, use [Bulk Import](/third-parties/bulk-import) to add them all at once via CSV.
Start with vendors you know well — ones where you already have documentation or strong familiarity. It's easier to validate VISO TRUST's outputs when you can sanity-check them against what you already know.
***
## Week 2 — Run Your First Assessments
### 5. Review Instant Assessment Results
By now, your newly added vendors will have instant assessment results. Go to any relationship and review:
* The inherent and residual risk scores — marked transitional (italics and an asterisk) until an assessment completes
* What public artifacts were discovered (certifications, security pages, audit reports)
* Any risk advisories already surfaced
### 6. Configure Relationship Context
For your highest-priority vendors, add business context to each relationship:
* **Business case** — how your organization uses the vendor (data they access, systems they touch)
* **Data types** — what types of data the vendor handles
This refines the risk score from a generic estimate to one that reflects your actual exposure. To speed it up, use **Predict relationship context** and then review what VISO TRUST proposes rather than filling every answer in by hand.
### 7. Start Vendor-Involved Assessments
For vendors where you need deeper validation, send a collection request. Go to the relationship, select **Start Assessment**, and choose to involve the vendor. VISO TRUST sends them a secure link to submit documentation.
While those are in flight, you can also upload documents directly if you already have them on hand.
***
## Week 3 — Review Results and Act on Risk
### 8. Review Completed Assessments
As assessments complete, review the findings in each relationship:
* Check the risk score and what drove it
* Read the AI-generated Smart Summary for a quick executive overview
* Identify any control gaps or findings that need follow-up
### 9. Accept Risk or Request Remediation
For each completed assessment, take an action:
* **Accept risk** — document your decision and the business justification
* **Request remediation** — flag specific findings for the vendor to address
* **Send a follow-up questionnaire** — ask the vendor for additional information on specific controls
### 10. Set Up Notifications
Go to **Settings → Org Profile → Notifications** and configure alerts for:
* New risk advisories on your vendors
* Assessment status changes
* Upcoming recertifications or expiring documents
***
## Week 4 — Tune Your Program
### 11. Review Your Risk Model
Go to **Settings → Risk Model** and review how VISO TRUST is scoring risk for your organization — your current tolerance, its thresholds, and how your portfolio sits across the risk labels. To change any of it, edit **Settings → Your Framework → Risk calculations** and publish.
### 12. Set Up Integrations
If your organization uses tools like Slack, Coupa, or ServiceNow, configure the relevant integrations in **Settings → Integrations**. See [Integrations](/integrations/overview) for what's available.
### 13. Establish Your Ongoing Cadence
VISO TRUST works best as a continuous program, not a point-in-time exercise. Decide on:
* How often you'll reassess vendors (typically annually for critical vendors, every 18–24 months for lower-risk ones)
* Who reviews risk advisories and on what timeline
* How you'll handle new vendor onboarding going forward
***
## What's Next
Learn how to manage relationships and assessments in depth.
Understand how risk scores are calculated and how to customize your risk model.
Connect VISO TRUST to your existing tools and workflows.
Automate your TPRM workflows using the VISO TRUST API.
# Role-Based Access
Source: https://docs.visotrust.com/getting-started/roles-and-permissions
Compare the Admin, Program Manager, Contributor, and Viewer roles in VISO TRUST, plus the Business Owner and Assessment Lead relationship designations.
VISO TRUST uses four organization-level roles to control what users can see and do in the platform. Assign roles based on how each person participates in your third-party risk program.
## Roles
Full platform access. Can edit all relationships, manage all assessments, and edit program settings. Best for TPRM program owners who also administer the platform.
Can edit all relationships and manage all assessments. Can view — but not edit — program settings. Best for TPRM team leads who manage the full vendor portfolio without needing administrative control.
Can view all relationships. Can edit and manage assessments only for relationships where they are assigned as Business Owner or Assessment Lead. Best for risk team members who own specific vendor relationships.
View-only access across the platform. Can see relationships, assessments, risk metrics, and advisories — but cannot make any changes. Suited for executives, auditors, and stakeholders.
## Relationship Designations
**Business Owner and Assessment Lead are not roles** — they are designations on a specific relationship. A user with any platform role can be designated on one or more individual relationships.
### Business Owner
The Business Owner represents the internal stakeholder with business accountability for a vendor relationship. When a Contributor is assigned as Business Owner on a relationship, they gain full edit permissions for that relationship.
### Assessment Lead
The Assessment Lead is the TPRM team member responsible for running the assessment day-to-day for a specific vendor. This designation gives that person a proper home distinct from the Business Owner — addressing the common pattern of repurposing the Business Owner field to track who's running the assessment.
**What Assessment Lead can do** on the assigned relationship:
* Upload and manage artifacts
* Edit relationship context (intake, scoping)
* Configure assessment settings
* Send reminders to vendors
* View risk analysis and assessment results
**What Assessment Lead cannot do** (these remain Admin-only):
* Change frameworks or controls
* Manage integrations
* Administer users or org settings
* Modify notification templates
* Access billing or account settings
Business Owner and Assessment Lead grant the same relationship-level permissions to a Contributor. Each relationship can have a different person in each designation — the two are fully independent. All assignment changes are captured in the audit trail.
## Notifications
The notification settings page includes dedicated columns for Business Owner and Assessment Lead, each with independent toggles for assessment notifications, risk advisories, and other relationship-level alerts.
## Permissions Reference
In the tables below, **"If BO or AL"** means the action is available only on relationships where the Contributor is assigned as Business Owner or Assessment Lead.
### Relationships
| Action | Admin | Program Manager | Contributor | Viewer |
| -------------------------------- | ----- | --------------- | ----------- | ------ |
| Import relationships | Yes | Yes | No | No |
| View all relationships | Yes | Yes | Yes | Yes |
| Create relationship | Yes | Yes | No | No |
| Update relationship context | Yes | Yes | If BO or AL | No |
| Manage tags | Yes | Yes | If BO or AL | No |
| Subscribe / unsubscribe contacts | Yes | Yes | No | No |
| Add comments | Yes | Yes | If BO or AL | No |
| Delete own comments | Yes | Yes | Yes | No |
| Add / delete attachments | Yes | Yes | If BO or AL | No |
| Download attachments | Yes | Yes | Yes | Yes |
### Relationship Lifecycle
| Action | Admin | Program Manager | Contributor | Viewer |
| ---------------------- | ----- | --------------- | ----------- | ------ |
| Onboard relationship | Yes | Yes | No | No |
| Mark as not onboarded | Yes | Yes | No | No |
| Delete relationship | Yes | Yes | No | No |
| Update Business Owner | Yes | Yes | No | No |
| Update Assessment Lead | Yes | Yes | No | No |
### Assessments
| Action | Admin | Program Manager | Contributor | Viewer |
| -------------------- | ----- | --------------- | ----------- | ------ |
| View assessments | Yes | Yes | Yes | Yes |
| Create assessment | Yes | Yes | If BO or AL | No |
| Cancel assessment | Yes | Yes | If BO or AL | No |
| Send reminder email | Yes | Yes | If BO or AL | No |
| Add artifacts | Yes | Yes | If BO or AL | No |
| Delete own artifacts | Yes | Yes | If BO or AL | No |
| Download artifacts | Yes | Yes | Yes | Yes |
Vendor assessment submission is performed by the vendor through their collection portal — not by any internal platform user. This is intentional and cannot be changed by any role.
### Risk & Settings
| Action | Admin | Program Manager | Contributor | Viewer |
| ------------------------------------ | ----- | --------------- | ----------- | ------ |
| View risk metrics | Yes | Yes | Yes | Yes |
| View program metrics | Yes | Yes | Yes | Yes |
| Download risk model output | Yes | Yes | Yes | Yes |
| Generate risk advisory impact report | Yes | Yes | Yes | Yes |
| Artifact Intelligence | Yes | Yes | No | No |
| Questionnaires | Yes | Yes | No | No |
| VISO Chat Agent | Yes | Yes | Yes | Yes |
| View program settings | Yes | Yes | No | No |
| Edit org profile | Yes | No | No | No |
| Edit notification settings | Yes | No | No | No |
| Manage and invite users | Yes | No | No | No |
| Configure integrations | Yes | No | No | No |
When assigning roles, start with Contributor for most risk team members and use Business Owner or Assessment Lead designations to grant relationship-level access where needed. Use Program Manager for those who manage the full vendor portfolio. Escalate to Admin only for users who need to configure org settings, manage users, or control integrations.
# What Is VISO TRUST?
Source: https://docs.visotrust.com/getting-started/what-is-viso-trust
VISO TRUST is an AI-powered TPRM platform that automates vendor due diligence, document analysis, risk scoring, and continuous monitoring.
Traditional third-party risk management is broken. Security teams spend weeks chasing vendors for documents, manually reviewing hundreds of pages of audit reports, and still end up with an incomplete picture of their risk. As organizations adopt more third-party tools and services, that problem compounds.
VISO TRUST takes a different approach. Instead of replacing human judgment, it eliminates the manual work — so your team can focus on decisions, not data collection.
## What VISO TRUST Does
VISO TRUST automates the full vendor risk lifecycle: from the moment you add a relationship, through ongoing monitoring, to risk acceptance and remediation.
The moment you add a vendor, VISO TRUST automatically analyzes publicly available data — certifications, security pages, audit reports — and produces a risk score within seconds.
Artifact Intelligence reads security documents 60x faster than a human analyst. Upload a SOC 2 or ISO 27001 report and get a structured risk analysis in under a minute.
Send vendors a tailored collection request and VISO TRUST handles the rest — gathering responses, analyzing artifacts, mapping controls, and surfacing findings.
Stay informed with real-time risk advisories, breach alerts, and compliance changes for every vendor in your portfolio — without any manual tracking.
## How It Works
Every vendor relationship in VISO TRUST moves through the same core workflow:
Search the VISO TRUST directory or create a new vendor. VISO TRUST immediately runs an instant assessment using public data.
Define how your organization uses the vendor — what data they access, what systems they touch. This shapes the risk score to reflect your actual exposure.
Send a collection request to the vendor or upload documents directly. VISO TRUST analyzes everything and maps findings to your risk framework.
Review findings, accept risk, request remediation, or escalate. Track everything in one place with a full audit trail.
VISO TRUST monitors your vendors for new advisories, certification changes, and incidents — and alerts you when something needs attention.
## Built on a Proven Framework
VISO TRUST's risk model is grounded in NIST 800-53 and covers security, privacy, artificial intelligence, resilience, product security, cyber insurance, and service locations. Every assessment maps vendor evidence to a consistent control framework, so your risk ratings are comparable and defensible.
## Who Uses VISO TRUST
VISO TRUST is designed for security, risk, and compliance teams at mid-market and enterprise organizations — particularly those managing large vendor portfolios where manual review doesn't scale.
New to VISO TRUST? Start with [Key Concepts](/getting-started/key-concepts) to understand the building blocks of the platform, then follow the [Quick Start Guide](/getting-started/quick-start) to get your program running.
# Native Integrations: Slack, Coupa, Netskope, ServiceNow
Source: https://docs.visotrust.com/integrations/available-integrations
Native VISO TRUST integrations including Slack, Coupa, Netskope, and ServiceNow — how each connector works and how to configure it for your org.
VISO TRUST supports native integrations with several commonly used enterprise tools. All integrations are configured in **Settings → Integrations**.
***
## Slack
Send real-time notifications to Slack channels when events occur in your VISO TRUST program — keeping your team informed without requiring them to log in to the platform.
**Common automations:**
* Post to a security channel when a new Critical risk advisory is detected
* Notify a channel when an assessment is completed and awaiting risk review
* Alert a channel when a vendor fails to respond to a collection request
**Setup:**
1. Go to **Settings → Integrations** and find Slack
2. Select **Add to Slack** and authorize the VISO TRUST app for your workspace
3. Configure which channels receive which events through your automations
***
## Coupa (Supplier Sync)
Automatically synchronize supplier relationships from Coupa into VISO TRUST — eliminating the manual work of creating vendor relationships that already exist in your procurement system.
**How it works:**
* VISO TRUST connects to your Coupa instance via OAuth client credentials
* Suppliers in Coupa are automatically created as vendor relationships in VISO TRUST
* Syncs run daily on a schedule; you can also trigger a manual sync at any time
* Each sync picks up from where the last one left off — no duplicate relationships
**Setup:**
Navigate to `/oauth/clients`. Select **Create**, select **Client Credentials** as the grant type, and grant a scope that allows reading suppliers (e.g., `core.supplier.read`). Note the identifier, secret, and scope.
Go to **Settings → Integrations** and select **Connect to Coupa**. In the Coupa Configuration dialog, enter your **Instance**, **Access Key**, **Secret Key**, and **Scopes**, then select **Save**. (Use **Edit** to change these later.)
Select **Sync** to pull in your existing Coupa suppliers. Subsequent syncs run automatically each day.
***
## Netskope (Application Risk Exchange)
Synchronize Netskope-detected application relationships into VISO TRUST using the VISO TRUST Netskope Application Risk Exchange (ARE) plugin. This gives you visibility into shadow IT and vendor relationships surfaced by Netskope alongside your formal TPRM program.
**How it works:**
* VISO TRUST provides a Netskope ARE plugin that connects the two platforms
* Applications detected by Netskope are automatically created as relationships in VISO TRUST
* You can set thresholds (e.g., CCI score) to filter which applications are synced
**Setup:**
Get the latest `viso-netskope.tar.gz` from the [VISO TRUST GitHub releases page](https://github.com/visotrust/viso-netskope/releases/latest).
In the Netskope Admin UI, go to **Settings → Plugins** and upload the plugin file. Filter by the ARE category to verify the VISO TRUST plugin appears.
Select the VISO TRUST plugin entry and enter:
* **Business Owner Email** — the owner of relationships created from Netskope data
* **VISO TRUST API Token** — generate one from your [User Profile](/api-reference/authentication)
Create a **Business Rule** and **Sharing Configuration** in Netskope to route application events to the VISO TRUST ARE plugin. Use the sync icon to force an initial sync.
***
## VISO TRUST API
For custom integrations and automated workflows not covered by native connectors, use the VISO TRUST API directly.
**Available APIs:**
* **REST API** — the public Client API under `/api/v1/*`; see [API Reference](/api-reference/authentication)
* **MCP Server** — `https://mcp.visotrust.com/mcp` for AI tool integration (authenticate with your API token as a Bearer token)
All API access requires a valid API token. See [Authentication](/api-reference/authentication) for how to generate and use tokens.
***
Additional integrations may be available depending on your VISO TRUST plan. Contact your Customer Success Manager for information on integrations not listed here.
# How VISO TRUST Integrations Work
Source: https://docs.visotrust.com/integrations/overview
How VISO TRUST connects to your existing tools through event-driven native integrations, webhooks, and the REST API for automated TPRM workflows.
VISO TRUST integrations connect your third-party risk program to the tools your team already uses — so risk data flows into your workflows automatically, without manual export and import.
Integrations are managed in **Settings → Integrations**.
## How Integrations Work
VISO TRUST integrations are **event-driven**. When something happens in your program — an assessment completes, a risk advisory is surfaced, a vendor's status changes — VISO TRUST can automatically trigger an action in a connected system.
Examples:
* An assessment completes → a Slack message is sent to your security channel
* A new supplier is added in Coupa → the relationship is automatically created in VISO TRUST
* A risk-relevant event fires → a record is created or updated in a connected system
This event-to-action model is managed through **Automations** — configurable rules that define what triggers an action and what that action does.
## Connecting an Application
From **Settings → Integrations**:
1. Find the application you want to connect
2. Select **Connect** or **Manage Connection**
3. A secure authorization window opens — enter your credentials and complete the flow
4. Once connected, the integration status turns green
Depending on the integration, authentication is handled either through the provider's own authorization flow (for example, Slack) or with credentials you supply (for example, Coupa API keys), which are stored securely.
## Managing Automations
Each integration can have one or more **Automations** — rules that define how data flows between VISO TRUST and the connected application.
Each automation card shows:
* **Trigger** — the VISO TRUST event that starts the automation (e.g., "Assessment Completed")
* **Actions** — what happens when the trigger fires
* **Last Run** — when the automation last executed
Automations are powered by Workato and may need to be enabled for your organization. Contact your Customer Success Manager if you don't see them in Settings → Integrations.
### Automation Actions
| Action | Description |
| ------------- | ---------------------------------------------------------------- |
| **Launch** | Starts the automation |
| **Stop** | Pauses the automation without deleting it |
| **View Runs** | Opens execution history — successes, failures, and error details |
Automations won't launch unless all required applications are connected. If an automation is failing, **View Runs** is the best place to start troubleshooting — it shows exactly what happened and any error details.
## Field Mappings
Some integrations support **field mappings** — configuration that controls how data from an external system maps into VISO TRUST (and vice versa). For example, you might map an external system's priority field to a VISO TRUST risk level.
Field mappings let you align integration behavior with your existing data model without custom development. They're configured per-integration in the connection settings.
## API and MCP
For custom integrations, VISO TRUST provides a public **REST API** under `/api/v1/*`. You can use it to:
* Programmatically create and update relationships
* Pull risk scores, assessment data, and advisory feeds into other systems
* Manage webhooks and lifecycle events from external tools
VISO TRUST also supports **Model Context Protocol (MCP)** for AI integration — allowing AI tools to query your VISO TRUST program data directly.
See [API Reference](/api-reference/authentication) for documentation on authenticating and using the APIs.
## Webhooks
Webhooks let you push VISO TRUST events to any external endpoint in real time — useful for building custom integrations with systems not covered by native connectors.
See [Webhooks](/integrations/webhooks) for setup and event schema documentation.
# Webhooks: Real-Time Event Delivery to HTTP Endpoints
Source: https://docs.visotrust.com/integrations/webhooks
Push VISO TRUST events to any HTTP endpoint in real time — assessment completions, recertifications, and relationship lifecycle events for your systems.
**Webhooks** let you push VISO TRUST events to an external HTTP endpoint in real time. Use them to build custom integrations with systems that don't have a native VISO TRUST connector — GRC platforms, ticketing systems, SIEMs, data warehouses, or internal tooling.
Webhooks are managed through the VISO TRUST REST API under `/api/v1/webhooks`. See [Authentication](/api-reference/authentication) for how to generate an API token.
## How Webhooks Work
When a subscribed event occurs in VISO TRUST (for example, an assessment completes), VISO TRUST sends an HTTP POST request to the URL you registered. The request body is a JSON payload describing the event. Your endpoint receives the payload and can use it to trigger downstream actions — creating records, sending alerts, or syncing data.
## Managing Webhooks
Webhooks are created and managed via the API:
| Method & path | Purpose |
| ------------------------------------- | ----------------------------------------------------------------------------------- |
| `POST /api/v1/webhooks` | Register a webhook — provide the endpoint URL and the trigger types to subscribe to |
| `GET /api/v1/webhooks` | List your organization's registered webhooks |
| `GET /api/v1/webhooks/{webhookId}` | Retrieve a single webhook |
| `PUT /api/v1/webhooks` | Update a webhook's URL or subscribed trigger types |
| `DELETE /api/v1/webhooks/{webhookId}` | Remove a webhook |
Your endpoint should accept HTTP POST requests, return a `2xx` response to acknowledge receipt, and be publicly reachable from VISO TRUST's servers.
Deleting a webhook is safe to retry. `DELETE /api/v1/webhooks/{webhookId}` returns `200` when the webhook is removed and `404` when the ID is unknown or the webhook was already deleted. For example:
```bash theme={null}
curl -X DELETE "https://app.visotrust.com/api/v1/webhooks/12345" \
-H "Authorization: Bearer YOUR_API_TOKEN"
```
## Event Types
Subscribe a webhook to one or more of the following trigger types. Events are grouped into assessment and relationship categories.
### Assessment Events
| Trigger | When it fires |
| -------------------------------------- | -------------------------------------------------------- |
| `ASSESSMENT_COMPLETED` | An assessment reaches Completed status |
| `ASSESSMENT_RECERTIFICATION_COMPLETED` | A recertification assessment completes |
| `REMEDIATION_ASSESSMENT_COMPLETED` | A remediation assessment completes |
| `ASSESSMENT_ARTIFACT_UPDATE_COMPLETED` | An artifact-update assessment completes |
| `DOCS_ONLY_ARTIFACT_UPDATE_COMPLETED` | A documents-only artifact update completes |
| `ASSESSMENT_GENERATED_SUMMARY_CREATED` | An AI assessment summary is generated |
| `ASSESSMENT_REMINDER` | A reminder is sent for an assessment |
| `ASSESSMENT_CANCELLED` | An assessment is cancelled (by vendor, client, or admin) |
| `ASSESSMENT_CANCELLED_BY_AUDITOR` | An assessment is cancelled by an auditor |
| `ASSESSMENT_AUTOMATICALLY_CANCELLED` | An assessment is automatically cancelled |
### Relationship Events
| Trigger | When it fires |
| -------------------------- | --------------------------------------------------------- |
| `RELATIONSHIP_ONBOARDED` | A relationship is onboarded |
| `RISK_ACCEPTED` | Risk is accepted on a relationship |
| `RELATIONSHIP_OVERDUE` | A relationship becomes overdue |
| `UPCOMING_RECERTIFICATION` | A relationship is approaching recertification |
| `ARTIFACT_EXPIRING` | An artifact on the relationship is approaching expiration |
| `ARTIFACT_EXPIRED` | An artifact on the relationship has expired |
## Payload Structure
Every webhook delivery uses the same flat JSON payload. The `message` field carries the event name; `relationshipId` and `assessmentId` reference the affected records (`assessmentId` may be omitted for relationship-only events).
```json theme={null}
{
"relationshipId": 12345,
"assessmentId": 67890,
"message": "ASSESSMENT_COMPLETED"
}
```
Use the IDs to fetch full details from the API — for example, `GET /api/v1/relationships/{relationshipId}`.
## Delivery Behavior
Deliveries are sent asynchronously as an HTTP POST with `Content-Type: application/json`. Your endpoint should respond quickly with a `2xx` status.
Webhook payloads are not currently signed. Because there is no signature header to verify, protect your endpoint another way — use a long, unguessable URL, restrict inbound traffic to VISO TRUST, and treat the payload IDs as references to be confirmed against the API rather than as trusted data.
During development, tools like [Webhook.site](https://webhook.site) or [ngrok](https://ngrok.com) let you receive and inspect webhook payloads without running a production server.
# Organization Profile
Source: https://docs.visotrust.com/organization-settings/organization-profile
Configure your VISO TRUST organization profile: display name, logo and branding, contact information, and the settings vendors see in collection requests.
Your organization profile controls how VISO TRUST presents your organization to vendors and stakeholders — including your name, branding, and the email addresses and URLs that appear in vendor-facing communications.
Organization profile settings are in **Settings → Org Profile**. Editing the profile requires Admin access.
## Basic Information
Set your organization's display name and primary contact information. The organization name appears throughout the platform — in your vendor directory listing, assessment emails, and the collection portal vendors see when they submit documentation.
## Branding
Custom branding is an early access feature. Contact [support@visotrust.com](mailto:support@visotrust.com) to enable it for your organization.
VISO TRUST allows you to apply your organization's visual identity to the vendor collection experience — so vendors see your branding, not VISO TRUST's, when they submit documentation.
Navigate to **Settings → Org Profile → Branding** to configure:
### Logo and Icon
| Asset | Where it appears | Recommended dimensions | Max size |
| -------- | ------------------------------------------- | ---------------------- | -------- |
| **Logo** | Vendor email notifications | 400px × 150px | 100kb |
| **Icon** | Vendor collection portal, directory listing | 32px × 32px | 100kb |
Accepted file types: `.png` and `.jpg` for both assets — the logo also accepts `.gif`, and the icon also accepts `.ico`. Changes save automatically and are confirmed with a toast message.
### Brand Color
Set a brand color that appears in vendor collection requests and email communications. Use the color picker to enter a custom hex value, or select from the preset options.
Use the preview pane to see how the color looks in both the collection portal and email views before saving.
## Custom Email Domain
By default, vendor-facing emails are sent from a VISO TRUST address and collection portal links use a `visotrust.com` domain. Custom domain options let you replace these with your own branding.
Three levels of customization are available:
| Option | What changes |
| ----------------------- | ------------------------------------------------------------------ |
| **Subdomain** | Vendor portal links become `yourorg.visotrust.com` |
| **Fully custom domain** | Vendor portal links use your own domain (e.g., `tprm.yourorg.com`) |
| **Email domain** | Vendor emails come from your domain (e.g., `tprm@yourorg.com`) |
The email domain and the portal URL are independent settings. Verifying your domain with DKIM changes only the address vendor emails are sent *from* — it does not change your portal URL. If you also want branded links, choose a subdomain or a fully custom domain separately.
**Subdomain** and **fully custom domain** are mutually exclusive. Setting one removes the other.
Custom domains are vendor-facing branding, intended so vendors recognize the sender and the link. Your own team continues to use `app.visotrust.com`, which stays live whether or not you configure a custom domain.
### Configuring DKIM
DKIM proves to receiving mail servers that VISO TRUST is authorized to send on behalf of your domain, so vendor emails from your address land in inboxes instead of spam. You need program admin access, and DNS access for the domain you want to send from.
Go to **Settings → Org Profile → Manage domains**.
The table lists every domain registered to your organization, with **DKIM Verified** and **RP Domain Verified** columns. These domains are populated automatically from your organization's verified domains — you don't add them here.
Select the domain name, or the gear icon on its row, to open the **Domain Verification Configuration** dialog.
The dialog shows four values, each with a **Copy to clipboard** button:
* **DKIM Pending Host**
* **DKIM Pending Text Value**
* **Return Path Domain**
* **Return Path CNAME Value**
Once a domain is verified, the two DKIM fields read `DKIM Verified` instead of showing pending values.
In your DNS provider, add the following records for that domain:
| Purpose | Record Type | Host | Value |
| -------------------------------- | ----------- | ------------------------------------ | ----------------------------------------- |
| DKIM authentication | TXT | DKIM Pending Host (from the dialog) | DKIM Pending Text Value (from the dialog) |
| Custom return-path (recommended) | CNAME | Return Path Domain (from the dialog) | `pm.mtasv.net` |
The DKIM record is required. The return-path record is optional but recommended — it aligns bounce handling with your domain and improves deliverability. A custom sending address works with DKIM alone.
Back on **Manage domains**, select the refresh icon. VISO TRUST re-checks every listed domain against the email provider and updates the **DKIM Verified** column.
DNS propagation can take 24–48 hours, so the column may stay **No** for a while after you add the records. Refresh again periodically rather than re-adding the records.
Once at least one domain shows **DKIM Verified: Yes**, the **Edit email** button under **Custom email** becomes available. Select it and set:
* **Domain** — chosen from your DKIM-verified domains
* **Sender name** — the display name vendors see
* **Mailbox** — the local part of the address (e.g. `tprm`)
The dialog previews the result as `"Sender Name" `. Select **Save configuration** to apply it.
To go back to the VISO TRUST default sending address, use **Reset to default** next to **Edit email**. This clears the custom sending address only; the domain stays DKIM-verified, so you can re-apply it later without redoing DNS.
**Edit email** and **Edit domain** are separate controls. **Edit email** sets the address vendor emails come *from* and requires DKIM verification. **Edit domain** sets the branded URL in those emails and does not.
### Requests Already in Flight
Turning on DKIM or a custom URL does not break collection requests vendors already have:
* Each collection link is identified by a unique token, not by the domain it was sent under.
* The URL the vendor originally received stays live, so the link continues to resolve.
* Only emails sent *after* the change use the new from address and the branded URL.
Changing or removing a custom domain later does break links already sent under it. VISO TRUST stops routing the retired domain, so a vendor clicking an older email will not reach the collection portal. Switching between a subdomain and a fully custom domain has the same effect, because setting one retires the other. Reissue any open requests before retiring a custom domain.
## Language Support
VISO TRUST's Artifact Intelligence processes documents in any language. Assessments with non-English artifacts don't require native-language auditors — the AI analyzes the document and returns findings and evidence quotes in English.
No special configuration is needed. Proceed with assessments containing foreign-language artifacts exactly as you would with English documents.
## Notification Contacts
Set organization-level contacts for vendor communications and incident response from **Settings → Org Profile → Notifications**:
* **Support Contact** — the name and email vendors see in assessment communications
* **Incident Response Contact** — receives all risk advisory notifications across your portfolio
See [Notifications & Alerts](/risk-and-monitoring/notifications) for the full notification configuration reference.
# SSO / SAML Configuration
Source: https://docs.visotrust.com/organization-settings/sso
Set up SAML 2.0 single sign-on for VISO TRUST with Okta, Azure AD, Entra ID, or any compliant identity provider — including IdP setup and metadata exchange.
VISO TRUST supports Single Sign-On (SSO) with any **SAML 2.0 compliant identity provider (IdP)** — including Okta, Azure Active Directory / Entra ID, and others. Once SSO is configured, users authenticate through your IdP rather than with a VISO TRUST password.
SSO configuration requires coordination between your Admin and your VISO TRUST Customer Success representative. Contact [support@visotrust.com](mailto:support@visotrust.com) to begin the setup process.
## What You'll Need
SSO setup involves two sides: configuring VISO TRUST as a SAML application in your IdP, then providing the IdP's details to VISO TRUST.
### What VISO TRUST Provides to You
Your Customer Success representative will give you:
| Field | Description |
| -------------------------------- | -------------------------------------------------------- |
| **Audience URI (Entity ID)** | Identifies VISO TRUST to your IdP |
| **Single Sign-on URL (ACS URL)** | The endpoint in VISO TRUST that receives SAML assertions |
Enter these values when creating the VISO TRUST application in your IdP.
### What You Provide to VISO TRUST
Once the IdP application is configured, share the following with your CS representative:
| Field | Description |
| --------------------------- | -------------------------------------------- |
| **IdP SSO URL** | The SAML endpoint in your IdP |
| **IdP Issuer URL** | The entity ID of your IdP |
| **X.509 Certificate** | The certificate used to sign SAML assertions |
| **IdP Metadata** (optional) | XML metadata file if available from your IdP |
## Required SAML Configuration
Your IdP application must be configured with these exact settings:
**Name ID format:** Email address (lowercase)
**SAML assertion attributes** (no namespace or format prefix):
| Attribute name | Value |
| -------------- | --------------------------------------------- |
| `firstName` | User's first name |
| `lastName` | User's last name |
| `email` | User's email address (must match the Name ID) |
The `email` attribute value must be identical to the Unique User Identifier / Name ID. This is used as the user's identifier across the platform and for email communications.
## Important Behavior Notes
**VISO TRUST does not support IdP-initiated login.** A tile or bookmark in your IdP dashboard will not directly sign users in. To give users a convenient entry point, create a **Bookmark application** in your IdP that points to `https://app.visotrust.com` and hide the actual SAML application from users.
**First login must use SAML.** New users cannot sign in with Google or Microsoft social login on their first access — they must use your SAML provider. After a successful first SSO login, social logins will work for subsequent sessions.
**User provisioning happens at first login.** Simply assign users to the VISO TRUST application in your IdP, then invite them in VISO TRUST and instruct them to navigate to `https://app.visotrust.com` and sign in with their email. Their IdP session handles the rest.
## Okta Setup Example
When creating the VISO TRUST app in Okta:
1. Create a new **SAML 2.0 application**
2. Set the **Single sign-on URL** to the ACS URL provided by VISO TRUST
3. Set the **Audience URI** to the Entity ID provided by VISO TRUST
4. Set **Name ID format** to `EmailAddress`
5. Set **Application username** to `Email`
6. Add attribute statements for `firstName`, `lastName`, and `email` mapped to the appropriate Okta profile fields
7. Download the IdP metadata or copy the SSO URL, Issuer URL, and certificate — share these with your VISO TRUST CS representative
## Azure Active Directory / Entra ID Setup Example
When creating the enterprise application in Azure:
1. Create a new **Enterprise Application → Non-gallery**
2. Go to **Single sign-on → SAML**
3. Set **Identifier (Entity ID)** to the Entity ID provided by VISO TRUST
4. Set **Reply URL (ACS URL)** to the ACS URL provided by VISO TRUST
5. Set **Name ID format** to `Email address`
6. Add claims for `firstName`, `lastName`, and `email`
7. Download the **Federation Metadata XML** and share it with your VISO TRUST CS representative
## Troubleshooting
| Symptom | Likely cause |
| ------------------------------------------------- | -------------------------------------------------------------------- |
| User sees an error after IdP login | Name ID format is not set to email, or attributes are missing |
| User can't log in — redirected to login page | IdP-initiated login attempted; direct to `app.visotrust.com` instead |
| New user can't access after being assigned in IdP | User hasn't been invited in VISO TRUST yet — invite them first |
| Social login fails for a new user | First login must be via SAML; social logins work after that |
For configuration assistance, contact [support@visotrust.com](mailto:support@visotrust.com).
# Tags for Labeling and Filtering Vendor Relationships
Source: https://docs.visotrust.com/organization-settings/tags
Create custom tags in VISO TRUST to label vendor relationships, then filter the portfolio, scope Risk Insights dashboards, and drive bulk actions.
**Tags** are free-form labels you apply to vendor relationships to organize them outside the structure of Business Units and [tiers](/organization-settings/tiers). They're flexible by design — use them however makes sense for your program.
Tags are managed in **Settings → Tags**; managing the tag library requires Admin or Program Manager access. Any user with edit access to a relationship can apply tags to it.
## What Tags Are Used For
Tags are available as filters throughout the platform:
* **Relationships list** — filter your vendor portfolio by tag to see a specific subset
* **Risk Insights** — scope dashboard metrics to relationships with a specific tag
* **Bulk actions** — select all relationships with a tag and perform an action on them at once
* **Advisory outreach** — filter which vendors receive a risk advisory response request by tag
Because tags are searchable across the platform, they work well for temporary or cross-cutting groupings that don't fit neatly into a business unit or tier.
## Common Tagging Strategies
| Use case | Example tags |
| ------------------ | -------------------------------------------------------- |
| Program phase | `onboarding`, `active`, `offboarding`, `archived` |
| Compliance program | `pci-in-scope`, `hipaa`, `soc2-relevant` |
| Contract status | `contract-renewal-2025`, `nda-required` |
| Review priority | `critical`, `expedited-review` |
| System access type | `production-access`, `admin-access`, `data-processor` |
| Business context | `ai-vendor`, `cloud-infrastructure`, `payment-processor` |
Tags work best when they're defined and documented for your team so everyone applies them consistently.
## Creating and Managing Tags
From **Settings → Tags**:
* **Add a tag** — select **Add Tag** and enter the label
* **Rename a tag** — open the tag's three-dot menu and select **Edit**; the rename applies everywhere the tag is used
* **Delete a tag** — removes the tag from all relationships it's applied to; this cannot be undone
Deleting a tag removes it from all relationships immediately. If you want to stop using a tag without removing historical data, rename it with a prefix like `_deprecated_` instead of deleting it.
## Applying Tags to Relationships
Tags can be applied when creating a relationship or at any time afterward:
* **During creation** — the Add Relationship form has a Tags field
* **On the relationship detail page** — go to the Details tab and add or remove tags from the relationship settings
* **Via bulk import** — include comma-separated tags in the `Tags` column of your CSV
Tags on a relationship are visible on the relationship list page and the relationship detail page.
## Filtering by Tag
On the Relationships list page, use the **Tags** filter in the filter bar to show only relationships with a specific tag (or combination of tags). The filter supports multi-select — you can show relationships that have any of the selected tags, or all of them, depending on your filter mode.
Tag filters are also available in Risk Insights dashboards to scope metrics to a specific subset of your portfolio.
# Configure Vendor Tiers for Due Diligence and Oversight
Source: https://docs.visotrust.com/organization-settings/tiers
Configure vendor tiers in VISO TRUST from Settings → Tiers — set how many tiers your program uses, describe each one, and assign relationships to them.
**Vendor tiers** group your relationships into up to five tiers so you can apply the right level of due diligence, oversight, and reporting to each group. Tiers are typically defined by risk level, business criticality, or the sensitivity of the data a vendor handles.
Tiers are configured in **Settings → Tiers**. Changing the tier structure requires Admin or Program Manager access; assigning a relationship to a tier requires edit access to that relationship.
## The Tiers Page
**Settings → Tiers** lists every tier your organization has configured, in order. Each tier shows:
* **Tier name**
* **Description** — the criteria your team uses to decide what belongs in this tier
* **Relationship count** — how many relationships are currently assigned to the tier; select the count to open the Relationships list filtered to that tier
If no tiers exist yet, the page shows a **No tiers configured** state until you create them.
## Setting Up Tiers
From **Settings → Tiers**, select **Manage tiers**:
Pick a number from 0 to 5. Tiers are created in order — selecting 3 gives you Tier 1, Tier 2, and Tier 3.
Add a short description for each tier explaining what belongs in it. Descriptions appear on the Tiers page and in the tier picker when someone assigns a relationship, so they help your team choose consistently.
Select **Save changes** to apply the new tier structure.
Reducing the number of tiers removes the tiers above your new count, and any vendors assigned to a removed tier move to **Unassigned**. The dialog tells you which tiers will be removed before you save.
## Assigning Relationships to a Tier
A relationship is **Unassigned** until you put it in a tier. There are four ways to assign one:
* **When creating a relationship** — set the optional **Tier** field in the Add Relationship form
* **On an existing relationship** — open the **Relationship configuration** dialog (gear icon) and select a tier under **Tier**; the picker shows each tier's description
* **In bulk** — select relationships on the Relationships list page and use the **Move tier** action (Admin only)
* **Via bulk import** — include a `Tier` column with a value of 1–5 in your CSV (see [Bulk Import](/third-parties/bulk-import))
The **Move tier** menu also offers **Unassigned**, which removes relationships from their current tier.
If no tiers are configured, the **Move tier** bulk action is disabled. Create tiers in **Settings → Tiers** first.
## Where Tiers Show Up
Once relationships are tiered, the tier is available across the platform:
* **Relationships list** — filter the portfolio by tier, and save that filter for one-click reuse
* **Risk Insights** — the **Relationships by Tier** metric breaks your portfolio down by tier
* **Risk advisories** — filter by tier when choosing which vendors receive a response request
* **VISO Chat** — ask questions scoped to a tier, such as "Tier 1 vendors"
## Tiers vs. Tags vs. Business Units
| Structure | Purpose |
| --------------------------------------- | ------------------------------------------------------------------------ |
| **Vendor Tiers** | A single ranked structure (up to 5) for how much oversight a vendor gets |
| [**Tags**](/organization-settings/tags) | Free-form, multi-select labels for cross-cutting or temporary groupings |
| **Business Units** | The internal part of your organization that owns the relationship |
A relationship belongs to at most one tier, can carry many tags, and rolls up to one business unit.
# User Management
Source: https://docs.visotrust.com/organization-settings/user-management
Invite users to VISO TRUST, change their roles, configure default notification subscribers, and create service accounts for API access.
User management is in **Settings → Users**. Inviting and editing users requires Admin access. From here you can invite new users, change roles, configure default subscribers, and manage service accounts for API access.
## Inviting Users
Select **Add User**.
Enter the user's name and email, check **Invite to VISO TRUST**, and select their role: **Admin**, **Program Manager**, **Contributor**, or **Viewer**. See [Role-Based Access](/getting-started/roles-and-permissions) for a breakdown of what each role can do.
The user receives an email with a link to set up their account. If SSO is configured, their first login must go through your SAML identity provider — social logins (Google, Microsoft) work after the first successful SSO login.
## Changing a User's Role
From **Settings → Users**, select the three-dot menu next to any user and select **Edit**. Update their role and save. Role changes take effect immediately.
## Removing a User
Select the three-dot menu next to the user and select **Delete**.
If the user has relationship subscriptions, Business Owner assignments, or Assessment Lead assignments, the delete dialog prompts you to reassign them first. Select another user to receive the assignments, then select **Reassign and Delete Contact**. These counts include archived relationships, so a user may need reassignment even if they own nothing in your active portfolio.
Removing a user:
* Revokes their platform access immediately
* Does not delete their past activity, comments, or audit trail entries
## Default Subscribers
A **Default Subscriber** is automatically subscribed to every relationship in the organization — existing and future. Use this for centralized risk or compliance teams that need visibility across the entire vendor portfolio.
To enable:
1. Select the three-dot menu next to the user → **Edit**
2. Check **Default Subscriber**
3. Select **Save**
The change is immediate — the user is added as a subscriber to all current relationships and any new ones going forward.
A Default Subscriber cannot be removed from an individual relationship unless the Default Subscriber setting is first unchecked on their user profile.
You can configure multiple Default Subscribers. See [Inviting Your Team](/getting-started/inviting-your-team) for more context on how to use this feature.
## Business Units
Every user belongs to a Business Unit, which is set when they're created or edited. Business Units determine which unit a relationship is attributed to when the user is assigned as Business Owner.
To manage Business Units, go to **Settings → Business Units**. See [Business Units](/third-parties/business-units) for details.
## Service Accounts for API Access
If you're using the VISO TRUST API for automation or integration, use a dedicated service account rather than a personal user account. This ensures API access isn't tied to an individual's employment status and makes it easier to manage token lifecycle.
To create a service account:
1. Invite a new user with a service account email (e.g., `viso-api@yourorg.com`)
2. Assign the **Admin** or **Program Manager** role — the API endpoints require program-level access
3. Log in as that user to generate an API token from the user profile
See [Authentication](/api-reference/authentication) for API token generation and usage.
## User Activity and Audit Trail
All user actions that affect relationships, assessments, and settings are recorded in the platform's audit trail. This includes who created a relationship, who uploaded an artifact, who accepted risk, and who changed a setting.
The activity log for a relationship is visible in its **Activity** tab. Organization-level audit logs are available to Admins on request.
# Release Notes
Source: https://docs.visotrust.com/resources/changelog
Release notes for the VISO TRUST platform: new features, enhancements, bug fixes, and behavior changes shipped in each version of the product.
Release notes are published with every platform update.
***
## September 03, 2026 — v3.57.0
### Bug Fixes
* Artifact sources now use Public and Private labels instead of "Collected by" wording, fixing questionnaires incorrectly shown as collected by the third party.
* Search results now stay available at all times, including while relationship and vendor data is being refreshed in the background.
* Fixed an issue where excluding an artifact from the Artifact Viewer did not remove it from the assessment.
* Fixed relationship context prediction for bulk-imported vendors, and large imports now run in the background so the page is usable while they process.
* Removed misleading questionnaire wording from third-party collection emails.
* Fixed an issue where the page could not be scrolled while a dropdown menu or date picker was open.
* Comments entered while excluding an artifact from risk analysis now appear in the relationship activity.
* Corrected card background colors in the artifact collection flow.
* Polished the toggle controls on the vendor discovery screen.
* Page headers are now consistent across the application, with titles, actions, and filters in the same position on every screen.
* Fixed an error when sending a recommended follow-up questionnaire that reported no follow-up questions existed.
* Fixed an error when deleting a webhook through the public API, and made repeated deletes safe.
* Fixed a rare issue that could lock a user out of the application with an error page on every screen until they signed in again.
* Fixed dark mode rendering, restoring readable body text, opaque side panels, and visible header chips.
### Enhancements
* The AI-generated assessment summary now replaces the legacy summary throughout the assessment.
* Imported relationships are now attributed to the user performing the import, and the ambiguous "Client username" column has been removed from the import template.
* The audit log is now surfaced as "All activity" at the top of the Activity tab, with icons for easier scanning.
* Third parties can now view and complete every questionnaire in a collection on a single page, with navigation and per-questionnaire progress.
* Users can now export nth parties to CSV from the Relationships page, with the export respecting applied filters.
* Saved filters now follow the user across browsers and devices instead of living in a single browser.
* Added divider lines between control domains to more clearly separate domains from their controls.
* Users can now expand or collapse all control domains at once.
* Fixed an error when saving a custom subdomain under Manage Domains.
* Fixed an issue where users mentioned in a comment did not receive a notification and the mention displayed incorrectly.
* The relationship import template now includes an organization's custom data types, so imports containing them no longer fail with column errors.
* Supplemental questionnaires are now answered from the full text of a relationship's artifacts, with supporting citations shown alongside each answer.
* The New Risk Analysis opt-in card now includes a demo video so admins can preview the experience before enabling it.
* Supplemental questionnaires now show whether each answer is AI-generated or vendor-provided, display progress while answering is in flight, and carry vendor answers forward between rounds.
* The user who started a relationship import is now emailed if the import fails, with a new notification setting to control it.
* Redesigned the supplemental questionnaire panel and "Get answers now" button, making it clear that answers are generated by running an assessment.
***
## August 25, 2026 — v3.56.1
### Bug Fixes
* Fixed spacing on the vendor signature screen.
* Fixed an error when changing lifecycle management and onboarding settings on a relationship.
* Fixed assessment results showing the previous assessment instead of the newly updated one.
* The "Pending changes since last assessment update" notice no longer appears during a normal assessment, such as when a third party provides artifacts.
* Selecting a detection from risk analysis now highlights that detection on the destination page.
* Compliance attestations no longer affect initial risk when excluded in your framework.
* Pending changes no longer reappear immediately after starting an assessment from the pending-changes prompt.
* Presumed artifacts are now shown by default in the artifact list.
* Fixed the assessment collection stepper layout on smaller screens and corrected spacing on the Sign & Submit step.
### Enhancements
* Filtering detections by type now displays the matching detections instead of their controls.
* Fixed missing historical data in risk analysis after an artifact was deleted.
* Detections are now sorted by highest assurance first.
* Removed the placeholder text shown when a control has no detections.
* Risk analysis now accounts for a third party's subprocessor list.
***
## August 20, 2026 — v3.56.0
### Bug Fixes
* Fixed CSV export not generating or downloading.
* Added spacing between the left navigation and main content in the vendor experience.
* Fixed the star icon in the AI Assistant rendering in the wrong color.
* Reopening the AI Assistant now restores the previous conversation instead of starting a new one.
* Regenerating an assessment summary now shows progress and confirms success only once the new summary is ready.
* Pressing Enter in the artifact selector now adds the highlighted option instead of leaving the text in the search field.
* Fixed lifecycle management notification settings reverting to the third-party contact instead of saving the selected business owner.
* Saved filters no longer show internal identifiers for tiers that have since been removed.
* Fixed an error that prevented third parties from opening the collections page.
* Relationship count links on the tier settings page now open the relationship list filtered to the selected tier.
* Risk model settings now clearly show whether each option is on or off.
* Compliance standards removed from an organization are no longer automatically re-added by artifact predictions.
### Enhancements
* Release notes are now available directly in the app.
* Assessment leads, subscribers, and org admins now receive a notification when an email to a contact bounces.
* Artifact table rows are now clickable in full, not just the link text.
* Expired assessments are now called out on the assessment timeline and in the relationship list, with the option to complete the assessment or extend its collection timeline.
* Pending Changes now surfaces program-level changes separately, with a clear prompt to bring affected relationships up to date.
***
## August 07, 2026 — v3.55.0
### Bug Fixes
* Refined color usage across the application for improved visual consistency.
* Fixed notification links so they now navigate to the correct page.
* Fixed an issue where the AI assistant would reopen full screen unexpectedly.
* Added a webhook trigger for assessment summary generation.
* Fixed a webhook trigger for document-only artifact updates that could be subscribed to but never fired.
* Fixed an issue preventing a custom framework draft from being published after refreshing the page.
* Improved the visibility of the "No context" label on the risk tolerance card.
* Fixed the global navigation animating across the screen on first page load.
* Relationship import progress now updates on its own without requiring the user to interact with the page.
* Long artifact names now truncate in the artifacts table, with the full name shown on hover.
* The artifact upload button now shows a loading indicator while an upload is in progress.
* Fixed the artifacts table so it opens in its intended default sort order.
* Softened the AI assistant's stop button to an outlined style.
* Archived relationships are now excluded from the Directory summary.
### Enhancements
* Users are now returned to their originally requested page after signing in through SSO.
* Standardized page backgrounds across the application for a more consistent look.
* Redesigned the relationship list page with a reorganized filter panel and quick filters for faster drill-down.
* Users can now save groups of filters and apply them in a single click.
* Tier management now has its own settings page, including tier descriptions.
* Added a guided walkthrough on the relationship page to help users work through change management.
* Admins can now copy a user's invite link to share it directly instead of relying on the invitation email.
* Simplified the vendor discovery page header and added a "Learn more" link to supporting documentation.
* Exceptions are now only generated for audit types that can contain them.
* Questionnaire answering is now significantly faster for organizations with large trust profiles.
***
## July 29, 2026 — v3.54.3
### Bug Fixes
* Fixed an error that could cause the public API specification, and the API reference documentation built from it, to fail to load.
* Fixed an error that prevented organization assessment settings from loading.
### Enhancements
* The Workato **Create VISO Relationship** action now exposes additional fields, including instant analysis.
***
## July 28, 2026 — v3.54.2
### Bug Fixes
* Fixed an issue where artifacts uploaded to a trust profile were not available to questionnaire answering, leaving questions unanswered.
### Enhancements
* Questionnaire answering is significantly faster on large trust profiles, completing in minutes rather than tens of minutes.
***
## July 10, 2026 — v3.53.1
### Bug Fixes
* Fixed an error that caused the Integrations page to fail to load when a Workato connection was configured.
***
## July 09, 2026 — v3.53.0
### Bug Fixes
* Corrected assessment scoping so AI controls are only included when the AI intake question is answered.
* Fixed an issue where an instant assessment summary would not appear after relationship creation until the page was refreshed.
* Fixed the color of assessment summary headers in dark mode.
* Fixed an issue where a completed artifact validation would not display automatically until the page was refreshed.
* Artifact glossary descriptions are no longer truncated and now display in full.
* Fixed a missing background when creating a new contact for the assessment lead.
* Fixed an issue where detections were not loading on the Trust → Artifact Intelligence page.
* Fixed an issue where clicking Cancel in the Manage Tiers dialog could unintentionally unassign vendor tiers instead of simply closing the dialog.
* Presumed artifacts excluded from the risk model no longer appear in the assessment summary.
* Fixed a crash on the relationship page caused by artifact expiration dates.
* Improved the visibility of certain options and buttons affected by color contrast.
### Enhancements
* AI controls now scope only from the AI Systems intake question. AI control domains are now included in an assessment only when the **AI Systems** intake question is selected. Previously they could also be pulled in by the Vendor Data Processing or Technology Provider questions — that's been corrected. To include AI controls going forward, select **AI Systems** when scoping the vendor. No past or in-progress assessments are affected; this applies only to new assessments scoped from July 9 onward.
* The vendor directory profile now includes a Relationships view listing all relationships with a vendor along with a generated executive summary, a Details tab, and vendor-specific risk advisories.
* Added filtering options to the relationship search endpoint in the Client API.
* Refreshed the application color palette.
* Our API documentation can now be found, publicly, at [docs.visotrust.com](http://docs.visotrust.com).
***
## June 30, 2026 — v3.52.2
### Bug Fixes
* Resolved an issue where detections were not displayed on Trust → Artifact Intelligence.
***
## June 26, 2026 — v3.52.1
### Bug Fixes
* Resolved an issue with the new Admin user role.
***
## June 25, 2026 — v3.52.0
### Enhancements
* **Assessment Lead role** — teams can now designate a specific user to run a vendor assessment, separate from the relationship's Business Owner.
* **Control validation side panel** — a new panel breaks down an individual control's weight, supporting evidence, and mitigation details.
* **Artifact glossary updates** — clearer assurance-level definitions across all artifact types.
* **Smarter public research** — reduced the volume of irrelevant public documents pulled into assessments.
* **New webhook event** — a webhook now fires when an AI assessment summary is generated.
* **Post-SSO redirect** — users are now returned to their originally requested page after signing in through SSO.
* **Light/dark mode** — users can now switch between light and dark interface themes.
* **Admin role** — a new Admin role lets designated users manage organization-level settings.
* **In-page user invitations** — users can now be invited to the platform directly from the user management page.
### Bug Fixes
* Fixed orphaned supplemental questionnaire entries appearing blank in the relationship configuration dialog.
* Fixed the Assessment Activity dropdown not listing activity on the assessment page.
* Improved the artifact viewer with refined editing controls, layout, and vendor selection.
* Fixed integrations showing as Connected after their credentials expired.
* Fixed a blue overlay appearing when viewing the agent in full screen.
***
## June 16, 2026 — v3.51.2
### Bug Fixes
* Resolved an issue that caused the AI chat assistant to become unavailable.
***
## June 12, 2026 — v3.51.1
### Bug Fixes
* Resolved an issue where `Content-Disposition` header filenames were not fully RFC 6266-compliant.
***
## June 11, 2026 — v3.51.0
Earlier release notes are available in the VISO TRUST platform under **Help → Release Notes**, or by contacting your Customer Success Manager.
# Troubleshooting & FAQ
Source: https://docs.visotrust.com/resources/faq
Troubleshooting steps and frequently asked questions about login, assessments, artifact uploads, notifications, and other common VISO TRUST issues.
## Getting Started
**I didn't receive my account setup email. What do I do?**
Check your spam folder first. If it's not there, contact your Customer Success Manager or email [support@visotrust.com](mailto:support@visotrust.com). If your organization uses SSO, confirm with your Admin that you've been assigned access in your identity provider.
**I can't log in with Google or Microsoft.**
If your organization has SSO configured, your first login must go through your SAML identity provider — navigate to [app.visotrust.com](https://app.visotrust.com), enter your email, and follow the redirect to your IdP. Social logins (Google, Microsoft) work for subsequent logins after your first successful SSO session.
**I can see the platform but can't take any actions.**
You likely have **Viewer** access. Viewers can view relationships, assessments, and risk data but cannot create or edit. Contact your Admin to request a role change if you need edit access.
***
## Relationships and Vendors
**How do I add a vendor that isn't in the VISO TRUST directory?**
When adding a relationship, search for the vendor name. If it doesn't appear, select **Create new third-party organization** at the bottom of the results. Enter the vendor's name and website URL — providing a URL is important for public research and instant assessment accuracy.
**Why is my vendor's risk score different from what I expected?**
Risk scores are driven by the combination of data types and business cases configured for the relationship. Check the relationship's Context settings to make sure the selections accurately reflect how you use this vendor. Also review what artifacts have been collected — a vendor with no analyzed documentation will have a higher residual risk than one with a validated SOC 2.
**What does "Pending Changes" mean on a relationship?**
It means new information exists that hasn't been incorporated into the current assessment summary yet — expired artifacts, a context update, newly discovered public artifacts, new risk advisories, newly added supplemental questionnaires, or a risk model update since the last assessment ran. Run a public search or initiate an assessment update to resolve it.
**Can I have multiple relationships with the same vendor?**
Yes. Use the Products & Services scoping feature to create separate relationships for different products or services from the same vendor. Each relationship has its own assessment context and risk score.
***
## Assessments
**How do I start an assessment?**
There are three ways:
1. **Instant Assessment** — runs automatically when you create a relationship (if enabled)
2. **Upload artifacts** — go to the relationship, select **Add information**, and upload documents directly
3. **Collection request** — go to the relationship, select **Start assessment**, and send a request to the vendor
**The vendor says they didn't receive the collection request email. What should I do?**
Ask the vendor to check their spam folder — assessment emails sometimes get filtered. If it's not there, go to the relationship's Assessments tab, open the active assessment, and use **Send Reminder** to resend. You can also update the vendor contact and resend from the relationship settings.
**Can I upload documents on behalf of a vendor?**
Yes. Upload artifacts directly on the relationship — they'll be treated as **Collected from Client** rather than from the vendor. This is the right approach when you have documents on hand and don't need vendor involvement.
**An assessment has been in "Review Started" for a long time. Is that normal?**
The AI review typically completes within minutes. If AI Assessment + Auditor Review is configured, the auditor review may take longer (typically 1–2 business days). If it's been more than 48 hours without movement, contact [support@visotrust.com](mailto:support@visotrust.com).
**Can I cancel an active assessment?**
Yes — open the assessment and select **Close Request**. The assessment will be cancelled. Any artifacts already submitted or uploaded will be retained on the relationship.
**What happens when an assessment expires without a vendor response?**
Depending on your configuration, VISO TRUST either notifies the business owner and assessment creator, or automatically closes the collection request. You can configure this behavior in assessment defaults.
***
## Risk Scores
**Why did a vendor's risk score change without a new assessment?**
Several things can trigger score changes without a full assessment: artifacts expiring (reducing assurance on credited controls), context updates (adding or removing business cases or data types), new risk advisories being detected, or a change published to Your Framework — publishing a new risk tolerance re-runs the model across your whole portfolio. Check the relationship's Activity tab for a log of what changed.
**Can I override a vendor's risk score?**
Yes. When an assessment is in **Review Risk** status, select **Override Risk** to manually set a different inherent or residual value. Document your reasoning — overrides are recorded in the audit trail. Overrides remain in effect until the next assessment update.
**What's the difference between inherent and residual risk?**
Inherent risk is the starting point — potential exposure based on your relationship context, before accounting for vendor security controls. Residual risk is what remains after crediting the vendor's proven controls. Controls lower risk by reducing the likelihood of an incident, never the impact, so residual risk can never drop below what your data sensitivity allows. Act on residual risk; use inherent risk to understand worst-case exposure. The full breakdown for any vendor is in the relationship's [risk analysis](/risk-and-monitoring/risk-analysis).
***
## Artifacts and Documents
**Why was my artifact classified incorrectly?**
Classification is automatic but not perfect. You can correct it in **Trust → Artifact Intelligence** — open the artifact and change its **Artifact Type**. That section is available to Admins and Program Managers, so ask one of them if you're a Contributor or Viewer.
**Can I upload a password-protected document?**
Password-protected artifacts require manual handling. When you upload one, note in the comments that it's password-protected and provide the password through a secure channel to [support@visotrust.com](mailto:support@visotrust.com) so auditors can access it.
**Why does a vendor's SOC 2 only give partial credit?**
If VISO TRUST detected a SOC 2 badge on the vendor's website but hasn't reviewed the actual report, it grants partial credit (lower assurance). To get full credit, request the actual SOC 2 report through a collection request so it can be analyzed.
**Can I delete an artifact a vendor submitted?**
Delete permissions depend on your role — some roles can remove any artifact, while others can only remove artifacts their own team uploaded. Vendor-submitted artifacts are otherwise retained as part of the audit trail.
***
## Notifications and Access
**Business owners are getting too many emails. How do I reduce them?**
Go to **Settings → Org Profile → Notifications** and adjust the notification matrix — toggle off notification types that aren't useful. You can also **Override All Internal Email Recipients** to consolidate all internal notifications to a single inbox, or **Disable All Business Owner Notifications** entirely and route alerts through a central team.
**A user can't see a relationship they should have access to.**
Check the user's role. Contributors see all relationships in the organization by default, but some filtered views may hide relationships they're not subscribed to or don't own. If the relationship still isn't visible, check whether it's archived.
**I need to give a vendor access to submit documentation outside of a collection request.**
All vendor document submission happens through the collection portal, which is accessed via a collection request. There is no way to give a vendor ongoing platform access — each submission is through a specific, time-limited collection link.
***
## Getting Help
For issues not covered here:
* **Email:** [support@visotrust.com](mailto:support@visotrust.com)
* **In-platform:** Use the help button to contact support
* **Your Customer Success Manager:** For account-specific questions and configuration guidance
# VISO TRUST Glossary of TPRM and Risk Terms
Source: https://docs.visotrust.com/resources/glossary
Definitions of key VISO TRUST terms — including artifacts, assessments, business cases, control domains, residual risk, and Artifact Intelligence.
## A
**Admin** A VISO TRUST role with full platform access — manages users, settings, relationships, assessments, and all program activity.
**Artifact** Any document or evidence collected as part of an assessment — audit reports, security certifications, policies, questionnaire responses, and more. Artifacts are analyzed by Artifact Intelligence to extract control evidence.
**Artifact Intelligence** VISO TRUST's AI document analysis engine. Reads security and compliance documents, extracts risk-relevant evidence, maps findings to controls, and assigns assurance levels — automatically.
**Artifact Type** The classification of an artifact (e.g., SOC 2 Type II, ISO 27001, Penetration Test Report). VISO TRUST classifies artifacts automatically and uses the type to determine which controls the artifact can validate and how much assurance it carries.
**Artifact Validity** The period during which an artifact is considered current. Each artifact type has a standard validity window (e.g., SOC 2 audit period, ISO 27001 3-year certificate). VISO TRUST tracks expiration and reduces assurance as artifacts age.
**Assessment** The process by which VISO TRUST evaluates a vendor's security posture. Assessments can be instant (using public data), artifact-based (uploading documents), or vendor-involved (requesting documentation through the collection portal).
**Assessment Lead** A designated user responsible for running a vendor assessment, separate from the Business Owner of the relationship.
**Assurance Level** A rating reflecting how trustworthy a piece of evidence is. Third-party audits carry higher assurance than self-attested policies. Assurance affects how much control credit an artifact receives — it's the multiplier applied to a control's weight when calculating mitigation. Levels are Limited, Moderate, Standard, and Advanced. An artifact's level can be reduced when it expires, when it only describes a control without testing it, or when an auditor lowers it manually.
**Attestation** A vendor's formal declaration about their security practices. Includes submission certification (vendor confirms their responses are accurate), compliance attestations (publicly claimed certifications), and questionnaire responses.
***
## B
**Business Case** An intake selection that describes how your organization engages with a vendor — e.g., "stores customer data," "has privileged system access," "provides SaaS." Business cases determine which controls are in scope for an assessment and contribute to the likelihood (threat surface) component of inherent risk.
**Business Owner** The internal team member designated as the primary owner of a specific vendor relationship. Not a platform role — an assignment on a relationship. Business Owners manage assessments, receive notifications, and have expanded edit permissions on relationships they own.
**Business Unit** An internal department or team grouping used to organize vendor relationships and scope Risk Insights dashboards. Each user and relationship belongs to a Business Unit.
***
## C
**Collection Portal** The secure, vendor-facing interface used to submit documentation and questionnaire responses during an assessment. Vendors access it via a one-time passcode from an email invitation.
**Collection Request** A formal request sent to a vendor to submit security documentation and/or questionnaire responses through the collection portal.
**Complementary User Entity Controls (CUECs)** Controls in a SOC 2 report that are the responsibility of the client (user entity) rather than the vendor. VISO TRUST auditors review CUECs as part of the AI Assessment + Auditor Review process.
**Contributor** A VISO TRUST role that can view all relationships and create and manage assessments on relationships where they are assigned as Business Owner or Assessment Lead.
**Control** A specific security requirement that must be satisfied by vendor evidence. Controls are organized into control domains and brought into scope by the business cases selected for a relationship.
**Control Domain** A category grouping related security controls — for example, Access Control, Incident Response, or Data Privacy. The domains in scope for a relationship are determined by the selected business cases.
**Control Framework** The structured set of controls that assessments are evaluated against. VISO TRUST's default framework is grounded in NIST 800-53. Custom frameworks can be created for program-specific requirements.
**Control Mitigation** The amount of likelihood removed by controls the vendor has proven. Calculated per control as control weight × assurance × presence, then summed across in-scope controls. Subtracted from likelihood to produce residual risk.
**Control Status** The current state of evidence for a specific control: Present, Description Only, Not Present, No Information, or Not Applicable. Out of scope applies to a whole control domain rather than an individual control.
**Control Weight** A single control's contribution to likelihood. Calculated as control domain weight × relative control weight. Heavier controls move the residual risk score further when evidence is provided for them.
***
## D
**Data Sensitivity** A numeric value (0–1) representing how severe the consequences would be if data of this type were compromised. Drives the impact component of inherent risk. Levels range from None and Minimal up through Moderate, Elevated, and Critical.
**Data Type** A category of information that may be shared with a vendor — e.g., Customer PII, Financial Reporting, Source Code, PHI. Data types determine data sensitivity and the impact component of inherent risk.
**Default Subscriber** A user automatically subscribed to every relationship in the organization, existing and future. Useful for centralized risk or compliance teams that need full portfolio visibility.
***
## F
**Follow-Up Questionnaire** A targeted questionnaire sent to a vendor after initial assessment review to address specific control gaps. Shorter and more focused than an initial questionnaire. Vendors have a configurable window (7 days by default) to respond.
***
## I
**Impact** One of two inputs to inherent risk. Represents the severity of consequences if a vendor were compromised. Driven by the maximum data sensitivity across selected data types. Answers: "If something goes wrong, how bad could it be?"
**Inherent Risk** The level of risk before accounting for any vendor security controls. Calculated as Impact × Likelihood. Represents worst-case exposure based on the relationship context.
**Instant Assessment** An automatic assessment that runs when a relationship is created (if a vendor URL is provided). Uses publicly available data — certifications, security pages, breach disclosures — to generate an immediate risk score without vendor involvement.
***
## L
**Lifecycle Management** Automated features for maintaining vendor relationships over time: artifact validity tracking (alerts when documents expire), relationship recertification (scheduled reassessments), and automatic renewal requests.
**Likelihood** One of two inputs to inherent risk. Represents the probability of a security incident occurring, based on the threat surface defined by the selected business cases. Reduced by the weight of control domains that are out of scope for the relationship, and by controls marked not applicable. Answers: "How likely is something to go wrong?"
***
## N
**Nth Party** A vendor's vendor — a subservicer or technology provider that your direct vendor relies on. VISO TRUST surfaces nth-party risk through the Risk Network and monitors them for advisories alongside your direct vendors.
***
## O
**Onboarded** A relationship status indicating the vendor is actively managed in your TPRM program. Onboarded relationships appear in Risk Insights dashboards and are eligible for lifecycle management features.
***
## P
**Pending Changes** A flag on a relationship indicating new information exists that isn't reflected in the current assessment summary — expired artifacts, context changes, new advisories, or newly discovered public artifacts. Resolved automatically on the next assessment update.
**Predicted Context** Relationship context — intake answers and data classification — proposed by VISO TRUST instead of entered by hand, via **Predict relationship context** in the Relationship configuration dialog. Labeled "Context predicted by VISO TRUST" with an explanation of the reasoning. A suggestion to review, not a confirmed context.
**Program Manager** A VISO TRUST role that can edit all relationships and manage all assessments, and can view — but not edit — program settings.
***
## R
**Relationship** The central record of a business connection with a third-party vendor. All assessments, risk scores, artifacts, advisories, and activity for a vendor are organized under a relationship.
**Remediation** A formal request sent to a vendor to address specific control gaps identified in an assessment. Vendors respond with evidence. VISO TRUST initiates a new assessment update when a vendor responds.
**Residual Risk** The level of risk after accounting for the vendor's security controls. Calculated as impact × the likelihood remaining once control mitigation is subtracted. The primary risk score used for decision-making.
**Risk Advisory** An alert generated when a vendor in your portfolio experiences a risk-relevant event — breach, vulnerability disclosure, regulatory action, etc. Generated automatically through continuous monitoring.
**Risk Model** The configuration layer that controls how numeric risk scores map to labels (Low, Medium, High, Extreme) and how demanding the thresholds are. Includes risk tolerance settings, label names, and compliance certification influence.
**Risk Network** A visual graph representation of your third-party and nth-party vendor relationships, built from subservicer data extracted from artifacts.
**Risk Tolerance** An organization-level setting controlling how strict the risk model is when mapping scores to labels. Options: Minimal (strictest), Moderate, Significant (most flexible).
***
## S
**Smart Summary** An AI-generated narrative summary of assessment findings — formatted as a readable report for executives, auditors, or boards. Editable in-platform and downloadable.
**Sub-Processor** A third party that your vendor uses to process personal data on your behalf. VISO TRUST collects sub-processor lists from vendors when the Privacy risk dimension is in scope.
**Subscriber** An internal user who receives notifications about a specific relationship without being the Business Owner. Subscribers are informed without being responsible for the relationship.
***
## T
**Tags** Free-form labels applied to vendor relationships for filtering, organization, and reporting. Managed in Settings → Tags.
**Threat Surface** The combination of exposures a vendor introduces based on the selected business cases — what systems they touch, what access they have, how they interact with your data. Drives the likelihood component of inherent risk.
**Transitional Risk** A risk score not yet backed by a completed assessment — either none has completed or a new one is in progress. Shown in italics with an asterisk (`*`) on the Relationships list. The marker clears once an assessment completes.
**Trust Profile** An organization's repository of security documentation in VISO TRUST, used to answer inbound customer questionnaires via AI and power Vendor Discovery.
***
## V
**Vendor Collection Portal** See *Collection Portal*.
**Vendor Discovery** A feature that automatically surfaces third-party vendors identified through subservicer analysis of your Trust Profile artifacts — helping you find vendors you may not be tracking yet.
**Vendor Tier** A grouping structure (up to 5 tiers) for organizing vendor relationships by priority or risk treatment. Configured in Settings → Tiers.
**Viewer** A VISO TRUST role with view-only access. Can see relationships, assessments, risk metrics, and advisories but cannot make changes.
**VISO Chat Agent** An AI assistant built into VISO TRUST that answers questions about your vendor portfolio, assessment findings, and risk data using natural language.
# The New Risk Analysis
Source: https://docs.visotrust.com/resources/new-risk-analysis
What's changing with VISO TRUST's new risk analysis, how an Admin turns it on for your organization, and what to expect once it's enabled.
![New Risk Analysis]( "New Risk Analysis")
VISO TRUST is rolling out an updated **risk analysis** — a new version of the risk model and a rebuilt Risk Analysis view. You choose when to turn it on: an Admin can enable it for your organization as soon as you're ready, and it switches on automatically for every organization on **October 1, 2026**, when the previous risk model is retired.
Enabling the new risk analysis is a **one-way change**. Once it's on for your organization, it can't be switched back.
## What's Changing
* **A simpler calculation.** Risk is calculated so it's clear which factors directly affect your score.
* **The math is visible.** Each risk dimension shows a step-by-step **Risk breakdown** from impact through residual risk, and each control has a **Control details** panel showing exactly how its weight and the assurance of its evidence produced the mitigation it earned.
* **History over time.** Risk analysis is retained per assessment, so you can select a past assessment and see how your analysis has changed.
Your risk methodology doesn't change — impact, likelihood, control mitigation, and residual risk mean what they've always meant. See [Risk Analysis](/risk-and-monitoring/risk-analysis) for a full walkthrough of the new view.
History only accrues from the first assessment that runs under the new model. Enabling early starts building that record sooner.
## Turning It On
Enabling is self-service and takes an Admin a few seconds.
In the left navigation, go to **Settings → Org Profile**, then open the **New features** tab.
On the **Risk Analysis & Risk Model Update** card, select **Enable now**.
Read the confirmation dialog and select **Yes, enable**. The button changes to **Enabled**.
Only **Admins** see the **New features** tab, so only an Admin can enable the update. Program Managers, Contributors, and Viewers don't need to do anything — once it's on, everyone in your organization sees the new experience.
Admins may also see a banner across the top of the platform — *Update available: See exactly what's driving your risk score* — with a **View new features** link to the same tab. Dismissing the banner changes nothing; you can still enable the update from the tab at any time.
Because this can't be undone, review your portfolio and let your team know before you enable it.
## What Happens After You Enable
* **Completed assessments keep their scores.** Every assessment that has already completed keeps the scores it was calculated with, under the model that calculated them. Your history stays intact.
* **In-progress and new assessments use the new analysis.** Any assessment still running when you enable, and every assessment started afterward, uses the new model and the new Risk Analysis view.
* **Your portfolio is recalculated in the background.** Enabling re-runs the risk model across every relationship to produce its current score under the new model. This does not overwrite any completed assessment.
* **The difference surfaces as a pending change.** Where the new model produces a different result than a relationship's last completed assessment, it appears as a **Risk model updated** [pending change](/third-parties/relationships#pending-changes) rather than silently changing the score. You decide when to bring each relationship current.
To bring a relationship onto the new analysis, run **Update assessment** from the relationship. Until that assessment completes, the relationship keeps showing its most recent completed assessment.
Once a relationship has a completed assessment on the new model, the risk analysis sections of its older assessments can't be opened — selecting one shows "Risk analysis history is not available for some older assessments." The assessment summary and questionnaire sections for those assessments still work.
## Rollout Timeline
You have a window to opt in on your own schedule. On **October 1, 2026** the new risk analysis turns on automatically for any organization that hasn't enabled it yet, and the previous risk model is retired.
## FAQ
**Do I have to do anything?** No. Enable it early to start using it right away — otherwise it turns on automatically on October 1, 2026.
**Will my existing risk scores change the moment I enable it?** No. Completed assessments keep their scores. Affected relationships flag a **Risk model updated** pending change, and scores only move once you run an assessment update.
**Can I turn it off after enabling?** No — enabling is permanent for your organization.
**Who can enable it?** Any **Admin**. The **New features** tab is only visible to Admins.
**Where do I see what changed on a specific vendor?** Open the relationship's [Risk Analysis](/risk-and-monitoring/risk-analysis) after an assessment update completes.
# Security & Privacy
Source: https://docs.visotrust.com/resources/security-and-privacy
How VISO TRUST protects customer and vendor data: what's collected, where it's stored, encryption, access controls, and compliance certifications.
VISO TRUST is purpose-built for handling sensitive third-party risk data. This page outlines how the platform is designed to keep your data — and your vendors' data — secure and private.
## What Data VISO TRUST Collects
VISO TRUST collects only the information necessary to assess third-party security risk. This includes:
**From your vendors (via collection requests):**
* Security and compliance audit reports (SOC 2, ISO 27001, HITRUST, PCI DSS, etc.)
* Penetration testing results
* Privacy and compliance documents (DPAs, privacy policies)
* Cyber insurance policies
* AI governance documentation
* Questionnaire responses
**From public sources (via automated research):**
* Publicly available security and compliance documentation
* Vendor security and privacy pages
* Compliance certification claims
* Breach disclosures and risk advisories from public feeds
**From your organization:**
* Relationship context and configuration
* Internal user data (names, emails, roles)
* Organization settings and preferences
VISO TRUST does not collect personal data about end users of your vendors' products or any data beyond what is required for risk assessment purposes.
## How Data Is Protected
### Encryption
All data is encrypted in transit using TLS and at rest using industry-standard encryption protocols. This applies to vendor-submitted documents, assessment data, and all platform communications.
### Access Control
Access to data within VISO TRUST is controlled at multiple levels:
* **Role-based access** limits what each user can see and do within your organization's instance
* **Organization isolation** ensures data from one VISO TRUST customer is never accessible to another
* **Vendor data scoping** means vendor-submitted artifacts are accessible only to the client organization that requested them — not to other VISO TRUST customers assessing the same vendor
### Secure Document Submission
Vendor documents are submitted through encrypted portals using one-time passcodes. The submission experience is designed to prevent unauthorized access and ensure that only the designated vendor contact can submit documentation.
### Credential Handling
For integrations that use delegated authorization (such as Slack), VISO TRUST relies on the provider's own authorization flow rather than storing your credentials. Where an integration requires credentials directly (such as Coupa API keys), they are stored securely server-side. API tokens are presented once at generation — store them securely.
## Vendor Data and Confidentiality
**Vendor documents are not shared across customers.** When a vendor submits a SOC 2 report to satisfy your assessment, that document is not shared with other VISO TRUST customers who assess the same vendor. Each assessment is isolated to the client-vendor relationship it belongs to.
**Trust Profile artifacts are not public.** Documents uploaded to your organization's Trust Profile are used internally — to answer AI-generated questionnaire queries and power Vendor Discovery — and are not shared outside your VISO TRUST instance without your action.
**Publicly collected artifacts** are sourced from information vendors have made publicly available (their own website, public trust portals, etc.). VISO TRUST does not access non-public systems or credentials.
## Auditor Access
When the **AI Assessment + Auditor Review** method is configured, VISO TRUST analysts access submitted artifacts to perform a focused review of high-assurance documents. This access is:
* Scoped to the specific artifacts under review
* Logged and auditable
* Performed only by trained VISO TRUST personnel under confidentiality obligations
Auditors do not retain copies of vendor documents after the review is complete.
## AI and Data Usage
VISO TRUST's AI models (Artifact Intelligence, VISO Chat Agent, context prediction) operate on data within your organization's instance. VISO TRUST does not use customer data to train shared AI models without explicit consent.
AI-generated outputs — risk scores, control detections, questionnaire answers — are derived from evidence in your instance and are transparent: every finding links back to a source artifact and detection.
## Compliance
VISO TRUST maintains compliance with applicable data protection regulations and industry standards. For specific compliance documentation, certifications, or data processing agreements, contact [support@visotrust.com](mailto:support@visotrust.com) or your Customer Success Manager.
## Reporting a Security Issue
If you discover a potential security vulnerability in VISO TRUST, please report it responsibly to [support@visotrust.com](mailto:support@visotrust.com). We take security reports seriously and will respond promptly.
# Control Domains & Artifact Types
Source: https://docs.visotrust.com/risk-and-monitoring/control-domains
How control domains define the security categories assessed in VISO TRUST, and how artifact types like SOC 2 and ISO 27001 reports map evidence to controls.
**Control domains** are the categories of security requirements that VISO TRUST assesses vendors against. **Artifact types** are the documents and evidence that validate whether those requirements are met. Together, they form the evidence-to-controls mapping that drives every risk score.
## Control Domains
A control domain is a grouping of related security controls — for example, Access Control, Incident Response, Data Protection, or Vendor Management. The domains in scope for a given assessment are determined by the **business cases** selected for that relationship.
VISO TRUST's default framework covers these dimensions:
| Dimension | What it covers |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| **Security** | Core information security controls — access management, encryption, vulnerability management, incident response, etc. |
| **Privacy** | Data handling, consent, sub-processor management, and compliance with privacy regulations (GDPR, CCPA, HIPAA) |
| **Artificial Intelligence** | Risk controls specific to vendors that develop or deploy AI — model governance, bias, transparency, and AI-specific security practices |
| **Resilience** | Business continuity, disaster recovery, and operational stability |
| **Product Security** | Secure software development, dependency management, and vulnerability disclosure programs |
| **Cyber Insurance** | Coverage and limits of the vendor's cyber insurance policy |
| **Service Locations** | Where the vendor stores data and operates, for data residency and geopolitical exposure |
| **Subservicers** | The vendor's own downstream providers, for nth-party visibility |
Every dimension that has controls in scope gets its own section in the relationship's [risk analysis](/risk-and-monitoring/risk-analysis), where you can see those controls and the evidence behind them. Only the Security dimension produces the inherent and residual risk scores used across the platform.
Controls introduced by your organization's own **supplemental questionnaires** are tracked separately — they appear under Questionnaires in the risk analysis rather than as a risk dimension.
You can further tailor the controls in scope through [Custom Frameworks](/third-parties/advanced/custom-frameworks). The full framework is listed in-platform under **Glossary → Control Domains**.
## How Controls Come in Scope
Controls are brought into scope by the business cases selected during relationship context configuration. Each business case maps to a set of control domains — the combination of selected business cases determines the full set of controls that must be assessed.
Example: A vendor selected with the business cases **"Stores customer data"** and **"Has privileged system access"** will have a broader set of controls in scope than a vendor selected only as a **"Provides software as a service."**
Changing a relationship's business cases immediately updates which controls are in scope. Control domains that fall out of scope are marked **Out of scope**. New in-scope controls show **No Information** until evidence is collected.
## Control Status
Each in-scope control has a status that reflects the current state of evidence:
| Status | Meaning |
| -------------------- | -------------------------------------------------------------------------------------------------------------- |
| **Present** | The control is described as implemented — evidence confirms it's in place |
| **Description Only** | Evidence describes the control but doesn't test it, so it counts as present at reduced assurance |
| **Not Present** | The control is described as not implemented, or the audit includes a qualified opinion or exception against it |
| **No Information** | No evidence addresses this control yet |
| **Not Applicable** | Confirmed by the vendor (or your team) that this control doesn't apply to their environment |
**Out of scope** applies at the control domain level: the domain is enabled in your organization, but doesn't apply to this relationship based on its business context.
In the [risk analysis](/risk-and-monitoring/risk-analysis) view, these statuses are grouped into three indicators — **Present** (green), **Not present** (red), and **Not applicable** (grey) — with a ring showing how much of the control's weight the evidence actually mitigated.
Controls with no supporting evidence represent gaps — they keep the residual risk score high and are the primary targets for remediation requests and follow-up questionnaires. Controls marked **Not applicable** are handled differently: their weight is removed from likelihood rather than counted as mitigation, so they neither raise nor lower the score.
## Artifact Types and Control Mapping
Every artifact type recognized by VISO TRUST maps to a defined set of controls it can validate. When an artifact is uploaded and analyzed, Artifact Intelligence extracts evidence from the document and credits the controls it satisfies.
Each type covers a characteristic set of domains:
| Artifact Type | Controls typically validated |
| ------------------------- | ------------------------------------------------------------- |
| SOC 2 Type II | Security, availability, confidentiality, processing integrity |
| ISO 27001 | Information security management across all domains |
| HITRUST CSF | Security, privacy, compliance (especially healthcare) |
| PCI DSS ROC/AOC | Payment card data security controls |
| Penetration Test | Vulnerability management, application security |
| Data Processing Agreement | Privacy, sub-processor management, data handling |
| Cyber Insurance Policy | Cyber insurance coverage and limits |
| Security Policy | Policy-level coverage across security domains |
| SOC 2 Type I | Design of controls (no operating effectiveness testing) |
| Vendor Questionnaire | Self-attested coverage across any domain |
## Assurance Levels
Every artifact type carries a numeric assurance value, displayed as one of four levels on a four-dot meter:
| Level | Assurance value | Example artifact types |
| ------------ | --------------- | ----------------------------------------------------- |
| **Advanced** | 0.92 and above | ISO 27001, SOC 2 Type II, PCI DSS AOC/ROC, HITRUST r2 |
| **Standard** | 0.90 – 0.91 | SOC 1 Type II, HITRUST i1 |
| **Moderate** | 0.80 – 0.89 | SOC 2 Type I, SOC 1 Type I, HITRUST e1 |
| **Limited** | Below 0.80 | Vendor questionnaires, privacy policies |
Assurance is what scales control credit: a present control backed by an Advanced artifact mitigates nearly all of its weight, while the same control backed by a questionnaire mitigates well under it. Every artifact type's own level is listed in-platform under **Glossary → Artifact Types**.
Assurance can also be **reduced** below an artifact type's normal level. The risk analysis view labels the reason:
| Reason | What happened |
| --------------------- | ------------------------------------------------------- |
| **Artifact expired** | The artifact is past its validity period |
| **Description only** | The evidence describes the control without testing it |
| **Reduced assurance** | A VISO TRUST auditor manually lowered the assurance |
| **Audit ignored** | The artifact doesn't count toward the risk model at all |
## The Assurance Hierarchy
When multiple artifacts of different assurance levels address the same control, VISO TRUST uses the highest-assurance artifact to determine the control's status. A validated SOC 2 report supersedes a self-attested security policy for the same control.
When a high-assurance artifact is available, it also supersedes expired lower-assurance artifacts of the same type, and older versions of the same artifact type.
## Compliance Certifications vs. Validated Artifacts
When VISO TRUST detects a publicly claimed certification (a SOC 2 badge on a vendor's website) but doesn't have the actual report, it grants **partial credit** — a lower-confidence signal that the vendor likely meets those controls.
To upgrade from partial to full credit, request the actual certification document through a collection request. Submitting and analyzing the full report replaces the partial credit with validated evidence.
# Notifications & Alerts
Source: https://docs.visotrust.com/risk-and-monitoring/notifications
Route VISO TRUST notifications to the right people: configure organization contacts, default subscribers, and per-event delivery for alerts and advisories.
VISO TRUST generates notifications to keep the right people informed about assessments, risk events, and relationship activity. Admins have granular control over how notifications are routed and who receives them.
Notification settings are in **Settings → Org Profile → Notifications**.
## Organization Contacts
Before configuring notification routing, designate your organization's primary contacts:
**Support Contact** — the primary contact vendors see during interactive assessments. This person's name and email appear in assessment communications sent to vendors. Setting a clear support contact improves vendor trust and streamlines communication.
**Incident Response Contact** (optional) — a designated recipient for all risk advisory notifications across your entire vendor portfolio. Ideal for a centralized security operations or compliance team that needs to triage every advisory regardless of which business owner owns the relationship.
## Notification Routing
### Disable Business Owner Notifications
By default, Business Owners receive notifications about the relationships they own — assessment updates, risk advisory alerts, lifecycle reminders, and more. You can disable all Business Owner notifications globally.
Use this when another team is centrally managing all communication, or when you're triaging notifications through a shared inbox before routing them.
### Override Internal Email Recipients
Consolidate all internal notifications into a single email address — useful for ticketing systems, shared inboxes, or security operations centers that triage alerts before routing them to the appropriate person.
The override applies only to **internal notifications**. Vendor-facing emails (collection requests, reminders, submission confirmations) are never redirected by this setting.
## Notification Types
The notification settings matrix groups notifications into categories. Each notification can be toggled on or off per recipient. Depending on the category, recipients include the **Business owner**, **Assessment lead**, **Subscribers**, the **creator** of the item, and the vendor's **third party contact**. Some notifications — particularly those sent directly to vendors — cannot be disabled.
### Assessments
* Assessment started
* Assessment submitted
* Assessment completed
* Assessment cancelled
* Assessment forwarded
* Assessment expired
* Assessment expiration extended
* Assessment reminder
* Invalid assessment recipient email
### Remediation
* Remediation requested
* Remediation reminder
* Remediation artifacts provided
* Remediation declined
* Remediation forwarded
* Remediation target date missed
### Monitoring & Risk Alerts
* Risk advisory
The Incident Response Contact (configured above) additionally receives every risk advisory across your portfolio.
### Lifecycle & Recertification
* Relationship onboarded
* Upcoming recertification
### Relationship Management
* Relationships imported
* Relationship import failed
### Mentions
Users tagged in comments on a relationship or assessment receive a notification — regardless of their role or subscription status on that relationship.
## Previewing Notification Content
To see exactly what a notification looks like before it goes out, select any notification type in the Settings matrix. A preview shows the email subject and body, including how placeholder data (vendor name, relationship name, etc.) is populated.
Use this to validate that your support contact name appears correctly and that the communication tone matches your organization's expectations.
## Per-Relationship Notification Settings
In addition to org-wide settings, individual relationships have their own notification configuration. Open the relationship's **Relationship configuration** dialog (gear icon) and use the **Contacts** section to:
* Enable or disable notifications for the Business Owner on that specific relationship
* Add or remove Subscribers who receive updates for that relationship
Relationship-level settings don't override org-wide routing overrides — if you've consolidated all notifications to a shared inbox at the org level, that applies to all relationships.
# Risk Advisories
Source: https://docs.visotrust.com/risk-and-monitoring/risk-advisories
Risk Advisories surface vendor breaches, vulnerabilities, regulatory actions, and other material events automatically so you can respond the day they happen.
**Risk Advisories** are alerts generated when something risk-relevant happens to a vendor in your portfolio — a breach, regulatory action, software vulnerability, or other material event. VISO TRUST monitors your vendors continuously and surfaces advisories automatically, so you're informed the same day an event is published rather than at your next review cycle.
## What a Risk Advisory Contains
Each advisory includes:
* **Title** — a clear description of the event
* **Organization** — the vendor the advisory pertains to
* **Type** — the category of event (see below)
* **Materiality** — the assessed severity and significance of the advisory
* **Network Exposure** — the number of direct vendors and nth parties impacted
* **Source** — a link to the original documentation and its publication date
* **VISO TRUST Statement** (when applicable) — additional context or guidance from the VISO TRUST team
## Advisory Types
| Type | What it covers |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Security** | Events related to the confidentiality, integrity, or availability of information being compromised — breaches, ransomware incidents, unauthorized access |
| **Vulnerability** | Disclosure of a specific flaw or weakness that could be exploited (CVEs, zero-days) |
| **Compliance** | Failures to meet regulatory requirements, resulting in fines, enforcement actions, or legal consequences |
| **SEC 8-K** | Material security incident disclosures by public companies — significant enough to require shareholder notification |
| **Legal** | Legal disputes, lawsuits, or regulatory actions affecting a company's risk profile |
| **Geopolitical** | Sanctions, international conflicts, or political instability that could affect vendor operations or supply chain continuity |
| **Financial** | Material financial events such as earnings losses, bankruptcy filings, or significant funding issues |
| **Operational** | Events affecting a vendor's operational capacity — system outages, natural disasters, workforce disruptions |
## Materiality
Each advisory is assigned a **materiality rating** that reflects its potential significance. Materiality is assessed through an automated process with human oversight, based on whether a reasonable stakeholder would consider the event important in evaluating the vendor's risk profile.
Use materiality ratings to triage which advisories require immediate action versus which to monitor.
## Where to Find Advisories
**Portfolio level:** Navigate to **Monitoring** in the left sidebar to see all advisories across your entire vendor portfolio. Switch between the **Risk Advisories** and **Vulnerabilities** tabs to view each feed.
**Relationship level:** Open any vendor relationship and go to the **Monitoring** tab to see advisories specific to that vendor and their nth parties.
**Nth-party visibility:** VISO TRUST surfaces advisories not just for your direct vendors, but for their subservicers and technology providers — giving you visibility into supply chain risk beyond your immediate vendor list.
## Requesting a Vendor Response
When a high-impact advisory affects multiple vendors, you can send a targeted collection request directly from the advisory — asking affected vendors to confirm their exposure and provide evidence of their response.
Navigate to **Monitoring**, open the **Risk Advisories** tab, and select the advisory you want to act on.
At the bottom of the advisory, select **Request vendor response**.
Use filters (tiers, tags, business units, business cases, data types) to identify the relevant vendor relationships. Select individual vendors or bulk-select your entire portfolio.
Relationships without a third-party contact cannot be included. Add a contact to the relationship first.
Add specific questions for vendors to answer — tailored to the advisory rather than generic requests. VISO Chat Agent can help you draft context-specific questions based on the advisory details.
Use Advanced Settings to define collection timelines, non-response behavior, and follow-up options. Send the request — each vendor's contact receives a targeted collection request.
Track vendor responses in the relationship's artifact list under the **Questionnaire** artifact type.
## Continuous Monitoring
VISO TRUST continuously scans OSINT feeds, regulatory filings, security disclosures, and news sources to surface advisories as they emerge. There's no manual setup required — once a relationship exists and the vendor is onboarded, monitoring is active.
Point-in-time assessments capture risk at a single moment. Continuous monitoring keeps that picture current between assessment cycles, giving you the ability to react to material events before they affect your risk posture.
# Risk Analysis
Source: https://docs.visotrust.com/risk-and-monitoring/risk-analysis
Read the Risk Analysis view in VISO TRUST: what impact, likelihood, control mitigation, and residual risk mean, and how each number is calculated.
**Risk Analysis** shows the work behind a vendor's risk score — which controls were in scope, what evidence was found, how much risk that evidence removed, and what remains. It's a snapshot of one assessment: every number reflects the evidence that existed when that assessment completed.
## Where to Find It
Risk analysis lives on the relationship's **Assessments** tab. Select an assessment from the selector at the top of the tab, then use the left sidebar to move between sections.
The sidebar starts with **Assessment summary** — risk level cards, the assessment timeline, artifacts, and the AI-generated summary — followed by two groups:
| Group | What it contains |
| ------------------ | ------------------------------------------------------------------------------------------------------ |
| **Risk analysis** | **All controls**, plus one section per [risk dimension](/risk-and-monitoring/control-domains) in scope |
| **Questionnaires** | One section per questionnaire attached to the relationship |
The ring next to each entry is a progress indicator — green for satisfied, red for the remainder. On risk analysis entries it's the share of in-scope controls that evidence shows are present; on questionnaire entries it's the share of questions answered. The Security entry also shows its residual risk label.
Older assessments were calculated with a previous version of the risk model. When you select one, the sidebar shows "Risk analysis history is not available for some older assessments" and the risk analysis sections can't be opened. The assessment summary and the questionnaire sections still work.
## Reading a Dimension
Each risk dimension opens with a card summarizing the dimension, followed by the full control list.
The card shows:
* **Control mitigation** — a bar and a percentage: the share of the dimension's in-scope controls that evidence shows are present
* **Inherent risk → residual risk** — the two risk levels for this dimension (Security only)
* **Risk breakdown** — an expandable, step-by-step walkthrough of the calculation
* **Download** — exports the underlying risk model output as CSV
The control mitigation percentage counts controls; the **control mitigation** value inside the risk breakdown is weighted. A dimension can show a high percentage of controls present while mitigating much less of its weight, if the controls with the most weight are the ones without evidence.
The relationship's headline risk score comes from the **Security** dimension — that's the inherent and residual risk used across the platform, and the only dimension that shows the full inherent → residual breakdown. Other dimensions show likelihood and mitigation so you can judge coverage.
## The Risk Breakdown
Expand **Risk breakdown** on the Security dimension to see the five steps that produce the score. Every value is on a 0–1 scale.
Other dimensions show a shorter breakdown — likelihood and mitigated likelihood only — because impact and the risk scores are set at the Security level.
### Step 1 — Impact: What's at Stake
Impact is set by the **highest sensitivity data type** shared with the vendor. One extremely sensitive data type sets impact for the whole relationship — sensitivities don't add up.
The step shows the data type responsible and its numeric sensitivity. See [Data Types](/third-parties/advanced/data-types).
### Step 2 — Likelihood: Controls in Scope
Likelihood is the share of your control framework that applies to this vendor. The more of your framework is in scope, the larger the threat surface.
Three numbers are shown:
| Metric | Meaning |
| ---------------------------- | -------------------------------------------------------------------------------------------------- |
| **Control domains in scope** | How many of this dimension's control domains apply to this relationship, out of all of its domains |
| **Control domain weight** | The combined weight of those in-scope domains, out of the dimension's total domain weight |
| **Likelihood** | The resulting likelihood value |
The **All controls** section shows the same three numbers across your whole framework rather than a single dimension.
Likelihood starts at 1 and is reduced by:
* the weight of every control domain that is **out of scope** for this relationship, and
* the weight of every individual control marked **Not applicable** inside an in-scope domain.
```
Likelihood = 1 − (weight of out-of-scope domains + weight of not-applicable controls)
```
Scope is driven by the business cases selected during relationship configuration. Narrowing the business cases takes domains out of scope and lowers likelihood. The bar underneath is clickable — selecting a segment jumps to that control domain in the list below.
### Step 3 — Inherent Risk
```
Inherent risk = Likelihood × Impact
```
Inherent risk is the baseline exposure before any credit for controls. The resulting score is mapped to a risk label using your organization's [risk tolerance](/risk-and-monitoring/risk-model).
### Step 4 — Mitigated Likelihood: What Controls Reduce
**Control mitigation** is the total weight of controls the vendor has proven, discounted by how trustworthy the evidence is. Subtracting it from likelihood leaves the part of the threat surface that is still unaddressed.
```
Unmitigated likelihood = Likelihood − Control mitigation
```
Mitigation only counts in-scope controls, and only where there is evidence. A control with no supporting evidence contributes nothing, no matter what the vendor claims. Controls marked **Not applicable** aren't counted as mitigation — their weight was already removed from likelihood in step 2.
### Step 5 — Residual Risk
```
Residual risk = Unmitigated likelihood × Impact
```
Residual risk is the number to act on. Impact never changes between the two calculations — controls reduce risk by shrinking likelihood, never by lowering the consequences of a breach.
### The Risk Graph
Below the steps, the risk graph plots likelihood (vertical) against impact (horizontal), with colored bands for each risk label under your current risk tolerance. Two markers are placed on it:
* **I** — inherent risk
* **R** — residual risk
The distance between them is the credit the vendor earned from evidence. A marker sitting high on the likelihood axis with little vertical drop means broad scope and thin evidence.
## Metrics Reference
| Metric | What it measures | How it's calculated |
| --------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Impact** | Severity if the vendor were compromised | Sensitivity of the most sensitive data type shared with the vendor |
| **Likelihood** | Size of the threat surface | 1 minus the weight of out-of-scope domains and not-applicable controls |
| **Inherent risk** | Exposure before controls | Likelihood × Impact |
| **Control mitigation** | Risk removed by proven controls | Sum of control weight × assurance × presence, across in-scope controls |
| **Unmitigated likelihood** | Threat surface still unaddressed | Likelihood − Control mitigation |
| **Residual risk** | Exposure after controls | Unmitigated likelihood × Impact |
| **Control domain weight** | A domain's share of the framework | Set per control domain in your framework |
| **Relative control weight** | A control's share of its domain | The control's own weight ÷ the total weight of every control in the domain |
| **Control weight** | A single control's contribution to likelihood | Control domain weight × Relative control weight |
| **Highest assurance** | Trustworthiness of the best evidence for a control | Assurance level of the highest-assurance artifact detection, reduced if the artifact is expired or description-only |
## The Control List
Under each dimension card, every control domain is listed with a bar showing how many of its controls are present. Domains that don't apply are labeled **Out of scope** or **Not applicable**.
Filter and search the list with:
* **All / Sufficient / Insufficient** — a domain counts as **Sufficient** only when every one of its controls is present; anything short of that is **Insufficient**. Both counts cover in-scope domains only.
* **Search** — match on control domain name
* **Detection types** — narrow to Subservicers, Sub-processor, Shared Responsibility, or CUEC detections
* **Issues** — narrow to domains with an **Exception** or an **Expired artifact**
Applying a detection type or issue filter auto-expands the matching domains and their controls, and each control shows only the detections carrying a selected type. Controls whose detections all filter out drop off the list, as do controls without a selected issue. The **Show irrelevant detections** section opens with the filter, since a match can land there. Clearing a filter returns the hidden controls and detections but leaves anything you've already opened in place.
Expand a domain to see its individual controls. To open every listed domain at once, select **Expand all** next to the filters. Once every domain is open, the button reads **Collapse all** and closes them. Each control shows a status indicator:
| Indicator | Meaning |
| ----------- | -------------------------------------------------------------------------------------------------- |
| Green check | **Present** — evidence confirms the control is in place |
| Red error | **Not present** — evidence says the control is missing, or an audit raised an exception against it |
| Grey | **Not applicable** — the control doesn't apply to this vendor |
The ring around the indicator shows how much of that control's weight the evidence actually mitigated. A green check with a partial ring means the control is present, but the evidence supporting it carries less than full assurance.
The **Sub-Processor List** control works differently from other controls. Instead of detection passages, it shows the vendor's collected sub-processor list as a table — each company, its purpose, and its location of processing. The underlying artifact detections sit behind **View sub-processor detections**. A collected sub-processor list carries full assurance, so this control shows as fully mitigated once the vendor provides its list. See [Sub-Processor Collection](/third-parties/assessments#sub-processor-collection).
Under each control are the **detections** — the specific passages in specific artifacts that substantiate it. Each detection card is titled with the audit report type of the artifact behind it and carries a category badge such as **Third party audit**, **Compliance attestation**, or **Self assessment**. Detections in the **Compliance attestation** category show a tooltip on the badge explaining that the control is likely present based on evidence of compliance certification. That category covers [presumed artifacts](/trust-and-questionnaires/artifact-intelligence#presumed-artifacts) and cert-only artifacts like an ISO 27001 certificate. Detections from a presumed artifact are titled with the audit report type followed by **Attestation** (for example, *SOC 2 Type 2 Attestation*) and show no quoted passage, because there is no document behind them. Detections are ordered by assurance, highest first, so the detection the risk model scored sits at the top. The ordering uses each artifact's effective assurance after any reduction for expiry or manual adjustment, so a live standard-assurance report ranks above an expired advanced one. The same ordering applies to the detections behind questionnaire answers. Detections that disagree with the control's outcome are collapsed behind **Show irrelevant detections**: on a control judged present, that's the detections saying it isn't, and vice versa. Expand them when you want to see why a control landed where it did.
## Control Details
Select **View control details** from a control's menu to open a panel with the full calculation for that one control:
* **Description** — what the control requires
* **Control weight** — `Control domain weight × Relative control weight = Control weight`
* **Supporting evidence** — the highest assurance level found, the artifact it came from, and the test result if the control was tested
* **Control mitigation** — how much of the control's weight the evidence satisfied
The mitigation formula shown in the panel is:
```
Control weight × Highest assurance × Presence = Control mitigation
```
Presence is 1 when the control is present and 0 when it isn't. So a missing control mitigates nothing, and a present control backed by weak evidence mitigates only part of its weight. This is where a vendor's score is won or lost: raising assurance on a heavy control moves residual risk more than adding evidence for a light one.
## Questionnaires
Supplemental questionnaires get their own sections in the **Questionnaires** group rather than appearing as a risk dimension — their controls are excluded from the risk analysis control lists. Each questionnaire section is labeled with its response mode: **AI response** when VISO AI answers the questions from the vendor's artifacts, or **Vendor response required** when the vendor answers directly. Each section shows:
* **Completion** — how many questions were answered, as a bar and a percentage
* **All / Answered / Not answered** filters, plus search across question text
* A table of questions with the answer and an icon showing who answered — VISO AI, a named person, or an error marker when the AI couldn't answer from the available information
Hover an AI answer to see the reasoning behind it. Expand any answered row to see the artifact detections behind it — the passages the answer cited, ordered the same way as detections elsewhere in risk analysis. A question with no answer shows a dash in the answer column, and its row doesn't expand.
### AI Answering States
A questionnaire section that isn't fully answered yet shows why:
* **Awaiting the vendor's response** — the questionnaire requires a vendor response that hasn't arrived
* **Answers will be generated once artifact processing is complete** — the assessment or its artifacts are still processing
* **VISO AI is answering these questions** — a run is in flight; the section header and its sidebar entry show a spinner, and unanswered rows show a placeholder until their answer lands
While a run is in flight, a **Stop** button on the processing banner cancels it so it can be started again.
A questionnaire the AI hasn't started answering shows a **Pending change** prompt instead of a status message.
### Answering Through an Assessment Update
Questionnaires added after the assessment completed aren't answered automatically. Their section shows a **Pending change** prompt explaining that an assessment update will generate the answers with Artifact Intelligence. Select **Update assessment** in the prompt to start one. VISO AI answers the questionnaire as part of the update, and answers arrive in the table in real time as they're generated.
An assessment update is the only way to request answers, so the assessment summary always describes the same analysis as the answers beneath it. Re-answering works the same way: running an update re-answers AI questionnaires from the vendor's latest artifacts, replacing the previous evidence.
Users who can't update the assessment, such as support and read-only users, see the prompt without the button. If the relationship is missing its context, the button is disabled with a tooltip asking you to add context first.
AI answers also write evidence into the questionnaire's control domains: a **Yes** answer validates the domain against the artifacts it cited, a **No** answer records it as not present, and an unanswerable question leaves it unvalidated. This evidence is for display only — supplemental questionnaire answers don't move the risk score.
## Snapshots and Updates
Risk analysis is bound to the assessment you're viewing. Evidence added after that assessment completed doesn't appear in it — selecting an older assessment shows what was known at the time, not today's picture.
New information surfaces as **Pending Changes** on the relationship instead, including:
* **Risk model updated** — the risk model has changed since this relationship's last assessment, and current scores may shift once it runs again
* **Supplemental questionnaires were added to this relationship** — new questionnaires are attached but not yet reflected in the analysis
Pending changes are incorporated the next time an assessment update runs. See [Pending Changes](/third-parties/relationships#pending-changes).
## Exporting the Analysis
The download button on any dimension card exports that dimension's risk model output as a CSV — a row per control with its weight, validation status, detection assurance, weighted presence, and the artifact that supported it, alongside the assessment's inherent and residual scores. From **All controls**, the export covers every dimension. Any user with access to the assessment can download it.
To lower residual risk, start from the **Insufficient** filter on the dimension with the most control weight in scope. Those controls have the largest unmitigated weight, so evidence there moves the score furthest. Use a [remediation request](/third-parties/assessments) or a follow-up questionnaire to collect it.
# Risk Insights
Source: https://docs.visotrust.com/risk-and-monitoring/risk-insights
Risk Insights provides portfolio-level VISO TRUST dashboards built on Metabase, giving program managers a complete view of third-party risk exposure.
**Risk Insights** provides portfolio-level dashboards that give program managers and security leaders a clear view of organizational risk across all vendor relationships. It's built on Metabase and accessible to all roles — Admins, Program Managers, Contributors, and Viewers.
Navigate to **Risk Insights** in the left sidebar to access the dashboards.
## Two Dashboards
Risk Insights contains two distinct dashboards with different scopes:
Scoped to **onboarded relationships only**. Shows your organization's actual cyber risk exposure — the vendors actively in your program with risk scores, control coverage, and assessment data.
Scoped to **all relationships** — onboarded, not onboarded, and deleted. Shows the operational health of your TPRM program — how much coverage you have, how active assessments are, and where VISO TRUST has had impact.
Selecting any number on either dashboard opens a filtered view of your Relationships list page — so you can drill directly into the underlying data.
## Filters
Both dashboards support the same set of filters for slicing the data:
| Filter | Description |
| ------------------ | ---------------------------------------------------------------- |
| **Created Date** | Apply date ranges based on when relationships were created |
| **Business Units** | Show only relationships belonging to a specific department |
| **Risk Levels** | Show relationships at a specific inherent or residual risk level |
| **Business Case** | Show relationships associated with one or more business cases |
| **Data Types** | Show relationships with specific data types in scope |
| **Tags** | Show relationships with specific tags applied |
## Risk Metrics Reports
Reports in this dashboard are scoped to onboarded relationships only.
| Report | Description |
| ---------------------------- | -------------------------------------------------------------------------------------------------------- |
| **Onboarded Relationships** | Total count of onboarded vendor relationships |
| **Average Residual Risk** | The average residual risk score across all onboarded relationships |
| **Risk Timeline** | Average organizational risk over time, relative to the number of onboarded relationships in your program |
| **Average Control Coverage** | Average percentage of in-scope controls with validated evidence (present controls ÷ in-scope controls) |
| **Risk Distribution** | Breakdown of vendors by risk level (Low / Medium / High / Extreme) |
| **Assessment Coverage** | Percentage of onboarded relationships with a completed assessment |
## Program Metrics Reports
Reports in this dashboard cover your full relationship population.
| Report | Description |
| ---------------------------------- | ---------------------------------------------------------------------------- |
| **Total Relationships** | All relationships across your program, including non-onboarded |
| **Assessment Activity** | Assessments initiated, completed, and in progress over a time period |
| **Relationships by Business Unit** | Relationship count broken down by owning department |
| **Relationships by Tier** | Relationship count broken down by vendor tier |
| **Relationships Awaiting Action** | Relationships pending risk review, remediation response, or lifecycle update |
Risk Insights is available to all roles. Both dashboards are visible to Admins, Program Managers, Contributors, and Viewers; the data shown may be scoped to the relationships each user can access.
## Using Risk Insights for Program Reviews
Risk Insights is designed to support executive and stakeholder reporting, not just day-to-day operations. Common use cases:
* **Board or executive reporting** — share average residual risk and assessment coverage as program health indicators
* **Business unit reviews** — filter by Business Unit to give team leads a view of their own risk posture
* **Audit preparation** — use assessment coverage and control coverage metrics to demonstrate program completeness
* **Trend analysis** — track how organizational risk has changed over time as more vendors are assessed and risk is reduced
Bookmark filtered dashboard views for specific business units or risk levels to build a recurring reporting workflow without re-applying filters each time.
# Your Risk Model
Source: https://docs.visotrust.com/risk-and-monitoring/risk-model
Tune VISO TRUST's risk model: adjust risk tolerance, customize score-to-label thresholds, and rename risk labels to match your TPRM program.
VISO TRUST's risk model is configurable. While the underlying scoring methodology is consistent, you can tune how risk scores map to labels and how strict the thresholds are — so the output aligns with how your organization thinks about and communicates risk.
There are two places to look:
* **Settings → Risk Model** shows your current tolerance, the score thresholds behind each risk label, and how your portfolio is distributed across those labels. It's a read-only view.
* **Settings → Your Framework → Risk calculations** is where you change the settings. Editing requires the Admin role and happens on a framework draft, so nothing takes effect until you publish.
## Risk Tolerance
**Risk tolerance** determines how demanding the model is when translating numeric risk scores into labels like Low, Medium, High, and Extreme. It controls the thresholds at which a vendor's score crosses from one label to the next.
VISO TRUST offers three predefined tolerance levels:
**Default.** The strictest setting. High-assurance artifacts (independent audits, certifications) are required to move a vendor into the lowest risk tier. Best for organizations in regulated industries or those handling highly sensitive data with mature TPRM programs.
Balances security rigor with operational efficiency. Strong controls are expected but there's more flexibility in the assurance level required. Suited for mid-sized or fast-growing organizations with dynamic vendor portfolios.
Accepts a higher level of risk in exchange for speed and flexibility. Focus is on core security controls, with questionnaire responses accepted as primary evidence. Suited for less regulated industries or early-stage TPRM programs.
Publishing a risk tolerance change re-runs the risk model for **every relationship in your organization**, so scores and labels across your portfolio can move at once — a vendor labeled "Low" under Minimal tolerance may land differently under Significant. Review your portfolio after publishing.
## Risk Label Names
The default labels — No Context, Low, Medium, High, Extreme — can be renamed to match your organization's risk vocabulary. If your GRC framework or executive reporting uses different terminology, updating the labels ensures consistency.
Renaming happens in the same place as tolerance: in **Settings → Your Framework → Risk calculations**, select **Customize** on the risk tolerance card, then fill in the **Custom label** field for each level alongside its default label.
Label name changes are cosmetic only — they don't affect the underlying scoring or thresholds.
## Control Domain Weighting
Every control domain carries a weight. In-scope domain weight is what sets a relationship's likelihood, and each individual control inherits a share of its domain's weight — so a heavy domain moves the score more than a light one, both when it comes into scope and when evidence satisfies it. A vendor with network access is therefore scored differently from one with only data access.
For organizations using [Custom Frameworks](/third-parties/advanced/custom-frameworks), control domain weighting can be adjusted to reflect your program's priorities — for example, placing greater weight on privacy controls for vendors handling personal data.
To see the weights in effect on a specific vendor, open the relationship's [risk analysis](/risk-and-monitoring/risk-analysis) — the likelihood step shows in-scope weight against total weight, and each control detail shows its own weight.
## Risk Overrides
When an assessment is in Review Risk status, Admins and Program Managers can manually **override** the inherent or residual risk value calculated by the model — as can Contributors on relationships where they're the Business Owner or Assessment Lead. Use this when:
* Compensating controls have been implemented that aren't captured in the assessment
* The relationship context doesn't fully reflect the actual risk exposure
* A business decision warrants accepting a different risk level than the model suggests
Overrides are documented in the relationship's activity log and remain in effect until the next assessment update.
## Risk Model Updates
When VISO TRUST updates the risk model itself, a relationship shows a **Risk model updated** pending change if the model version behind its last completed assessment differs from the version behind its current scores. Existing assessments are left alone — each one keeps rendering under the model it was calculated with — and the new model takes full effect the next time an assessment update runs.
## Compliance Certification Influence
By default, VISO TRUST gives partial credit when a vendor publicly claims a compliance certification (e.g., displays a SOC 2 badge on their website) but hasn't provided the actual report. This reduces residual risk slightly, with lower assurance than a validated artifact.
You can disable this behavior so that compliance certifications only count when the actual report is submitted and reviewed. The **Include compliance certifications in risk calculations** toggle is in **Settings → Your Framework → Risk calculations**, and like risk tolerance it applies when you publish the draft.
## What the Risk Model Doesn't Do
* **It doesn't replace human judgment.** Risk overrides, context configuration, and remediation decisions are all made by your team.
* **It doesn't assess vendors you don't have relationships with.** Scores only exist for vendors in your portfolio.
* **It doesn't guarantee outcomes.** Risk scores reflect the evidence collected — they're as accurate as the data behind them.
# Risk Scoring Overview
Source: https://docs.visotrust.com/risk-and-monitoring/risk-scoring
How VISO TRUST calculates inherent and residual risk for every vendor, combining business case exposure, data sensitivity, and control assurance.
VISO TRUST produces two risk scores for every vendor: **inherent risk** and **residual risk**. Understanding how these are calculated helps you interpret what the scores mean and how to act on them.
## The Core Formula
Everything in the VISO TRUST risk model flows from a single industry-standard principle:
```
Inherent Risk = Impact × Likelihood
Residual Risk = Impact × (Likelihood − Credit for proven security controls)
```
**Impact** answers: *If this vendor were compromised, how bad could it be?*
**Likelihood** answers: *How likely is something to go wrong?*
Both values are numeric (0 to 1 internally) and combine to produce an inherent risk score. Proven controls then reduce likelihood — the credit they earn is called **control mitigation** — and the reduced likelihood produces the residual risk score.
Impact is identical in both calculations. Controls lower risk by shrinking the likelihood of an incident, never by reducing how bad one would be.
## Step 1 — Establish Impact
Impact is driven by **data sensitivity** — the types of data your vendor handles. The most sensitive data type selected for the relationship sets the impact score.
Data types fall into sensitivity levels — None, Minimal, Moderate, Elevated, and Critical. A vendor handling payment card data (Critical) starts with a higher impact score than one handling only low-sensitivity data (Minimal).
See [Data Types](/third-parties/advanced/data-types) for the full list of data types and their sensitivity levels.
## Step 2 — Assess Likelihood (Threat Surface)
Likelihood is driven by **threat surface** — how the vendor interacts with your environment. This is determined by the **business cases** selected when configuring relationship context.
Business cases capture factors like:
* Does the vendor store or process your data?
* Does the vendor have privileged access to your systems?
* Does the vendor operate a production environment?
* Does the vendor have physical access to your facilities?
Each business case brings relevant control domains into scope and contributes to the likelihood score.
## Step 3 — Determine Controls in Scope
Not all security controls matter equally for every vendor. Based on the business cases selected, VISO TRUST automatically determines which control domains are relevant for the assessment.
A SaaS vendor on a hyperscale cloud needs different controls validated than a vendor with physical server access. Controls in scope define what evidence must be collected and reviewed.
## Step 4 — Gather and Weigh Evidence
VISO TRUST collects evidence from multiple sources:
* Independent audits (SOC 2, ISO 27001, HITRUST, PCI DSS)
* Security policies and procedures
* Technical assessments (penetration tests)
* Questionnaire responses
* Publicly available artifacts and certifications
How much risk a piece of evidence removes depends on three factors:
| Factor | What it measures |
| ------------------ | --------------------------------------------------------------------------------------------------------------- |
| **Control weight** | How much a control contributes to likelihood — its control domain's weight × the control's share of that domain |
| **Presence** | Whether the evidence shows the control is actually in place |
| **Assurance** | How trustworthy the evidence is (independent audit > self-attested policy) |
Multiplied together across every in-scope control, these produce **control mitigation** — the total credit subtracted from likelihood. See [Risk Analysis](/risk-and-monitoring/risk-analysis) for the per-control breakdown.
## Step 5 — Calculate the Scores
**Inherent Risk** is the starting point — potential risk before any controls are considered. It reflects Impact × Likelihood based solely on relationship context.
**Residual Risk** is the end point — impact applied to the likelihood that remains after control mitigation is subtracted. Risk only goes down when there's verified evidence. A vendor that claims good security practices but can't prove them gets no credit.
Both scores are mapped to risk labels:
| Label | Meaning |
| -------------- | ---------------------------------------------------------------- |
| **No Context** | Relationship context not yet configured; risk not yet calculated |
| **Low** | Limited exposure with strong controls verified |
| **Medium** | Moderate exposure; controls partially verified |
| **High** | Significant exposure or control gaps |
| **Extreme** | Critical exposure with major control gaps |
Label names and the thresholds that map to them can be customized to align with your organization's risk language. See [Your Risk Model](/risk-and-monitoring/risk-model).
## Scores Before an Assessment Completes
A relationship is scored as soon as it has context — you don't have to wait for an assessment. The instant assessment researches public sources and the model runs against whatever evidence that turns up.
Until a completed assessment backs the score, it's **transitional**. On the Relationships list a transitional score is shown in italics with an asterisk (`*`). Treat it as a starting estimate: it reflects the relationship context plus whatever public evidence exists, not reviewed documentation. The marker clears once an assessment completes, and the score then rests on analyzed evidence.
A score also goes back to transitional while a new assessment is in progress, since the result isn't settled yet.
## Predicted Context
Context — the intake answers and data classification — is what drives impact and likelihood, so it has to be right before the score means much. VISO TRUST can propose it for you.
Prediction runs on its own when you add a relationship with **Predict relationship context and instantly assess** selected. You can also run it later: open the **Relationship configuration** dialog and select **Predict relationship context**. Either way, VISO TRUST fills in the intake questionnaire and data classification from what it knows about the vendor, and the section header changes to **Context predicted by VISO TRUST** — hover it to see the reasoning behind the prediction.
Whether prediction happens automatically for new relationships is an org-level default in **Settings → Assessments**.
A predicted context is a suggestion, not a confirmation. Review the intake answers and data types before relying on the resulting score — an incorrect data type changes impact, and incorrect business cases change which controls are in scope.
## What Drives Score Changes
Risk scores update automatically when:
* New artifacts are uploaded or analyzed
* Business cases or data types are changed
* Artifacts expire (reducing assurance on previously credited controls)
* New risk advisories are detected (flagged as pending changes)
* An assessment update runs
Focus on **residual risk** when prioritizing your workload — it's the most actionable number. A vendor with high inherent risk but strong controls may be lower priority than one with medium inherent risk but unvalidated controls.
To see these steps applied to a specific vendor — with the actual impact, likelihood, and mitigation values behind their score — see [Risk Analysis](/risk-and-monitoring/risk-analysis).
# Artifact Type Configuration
Source: https://docs.visotrust.com/third-parties/advanced/artifact-type-configuration
How VISO TRUST artifact types classify security documents like SOC 2 and ISO 27001 reports, and how that classification drives which controls they validate.
**Artifact types** are the categories VISO TRUST uses to classify security and compliance documents. When an artifact is uploaded — whether by you, a vendor, or discovered publicly — VISO TRUST automatically classifies it into an artifact type and uses that classification to determine which controls it can validate.
## Common Artifact Types
VISO TRUST recognizes a wide range of artifact types, including:
| Artifact Type | Examples |
| ------------------------- | ----------------------------------------------------------- |
| SOC 2 Type II | AICPA SOC 2 audit reports |
| ISO 27001 | Certification and Statement of Applicability |
| Penetration Test | Third-party pen test reports |
| HITRUST | HITRUST CSF certification or validation report |
| PCI DSS | Attestation of Compliance (AOC), Report on Compliance (ROC) |
| Privacy Policy | Public-facing privacy policy documents |
| Data Processing Agreement | DPAs, data handling agreements |
| Sub-Processor List | List of sub-processors or subservicers |
| Cyber Insurance Policy | The vendor's cyber insurance policy |
| ISO 42001 | AI management system certification |
| Security Policy | Internal security policies shared by the vendor |
## How Classification Works
When an artifact is uploaded, VISO TRUST's AI:
1. Reads and analyzes the document content
2. Identifies the artifact type based on structure, language, and document characteristics
3. Maps the artifact to the relevant control domains it can validate
4. Flags the artifact's assurance level (high-assurance artifacts like SOC 2 carry more weight than self-attested documents)
For most artifacts, classification is fully automatic. High-assurance artifacts — SOC 2 reports, ISO certificates, third-party penetration tests — are routed through an additional auditor review step when the **AI Assessment + Auditor Review** method is configured.
## Artifact Assurance Hierarchy
Not all artifact types carry equal weight. Every artifact type has a numeric assurance value that maps to one of four levels — **Advanced**, **Standard**, **Moderate**, or **Limited** — shown as a four-dot meter wherever evidence appears. Assurance is the multiplier applied to a control's weight when VISO TRUST calculates how much risk the evidence removes. Each type's own level is listed in-platform under **Glossary → Artifact Types**, and the levels are defined in [Control Domains & Artifact Types](/risk-and-monitoring/control-domains#assurance-levels).
Broadly:
**Higher assurance:**
* Third-party audited reports (SOC 2, ISO 27001, HITRUST, PCI DSS)
* Third-party penetration tests
**Moderate assurance:**
* Vendor-completed questionnaires
* Data processing agreements
* Cyber insurance policies
**Lower assurance:**
* Self-attested policies
* Public compliance badges (partial credit only)
* Vendor-authored security summaries
When a higher-assurance artifact is available, it supersedes older or lower-assurance artifacts of the same type in the risk calculation.
## Artifact Validity Periods
Artifacts have validity periods — a SOC 2 report, for example, covers a specific audit period and expires after that window. VISO TRUST tracks artifact expiration and flags when artifacts are approaching their validity end date.
When an artifact expires:
* Its control coverage receives a lower assurance weighting
* Pending Changes are surfaced on the relationship to signal the gap
* If lifecycle management is enabled, VISO TRUST can automatically request updated documentation from the vendor
## Artifact Source Types
VISO TRUST tracks where each artifact came from and labels it in the artifact list as **Public** or **Private**:
| Source | Description |
| ----------- | ----------------------------------------------------------------------------------------------------------------------- |
| **Public** | Discovered from public sources (trust pages, websites, public repos) |
| **Private** | Uploaded by your team, submitted by the vendor through the collection portal, or sourced from VISO TRUST's own evidence |
The **Source** filter in the artifact list uses the same Public/Private options. Sorting the Source column still groups artifacts by who provided them, and source influences how the artifact is presented in the audit trail.
## Configuring Artifact Type Preferences
Admins and Program Managers can configure which artifact types to request by default in collection requests under **Settings → Assessments** (the **Required artifacts** section).
Whether publicly claimed compliance certifications count toward residual risk is a separate setting, managed under **Settings → Your Framework → Risk calculations**.
# Assessment Settings
Source: https://docs.visotrust.com/third-parties/advanced/assessment-settings
Set default assessment behavior in VISO TRUST at the organization, business unit, and relationship level for consistent and predictable automation.
Assessment settings let you define default behavior for how assessments are initiated, managed, and completed — across your entire organization or for individual relationships. Consistent defaults reduce repetitive configuration and ensure automation behaves predictably.
## Where to Configure Settings
Settings can be applied at three levels, from broadest to most specific:
| Level | Where to find it | Scope |
| ---------------- | -------------------------------------- | ------------------------------------------------ |
| **Organization** | Settings → Assessments | Applies to all relationships unless overridden |
| **Relationship** | Relationship → gear icon → Assessments | Applies to all assessments for this relationship |
| **Assessment** | Start assessment → Advanced Settings | Applies to this one collection request only |
More specific settings override broader ones. A relationship-level setting overrides the org default; an assessment-level setting overrides both.
Organization and relationship defaults also apply to assessments started by automation — such as scheduled recertifications and artifact update requests.
## Available Settings
### Instant Assessment (Organization level only)
When enabled, VISO TRUST automatically runs an instant assessment for every newly created relationship — analyzing publicly available data to generate an immediate risk profile. This setting can be toggled on or off per relationship at creation time.
### Collection Request Defaults
**Initial collection timeline** — how long the vendor has to respond before the request expires. Default is 30 days. Configurable per assessment via Advanced Settings.
**No-vendor-response behavior** — what happens when the collection deadline passes without a vendor response:
* **Notify me** — send an alert to the Business Owner and assessment creator
* **Close collection request** — automatically close the request when the deadline passes
**Automate follow-ups** — controls whether follow-up questionnaires are sent automatically when controls remain unvalidated:
* **Always ask before following up** — prompt the reviewer to decide whether to follow up after each assessment
* **Conditional based on residual risk** — automatically follow up when residual risk meets or exceeds a configured threshold (e.g., Medium)
* **Use assessment concierge service** — VISO TRUST manages the follow-up on your behalf
### Analysis Method
Controls whether submitted artifacts are reviewed by AI only, or by AI plus an expert auditor:
* **AI Assessment** — faster; uses Artifact Intelligence to analyze and map controls
* **AI Assessment + Auditor Review** — AI analysis is supplemented by a VISO TRUST analyst who reviews high-assurance artifacts (SOC 2 reports, ISO certificates, penetration tests, etc.) for qualified opinions, exceptions, and coverage gaps
The analysis method can be configured at the organization or relationship level and overridden per assessment.
### Follow-Up Questionnaire Timeline
How long the vendor has to respond to a follow-up questionnaire before it's considered expired (7, 14, 30, 60, or 90 days). Configurable at the organization and relationship level.
# Your Framework
Source: https://docs.visotrust.com/third-parties/advanced/custom-frameworks
Customize your VISO TRUST risk framework — intake questions, data classification, and risk calculations that determine assessment scope and scoring.
By default, VISO TRUST assesses vendors against its standard risk framework — grounded in NIST 800-53 and covering security, privacy, artificial intelligence, resilience, product security, cyber insurance, service locations, and subservicers. **Your Framework** lets you tailor that framework to your organization's requirements — adjusting the intake questions that scope controls, the data types you track, and how risk is calculated.
Your Framework is an add-on capability. If you don't see it in Settings, contact your Customer Success Manager to enable it. Editing the framework requires Admin or Program Manager access.
## How Your Framework Works
Unlike a per-relationship framework picker, VISO TRUST uses a single, organization-wide framework. Customizing it changes assessment scope and scoring for every relationship. Your Framework is organized into three tabs:
| Tab | What it controls |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Intake questionnaire** | The intake questions asked when configuring a relationship's context. Each question maps to the **controls in scope** it brings into an assessment. |
| **Data classification** | The data types your organization tracks and the **data sensitivity** level assigned to each — driving the impact side of risk scoring. |
| **Risk calculations** | How risk is calculated — risk tolerance thresholds and whether publicly claimed compliance certifications count toward residual risk. |
Evidence collected through assessments (artifacts, questionnaire responses, compliance attestations) is still analyzed by Artifact Intelligence and mapped to controls — the framework determines which controls are in scope and how they're weighted.
## Editing Your Framework
Your Framework is managed in **Settings → Your Framework**.
Go to **Settings → Your Framework** and select **Edit framework** to start a draft.
Work through the **Intake questionnaire**, **Data classification**, and **Risk calculations** tabs — editing intake questions and their controls in scope, adjusting data types and their sensitivity, and tuning risk calculations.
Your edits are saved as a draft. Select **Publish changes** to apply them across your organization, or **Discard draft** to revert.
## How the Framework Applies to Relationships
Because the framework is organization-wide, publishing changes updates the scope and scoring for all relationships. Each relationship's individual **Context** — its intake-questionnaire answers and data classification — is set per relationship in the **Relationship configuration** dialog, within the bounds your framework defines.
Changes take effect when you **Publish**. Review the impact on your portfolio after publishing, since re-scoping controls can shift risk scores.
# Data Types and Sensitivity Levels
Source: https://docs.visotrust.com/third-parties/advanced/data-types
How data types describe what information is shared with a vendor and drive the impact component of VISO TRUST's inherent risk score calculation.
**Data Types** represent the categories of information that may be shared with a vendor as part of a relationship. Selecting the right data types is one of the two inputs (along with business cases) that define relationship context — and they directly drive the **impact** component of risk scoring.
## What Data Types Do
Data types answer the question: *if this vendor were compromised, what's at stake?*
While business cases determine how a vendor interacts with your environment (exposure/likelihood), data types determine the potential severity if that exposure is realized (impact). Together, they produce the relationship's inherent risk score.
Data types determine impact only — they do **not** bring additional controls into scope. Business cases determine which controls are assessed.
## Data Sensitivity Levels
Each data type is assigned a sensitivity level that contributes to the impact score. VISO TRUST uses five levels, from lowest to highest impact:
1. **None**
2. **Minimal**
3. **Moderate**
4. **Elevated**
5. **Critical**
The more sensitive the data a vendor handles, the higher the impact — and the higher the resulting inherent risk. The specific data types your organization tracks, and the sensitivity level assigned to each, are configured in your framework's **Data classification** (see [Your Framework](/third-parties/advanced/custom-frameworks)).
Common data types include Monetary Assets, Authentication Credentials or Internal Encryption Keys, PCI (Payment Card Industry) Data, PHI (Protected Health Information), Sensitive PII, PII, Source Code, Vulnerabilities, Insider Information, Proprietary and Confidential Information, and Unrestricted Information. Higher-impact types — such as payment card data, authentication credentials, and monetary assets — carry the highest sensitivity, while unrestricted information carries the lowest.
## How to Select Data Types
When configuring relationship context, select all data types that may reasonably be shared with the vendor — not just what's contractually intended. Consider realistic operational access, not just the stated purpose of the relationship.
To set data types:
1. Open the relationship and select the **gear icon**
2. Go to **Context → Data Classification**
3. Select all applicable data types
To remove a data type from a relationship, return to **Context → Data Classification** and deselect it. The impact score updates immediately. The data type remains available in your framework for other relationships. To remove a data type from your organization's framework entirely, edit the data classification in [Your Framework](/third-parties/advanced/custom-frameworks).
The maximum sensitivity level across all selected data types drives the impact score. A relationship where a vendor handles both a low-sensitivity type and a high-sensitivity type is scored at the higher sensitivity level.
## Impact on Risk Scoring
Data sensitivity is expressed as a numeric value between 0 and 1 internally. Higher sensitivity data types produce a higher impact score, which in turn raises the inherent risk rating.
Inherent risk labels (No Context, Low, Medium, High, Extreme) reflect both the impact from data types and the likelihood from business cases. Changing data type selections updates the inherent risk score immediately.
See [Risk Scoring Overview](/risk-and-monitoring/risk-scoring) for a full explanation of how impact and likelihood combine into a risk score.
# Assessments
Source: https://docs.visotrust.com/third-parties/assessments
Create, track, and review vendor risk assessments in VISO TRUST — from instant assessments to artifact uploads and vendor collection requests.
An **assessment** is how VISO TRUST evaluates a vendor's security posture and produces a risk score. Assessments can run automatically, be initiated by you, or involve the vendor directly — depending on how much depth you need.
## Assessment Types
| Type | How it works | Vendor involved? |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
| **Instant Assessment** | Runs automatically when a relationship is created. VISO TRUST searches public sources for certifications, security pages, and audit reports. | No |
| **Artifact Upload** | You upload security documents directly (SOC 2, ISO 27001, pen test reports, etc.). VISO TRUST analyzes them immediately. | No |
| **Vendor Collection** | You send the vendor a collection request. They submit documentation through a secure portal. VISO TRUST analyzes submissions and optionally routes them through an auditor review. | Yes |
## Starting an Assessment
From any relationship, select **Start assessment** (or **Update assessment** if one already exists) to begin. To add documents without starting a new collection, use **Add information**.
### Request Artifacts from the Vendor
Send a collection request to the vendor's contact:
* **Ask for everything** — VISO TRUST requests all artifacts and questionnaire responses needed to satisfy in-scope controls
* **Request specific artifacts** — specify which document types you need (e.g., SOC 2, ISO 27001, pen test)
* **Request manual response** — send a questionnaire for the vendor to answer in writing
You can mix and match these options in a single collection request.
Use **Advanced Settings** when sending a collection request to configure follow-up timelines, response deadlines, and what happens if the vendor doesn't respond. These can also be set as defaults at the relationship or organization level.
### Upload Artifacts Directly
If you already have documentation, upload it directly without involving the vendor. VISO TRUST will classify the artifact type and begin analysis immediately. You can upload artifacts at any time, even alongside an active collection request.
### Conduct Research
VISO TRUST can automatically search public sources for the vendor — finding compliance attestations, publicly available artifacts, risk advisories, and other relevant data. This runs automatically for instant assessments and can be triggered manually at any time.
## Assessment Phases
Assessments move through a defined lifecycle. Understanding each phase helps you know what actions are available and what's happening behind the scenes.
| Phase | Description | Available actions |
| -------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------- |
| **Not Assessed** | No active assessment, and the vendor has no prior assessment | Start a new assessment |
| **Started** | A collection request has been sent; the vendor hasn't opened it yet | Close request, upload artifacts |
| **Collecting Information** | The vendor has opened the portal and started submitting | Close request |
| **Review Started** | VISO TRUST is reviewing submitted materials using AI (and auditor if configured) | Skip auditor review, close request |
| **Follow-Up Recommended** | Review is complete but additional information is needed | Send follow-up questionnaire, skip and complete |
| **Expired** | The collection deadline passed before the vendor submitted a response | Extend timeline, complete assessment |
| **Completed** | All submitted information has been reviewed; findings are ready | Review risk, accept risk, request remediation |
### Follow-Up Questionnaires
If controls remain unvalidated after initial review, VISO TRUST surfaces a follow-up questionnaire to request additional information from the vendor. You can configure this behavior in three ways:
* **Always ask before following up** — review results and decide whether to follow up
* **Conditional based on residual risk** — automatically follow up if residual risk meets a threshold (e.g., Medium or above)
* **Use assessment concierge service** — VISO TRUST manages the follow-up on your behalf
This setting can be configured at the assessment, relationship, or organization level.
## The Vendor Experience
When you send a collection request, the vendor receives an email with a secure link and a one-time passcode. Through the collection portal, they can:
1. Review what's being requested and access guidance on typical artifacts for each control
2. Upload documents (SOC 2, ISO 27001, pen tests, DPAs, etc.)
3. Answer questionnaires if requested
4. Forward the request to the right internal contact if needed
5. Certify and submit their response when complete
After submission, VISO TRUST processes the artifacts using AI to classify, analyze, and map findings to your control framework.
For a step-by-step walkthrough of the collection portal, including forwarding the request, requesting more time, and opting out, see [The Vendor Experience](/trust-and-questionnaires/questionnaire-answering#the-vendor-experience).
### Collection Timelines and Reminders
The default collection window is **30 days**. VISO TRUST sends reminders automatically:
* Internal recipients (the Business Owner, Assessment Lead, Subscribers, and the assessment creator): every 5 business days
* Vendor contacts: every 3 days, with a final notice 3 days before the deadline
You can toggle each internal recipient on or off for the **Assessment reminder** notification in the settings matrix under **Settings → Org Profile → Notifications**. See [Notifications & Alerts](/risk-and-monitoring/notifications#notification-types).
You can extend the collection timeline at any time while an assessment is in the **Collecting Information** phase. There's no limit on extensions.
If the vendor doesn't respond by the deadline, the assessment moves to the **Expired** phase. What happens next depends on the **No-vendor-response** setting configured under [Assessment Settings](/third-parties/advanced/assessment-settings):
* **Notify me** — the assessment stays in the **Expired** phase and shows an *Assessment expired* banner on the timeline. From the **Take action** menu, select:
* **Extend timeline** — return the assessment to **Collecting Information** with a new deadline, giving the vendor more time to submit
* **Complete assessment** — close the collection request and move the assessment to **Completed** using whatever evidence has been gathered so far
* **Close collection request** — VISO TRUST automatically completes the assessment. The timeline records an **Expired** node before **Completed** so you can see why the collection ended.
On the Relationships list, expired assessments show an **Expired** phase chip, and you can filter the list by that phase. Expired assessment events also appear in the relationship's audit log and activity feed.
## Sub-Processor Collection
When the Privacy risk dimension is in scope, VISO TRUST prompts vendors to provide a list of their sub-processors — third parties that process personal data on your behalf. Sub-processors are displayed in the risk analysis on the relationship's **Assessments** tab and mapped in the relationship's graph view for nth-party visibility.
In the risk analysis, the collected list appears as a table under the **Sub-Processor List** control, showing each company, its purpose, and its location of processing. A collected list counts as full-assurance evidence, so VISO TRUST treats the Sub-Processor List control as fully mitigated once the vendor provides it.
## Reviewing and Acting on Results
When an assessment reaches **Completed** status, a **Review risk** action becomes available — indicating that findings are ready and your team needs to record a decision.
### Review Risk Actions
| Action | What it does |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Accept Risk** | Records that your organization accepts the residual risk based on current findings. Closes the review. |
| **Override Risk** | Manually sets a different inherent or residual risk value — used when compensating controls exist that aren't fully reflected in the model, or when context isn't appropriately captured. |
| **Request Remediation** | Sends a remediation request to the vendor identifying specific control gaps. You set a target date for resolution. |
| **Add review note** | Records an optional note with your decision on the relationship history — useful for executive approvals or audit trail context. |
Once a remediation request is sent and the vendor responds, VISO TRUST automatically starts a new assessment update and returns the relationship to **Review Risk** for re-evaluation.
## Viewing Past Assessments
The **Assessments** tab holds the relationship's assessment history — every assessment except cancelled ones. Use the selector at the top of the tab to switch between them; the risk analysis, control evidence, and summary below it all update to the assessment you pick.
Each assessment is a snapshot. Selecting an older one shows the evidence and scores as they stood when it completed, not today's picture, so you can see exactly what a past decision was based on. See [Risk Analysis](/risk-and-monitoring/risk-analysis) for how to read it.
## Assessment Completion
An assessment is marked **Completed** when:
* All submitted artifacts and questionnaire responses have been analyzed
* Any follow-up questionnaire has been responded to, skipped, or determined unnecessary
* An assessment summary has been generated
Completion does not mean no action is required — you still need to review risk and record a decision.
### If Summary Generation Fails
If the assessment summary fails to generate, the latest assessment shows a "We couldn't generate this summary" alert. When a previous summary exists it remains visible below the alert until a new one is generated. Select **Try again** to regenerate the summary from the current assessment data — the action is available to the relationship's business owner, the assessment lead, and admins. If generation keeps failing, contact [support@visotrust.com](mailto:support@visotrust.com).
## Lifecycle Management
For onboarded relationships, VISO TRUST can automate ongoing vendor management:
**Artifact Validity** — VISO TRUST tracks when artifacts expire and alerts you (or automatically contacts the vendor) 30 days before expiration to request updated documentation.
**Relationship Recertification** — schedule recurring reassessments on a cadence you define (e.g., annually). VISO TRUST sends reminders when it's time to recertify and can initiate the collection process automatically.
Lifecycle management settings are in the relationship's **Relationship configuration** dialog (gear icon) under **Onboarding and lifecycle management**.
# Bulk Import Vendor Relationships from CSV
Source: https://docs.visotrust.com/third-parties/bulk-import
Use CSV bulk import in VISO TRUST to add many vendor relationships at once, with templates for new relationships or migrating existing assessment data.
**Bulk Import** lets you create a large number of relationships at once — instead of adding each vendor through the relationship wizard individually. You can also import existing relationships with prior assessment data preserved.
## Choosing a Template
From **Settings → Import Relationships**, download one of two CSV templates:
| Template | Use when |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **New Relationship** | You haven't assessed these vendors in VISO TRUST before. Excludes legacy assessment fields. |
| **Existing Relationship** | You've already assessed these vendors elsewhere and want to preserve prior assessment data. Includes additional legacy assessment fields. |
The downloaded template includes one example row. Delete it before adding your own data.
## Upload Rules
Before uploading your CSV, review these requirements:
* Do **not** rename column headers — the importer matches columns by header text (including the `(Required)` / `(Optional)` marker). Matching ignores case and surrounding whitespace.
* Complete every column marked **(Required)**
* You may delete Data Type and Business Context columns you don't need — a missing column is treated as `No` for every row
* Columns the importer doesn't recognize are rejected with an error naming the unknown column
* Paste values only — formulas are not supported
* **Business Unit** values are matched case-insensitively and must either match an existing Business Unit in your org or be spelled consistently throughout the file (VISO TRUST will create it on import)
* All Yes/No columns accept `Yes`, `No`, or blank — blank is treated as `No`
## Column Reference
Both templates share a common set of columns. The **Existing Relationship** template adds the legacy assessment columns described below. Header text includes a `(Required)` or `(Optional)` marker — leave it exactly as generated.
### Relationship & Contact Columns
VISO TRUST records the user who runs the import as the creator of each relationship. Templates downloaded before this column was retired may still include a `Client Username` column — it's accepted and ignored.
| Column header | Description | Required? |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| External ID | Reference ID from your own system (e.g., GRC tool) | Optional |
| Vendor Name | Legal or commonly used name of the third party | Required |
| Vendor Description | Short description of the product, service, or relationship purpose | Optional |
| Vendor Website | Vendor's primary URL | Required |
| Vendor Industry | Industry classification | Optional |
| Product/Service | Name of the specific product or service the vendor provides. Matched case-insensitively against existing products for that vendor in your org; a new product is created if none matches. Maximum 255 characters. | Optional |
| Business Owner Email Address | Email of the internal Business Owner | Required |
| Business Owner First Name | Business Owner's first name | Required |
| Business Owner Last Name | Business Owner's last name | Required |
| Business Owner Business Unit | Department the Business Owner belongs to (e.g., Engineering, IT, InfoSec) | Required |
| Assessment Lead Email Address | Email of the internal Assessment Lead | Optional |
| Assessment Lead First Name | Assessment Lead's first name | Optional |
| Assessment Lead Last Name | Assessment Lead's last name | Optional |
| Assessment Lead Business Unit | Department the Assessment Lead belongs to | Optional |
| Primary Third Party Contact Email Address | Vendor-side primary contact email | Optional |
| Primary Third Party Contact First Name | Vendor-side contact first name | Optional |
| Primary Third Party Contact Last Name | Vendor-side contact last name | Optional |
| Tag(s) | Comma-separated list of tags to apply | Optional |
| Tier | Vendor tier (1–5) | Optional |
### Data Type Columns
The template includes one **`Data Type - `** column for every data type enabled in your organization's data type configuration (for example, `Data Type - PCI (Payment Card Industry) Data`). This includes custom data types you've added, and excludes default data types you've disabled. Enter `Yes`, `No`, or leave blank for each.
Data Type columns are optional. If you delete one, every imported relationship is treated as `No` for that data type. Templates downloaded before a data type configuration change still upload — disabled and default data types remain recognized.
### Business Context Columns
The template also includes one Yes/No column for each intake (business context) question configured for your organization. Together with data types, these determine the business cases and controls brought into scope. Like Data Type columns, these are optional — a deleted column is treated as `No`.
### Legacy Assessment Columns
The **Existing Relationship** template adds the following columns to preserve prior assessment data (all required in that template):
* (Legacy) Assessment Start Date
* (Legacy) Assessment Completion Date
* (Legacy) Assessment Review Frequency
* (Legacy) Assessment Recertification Type
* (Legacy) Automatic Artifact Updates
* (Legacy) Assessment Inherent Risk
* (Legacy) Assessment Residual Risk
## After Import
Once uploaded, VISO TRUST validates the file and reports any errors before creating relationships. Fix any flagged rows and re-upload if needed.
When you start the import, it runs as a background job:
* You can leave the page or close the tab. The import keeps running, and VISO TRUST emails you whether it succeeds or fails. Both notifications can be turned off under **Notification settings → Relationship Management**.
* The import page shows live progress, such as "Imported 120 of 500 relationships". The **History** tab also lists in-progress imports with their counts.
* Only one import can run at a time per organization. Wait for the current import to finish before starting another.
If an import stops before finishing, the relationships already imported are created and unaffected. Imports do not resume. To bring in the rest, upload a new file containing only the rows that did not import.
If **Instant Assessment** is enabled at the organization level, newly imported relationships will automatically be assessed using publicly available data.
For large imports, start with a small test batch (10–20 rows) to validate your column formatting before uploading your full list.
# Business Units
Source: https://docs.visotrust.com/third-parties/business-units
Group vendor relationships by business unit in VISO TRUST to scope Risk Insights dashboards, clarify ownership, and filter views across large portfolios.
**Business Units** let you organize vendor relationships by the internal team or department that owns them. They're a core organizational layer in VISO TRUST — enabling filtered views, scoped reporting, and clear ownership across large vendor portfolios.
## What Business Units Do
Business Units are used to:
* Group relationships by the department responsible for the vendor relationship (e.g., Engineering, Finance, Legal, IT)
* Scope Risk Insights dashboards to a specific unit
* Filter the Relationships list by owning team
* Segment reporting for program-level visibility
Every Business Owner in VISO TRUST belongs to a Business Unit. When you assign a Business Owner to a relationship, that relationship is associated with their Business Unit.
## Creating a Business Unit
Business Units are created in **Settings → Business Units**.
1. Select **Add Business Unit**
2. Enter a name (e.g., "Engineering", "Procurement", "Legal")
3. Save
Business Unit names are matched **case-insensitively**, so `Engineering` and `engineering` resolve to the same unit. Spelling must still be consistent — especially when using bulk import — because a misspelling creates a separate Business Unit.
## Assigning Relationships to Business Units
Relationships are associated with a Business Unit through their **Business Owner**. To change which Business Unit a relationship belongs to, update the Business Owner or reassign the Business Owner to a different Business Unit.
When importing relationships via CSV, the `Business Owner Business Unit` column determines the assignment. If the Business Unit doesn't exist yet, VISO TRUST creates it on import — as long as the name is spelled consistently throughout the file.
## Filtering by Business Unit
On the Relationships list page, use the **Business Unit** filter to view only the relationships that belong to a specific team. This is useful for:
* Team-specific program reviews
* Business Unit-level risk reporting
* Identifying coverage gaps within a department
## Business Units and Risk Insights
When Risk Insights dashboards are available, you can filter metrics by Business Unit to see risk distribution, assessment coverage, and vendor counts scoped to a specific team. This gives Business Unit leads a focused view of their own risk posture without needing access to the full program.
# Manage Third-Party Vendor Relationships
Source: https://docs.visotrust.com/third-parties/relationships
Add, edit, tag, and offboard third-party vendor relationships in VISO TRUST — the central record that anchors every assessment, score, and advisory.
A **relationship** is your record of a business connection with a third-party vendor. Every assessment, risk score, advisory, artifact, and audit trail in VISO TRUST lives under a relationship. Managing your relationships well is the foundation of your TPRM program.
## Adding a Relationship
Go to **Third Parties → Relationships** in the left sidebar and select **Add relationship**.
Type the vendor's name in the search field. VISO TRUST searches its directory of thousands of known organizations.
If the vendor isn't in the directory, select **Create new third-party organization** at the bottom of the results and enter the vendor's name and website URL.
Risk analysis is significantly more accurate when a vendor website is provided. Always include the URL if you have it.
Select the internal team member who will own this relationship. The Business Owner manages assessments, responds to advisories, and receives notifications for this vendor. You can assign an existing user or invite a new one.
Write 1–3 sentences describing how your organization uses this vendor — what they provide, how your team engages with them, and what systems or data may be involved. This helps VISO TRUST predict the right risk context and is visible only to internal users, not the vendor.
* **Relationship name** — customize to differentiate this relationship from others with the same vendor
* **Tags** — add labels to organize and filter the relationship (see [Tags](/organization-settings/tags))
* **Tier** (optional) — assign the vendor to a priority tier (see [Vendor Tiers](/organization-settings/tiers))
Leave **Predict relationship context and instantly assess** checked to have VISO TRUST immediately analyze the vendor using publicly available data. This gives you a risk score within seconds of creating the relationship, with no vendor involvement required.
To disable instant assessment by default for all new relationships, go to **Settings → Assessments**.
## Configuring Relationship Context
Context defines the threat surface and controls in scope for a relationship. It's made up of two components:
**Business Cases** — how your organization engages with the vendor. Examples: SaaS provider, payment processor, IT support. Each selected business case brings relevant security controls into scope for the assessment.
**Data Types** — what information is shared with the vendor. Examples: Customer PII, financial data, internal business data. Data types determine data sensitivity and drive impact scoring.
Together, these two inputs define the relationship's inherent risk and the controls that need to be assessed.
To configure context:
1. Open the relationship and select the **gear icon** in the relationship header
2. Navigate to **Context**
3. Select the relevant business cases and data types
Use the **Predict context** button to have VISO TRUST suggest business cases and data types based on the vendor's profile and the business purpose you entered. You can accept, adjust, or override the suggestion.
Context can be updated at any time. VISO TRUST will flag when context may need attention as a relationship evolves.
## Products & Services Scoping
When a vendor offers multiple distinct products or services, you can create a separate relationship for each one. Each relationship has its own assessment context — so artifacts and risk findings are scoped to the specific product being assessed rather than the vendor as a whole.
This is especially useful for large platforms (cloud providers, productivity suites, AI tools) where different products carry meaningfully different risks.
Vendor-level metadata (company details, profile information) is shared across all relationships with the same organization, so you don't need to duplicate it.
## Tags
Tags are labels you apply to relationships for filtering and organization. Use them to group vendors by category, program phase, team ownership, or any other dimension that fits your workflow.
Tags are available as filters on the Relationships list page and on individual relationship detail pages.
To manage your organization's tag library, go to **Settings → Tags**.
## Vendor Tiers
Vendor Tiers let you group relationships into up to five priority tiers for portfolio-level oversight. Tiers are useful for defining treatment standards, reporting segmentation, and prioritization criteria.
Tiers are configured in **Settings → Tiers**, where you choose how many tiers your program uses and describe each one. See [Vendor Tiers](/organization-settings/tiers) for the full setup.
To assign relationships to a tier, either select them on the Relationships list page and use the **Move tier** action, or open a single relationship's **Relationship configuration** dialog and pick a tier under **Tier**.
## Saved Filters
Saved filters let you store a filter selection on the Relationships list page and reapply it with one click. Use them for views you return to often, such as a specific tier, business owner, or tag combination.
Saved filters are stored on your VISO TRUST account, so they're available from any browser or device you sign in from. Filters you previously saved in your browser are moved to your account automatically the first time you open the Relationships page.
To save a filter:
1. Open the filter panel on the Relationships list page and select your criteria
2. Choose whether relationships must match **all** criteria or **any** of them
3. Open the **Saved filters** menu and select **Save current selection**
4. Enter a name and save
To apply a saved filter, open the **Saved filters** menu and select it. To delete one, expand the **Saved filters** section in the filter panel and select the delete icon next to it.
If a tag, tier, business unit, or user referenced by a saved filter is later deleted, VISO TRUST removes that criterion from the filter automatically.
## Bulk Actions on Relationships
Select multiple relationships on the Relationships list page to apply changes across them at once. The toolbar exposes four bulk actions:
* **Move tier** — assign the selected relationships to a Vendor Tier (Admin only).
* **Assign assessment lead** — set the Assessment Lead on the selected relationships.
* **Assign business owner** — set the Business Owner on the selected relationships. Only existing users can be selected in bulk; use the individual relationship dialog if you need to invite a new user.
* **Manage subscribers** — add or remove Subscribers across the selected relationships in one operation.
Assessment lead, business owner, and subscriber bulk actions are available to Admins and to any Contributor who is already the Business Owner or Assessment Lead on every selected relationship. Move tier remains Admin-only.
Large selections are processed in the background. The first batch applies immediately; the remainder continues asynchronously, and you'll receive an in-app notification when the job completes. Assigning a new Business Owner also cascades the owner's business unit and recomputes risk on each affected relationship.
## Exporting Relationship Data
You can download CSV exports of your relationship data from the Relationships list page. Open the **⋮** (more options) menu next to the view toggle and select an export:
* **Export relationships** — one row per relationship, including status, inherent and residual risk, assessment phase and dates, business owner, tags, tier, and security ratings.
* **Export nth parties** — one row for each relationship and nth-party pair, with **Relationship ID**, **Relationship**, and **Nth party** columns. An nth party is a subservicer or technology provider your direct vendor relies on, surfaced through the Risk Network.
Both exports respect the filters currently applied to the page, so the file matches what you see on screen. Use the nth-party export to find every vendor in your program that depends on a given subservicer, for example when responding to a supply-chain advisory.
If no nth parties match your current filters, VISO TRUST shows a notification instead of downloading an empty file.
## Pending Changes
**Pending Changes** appear on a relationship when new information exists that isn't yet reflected in the current assessment summary. Common causes include:
* Controls were added to or removed from scope due to a context update
* New artifacts were discovered via public search
* Existing artifacts expired
* New risk advisories were detected
* Supplemental questionnaires were added to the relationship
* The risk model was updated after the relationship's last completed assessment, so current scores may shift
Pending changes don't require immediate action — they'll be incorporated the next time an assessment update runs. To resolve them immediately, initiate a public search from the relationship.
## Relationship Lifecycle
Relationships can be **onboarded** to include the vendor in Risk Insights dashboards and enable lifecycle management features like recertification scheduling and automatic artifact renewal.
To onboard a relationship, open its **Relationship configuration** dialog (gear icon), go to **Onboarding and lifecycle management**, and set the status to **Onboarded**.
See [Assessments](/third-parties/assessments) for details on lifecycle management, recertification, and archive behavior.
# Vendor Directory
Source: https://docs.visotrust.com/third-parties/vendor-directory
Browse and search the VISO TRUST vendor directory — a catalog of pre-populated third-party profiles that speed up instant assessments and onboarding.
The **Vendor Directory** is VISO TRUST's catalog of known third-party organizations. It contains pre-populated company profiles that help VISO TRUST build more accurate instant assessments — faster and with less manual input.
## What the Directory Contains
Each directory entry includes:
* Company name, website, and primary domain(s)
* Industry classification
* Headquarters location and company size
* Known compliance certifications (SOC 2, ISO 27001, etc.)
VISO TRUST uses this information to pre-populate vendor profiles when you create a relationship and to seed instant assessments with publicly available intelligence.
## Searching the Directory
The directory is accessible when you **Add a Relationship**. Type the vendor's name into the search field and VISO TRUST will suggest matches from the directory.
When you select a vendor from the directory:
* Company details are automatically populated in the relationship
* VISO TRUST can immediately offer to **predict relationship context** based on the vendor's profile
* Instant assessment runs with richer starting data than an unknown vendor
## When a Vendor Isn't in the Directory
If you search and don't find the vendor, select **Create new third-party organization** at the bottom of the search results. Enter the vendor's name and website URL.
Providing a website URL for vendors not in the directory is important. Without a URL, VISO TRUST has limited ability to conduct a public research assessment and the risk analysis will be less predictive.
Once you create a new vendor entry, VISO TRUST will begin building a profile for that organization using publicly available information.
## Public Artifacts and Certifications
When VISO TRUST finds publicly available evidence for a vendor — security pages, compliance badges, trust portals, public audit summaries — it uses that evidence to derive initial control coverage:
* **Publicly available artifacts** (full documents VISO TRUST can access): counted as present controls with full confidence
* **Compliance certifications** (certification badges claimed on the vendor's website): counted as partial coverage — lower assurance than a validated report
To get full credit and higher confidence, request the actual certification document (e.g., the SOC 2 report) from the vendor.
You can control whether publicly claimed compliance certifications influence residual risk scoring. Go to **Settings** to manage this preference.
# Vendor Discovery
Source: https://docs.visotrust.com/third-parties/vendor-discovery
Vendor Discovery uses AI to extract sub-processors and subservicers from your Trust Profile artifacts so you can find and onboard vendors you aren't tracking.
**Vendor Discovery** automatically surfaces third-party vendors that are referenced in your organization's security artifacts — helping you find vendors you may not be tracking yet. It's built on VISO TRUST's subservicer extraction capability, which identifies sub-processors and service providers mentioned in uploaded documents.
## How Vendors Are Discovered
Vendors appear in Vendor Discovery when they are extracted from artifacts uploaded to your **Trust Profile**. VISO TRUST's AI analyzes these documents and identifies references to third-party organizations — pulling in vendors mentioned as sub-processors, subservicers, or technology partners.
To get started with Vendor Discovery:
1. Go to **Trust → Knowledge base** and upload your organization's security artifacts (e.g., SOC 2 reports, DPAs, sub-processor disclosure statements)
2. VISO TRUST analyzes these artifacts and identifies referenced third parties
3. Discovered vendors appear in the Vendor Discovery table
Artifacts uploaded to your Trust Profile are not shared with anyone outside your VISO TRUST instance.
## Browsing Discovered Vendors
Navigate to **Third Parties → Vendor Discovery** in the left sidebar to see your discovered vendor table.
Use the filter at the top right to toggle between:
* **Pending** (default) — vendors that don't yet have a relationship in your directory
* **All** — every discovered vendor, including those already added
Each row shows the vendor and a link to the artifact where they were detected.
## Adding Relationships from Vendor Discovery
You can add relationships directly from the discovery table without going through the Add Relationship flow:
| Option | How it works |
| -------------- | ------------------------------------------------------------------------------------------------------------------------- |
| **Inline add** | Select **Add** on a single row to create one relationship |
| **Bulk add** | Check the boxes for specific vendors (or use **Select all** to select every vendor), then select **Add selected vendors** |
Once added, relationships go through the standard creation flow — including instant assessment if enabled.
## FAQ
**How are vendors discovered?**
Vendors are extracted from subservicer data found in uploaded artifacts. VISO TRUST's AI parses and matches entity names from your documents against known organization profiles.
**What counts as a "new" vendor?**
A vendor is new if there is no existing relationship for that organization in your directory.
**Can I undo a relationship after adding it from discovery?**
Yes — manage or delete the relationship through the standard relationship management flow.
# Answer Inbound Questionnaires
Source: https://docs.visotrust.com/trust-and-questionnaires/answer-inbound-questionnaires
Upload or paste customer questionnaires into your Trust Profile and have Artifact Intelligence answer them from your Knowledge base.
When a customer or prospect sends you a security questionnaire, you can answer it in your Trust Profile instead of filling it out by hand. Upload the file — or paste the questions — and Artifact Intelligence drafts an answer to each question using the documents in your Knowledge base.
Answers include a confidence score and source citations, so you can quickly review, edit, and export the completed questionnaire.
## When to Use It
Use this workflow when a customer sends you a questionnaire directly (e.g., a spreadsheet emailed by a prospect) rather than through a VISO TRUST collection request. Typical inputs:
* A vendor security questionnaire from a prospect
* A CAIQ, SIG, or custom spreadsheet
* A short list of ad-hoc questions you want answered from your existing documentation
For customer assessments sent through VISO TRUST, questionnaires are answered automatically — see [Answering Questionnaires](/trust-and-questionnaires/questionnaire-answering).
## Prerequisites
* A [Trust Profile](/trust-and-questionnaires/trust-profiles) with artifacts uploaded to the **Knowledge base** tab
* Artifacts have finished processing — quality of answers depends on what's available in your Knowledge base
* The **Admin** or **Program Manager** role — the Trust section isn't available to Contributors or Viewers
## Adding a Questionnaire
Navigate to **Trust → Questionnaire answering**, then select one of two options from **Add questions**.
### Upload a File
Accepted file types: `.xlsx`, `.xls`, `.xlsm`, `.csv`. Maximum size: 100 MB.
VISO TRUST extracts questions from the file and lists the questionnaire in the table with a **Processing** status. Question count appears as answers are generated (e.g., **12 / 40**).
Once parsing finishes, select the questionnaire name to open the answer view.
### Paste Questions
A dialog opens with a text area.
Enter one question per line, or separate them with commas. A live count shows how many questions were detected.
The pasted set is added to the table alongside uploaded questionnaires.
## Reviewing Answers
Open a questionnaire to see the full answer table. Filter toggles at the top let you narrow the view to **All**, **Answered**, **Needs attention**, or **Unable to answer**. A **Processing** indicator appears while remaining answers are being generated.
Each row includes:
* **Status** — Answered, Needs attention, Unable to answer, or Processing
* **Question** — the extracted question text
* **Answer** — the AI-generated response
* **Confidence** — how strongly the supporting evidence matches the question
### Statuses
| Status | Meaning |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ |
| **Answered** | High-confidence AI answer, an AI answer you accepted, or an answer you wrote or edited yourself. |
| **Needs attention** | Low-confidence AI answer — review it, then either accept it or edit it. |
| **Unable to answer** | The AI could not find supporting evidence in your Knowledge base. Add an answer manually or upload more documents. |
| **Processing** | The answer is still being generated. |
### Source Citations
For every AI answer, select **View source citation** to expand the supporting evidence. Each citation shows the quoted snippet, the source document name, and the page number when available. Use this to verify an answer before accepting it.
### Accepting or Editing an Answer
For rows in **Needs attention**, you have two ways to move the row to **Answered**:
* Select the check-mark **Mark answer as good** button next to the answer to accept the AI response as-is.
* Select the edit icon to modify the wording, then save.
Edited answers are marked as user-authored and no longer show the citation. Select **Revert to AI answer** to restore the original response.
For questions marked **Unable to answer**, select the edit icon to type an answer manually — saving it moves the row to **Answered**.
## Renaming a Questionnaire
By default, uploaded questionnaires use the file name and pasted questionnaires use `Pasted Questions `. To rename one, open the questionnaire and select the edit icon next to the title.
## Exporting Answers
From the questionnaire detail page, select **Download CSV** to export every question, answer, status, confidence score, and source citation. Use the export to return the completed questionnaire to the requesting customer.
Each AI answer includes its source citations in a **Source** column, formatted as `fileName (p.N)`. When an answer has more than one citation, the first appears on the answer's row and each additional source is written on its own row below it. Manually-authored answers have no source column populated, matching the detail view where citations are hidden once you supply your own answer.
## Improving Answer Quality
Answer quality depends on what's in your Knowledge base. If too many questions come back as **Unable to answer** or **Needs attention**, or confidence scores are consistently low:
* Add missing documents (policies, SOC 2, DPAs, sub-processor lists) to the **Knowledge base** tab
* Replace outdated artifacts so the AI doesn't cite expired evidence
* Include URLs to your public security and privacy pages
See [Trust Profiles](/trust-and-questionnaires/trust-profiles) for guidance on keeping your Knowledge base current.
# Artifact Intelligence
Source: https://docs.visotrust.com/trust-and-questionnaires/artifact-intelligence
Artifact Intelligence is VISO TRUST's AI engine that reads SOC 2, ISO 27001, and other security documents to extract control evidence and set assurance.
**Artifact Intelligence** is VISO TRUST's AI document analysis engine. It reads security and compliance documents, extracts evidence of security controls, and maps findings to your risk framework — automatically, in a fraction of the time a human analyst would take.
Every artifact processed in VISO TRUST — whether uploaded by you, submitted by a vendor, or discovered from public sources — passes through Artifact Intelligence.
## What Artifact Intelligence Does
When an artifact is submitted, Artifact Intelligence:
1. **Classifies the document** — identifies the artifact type (SOC 2 Type II, ISO 27001, penetration test, DPA, etc.)
2. **Extracts evidence** — reads the document and identifies language that describes security controls and practices
3. **Maps to controls** — matches extracted evidence to the relevant controls in your risk framework
4. **Assigns assurance** — rates the confidence level of each detection based on the artifact type and evidence quality
5. **Identifies gaps** — flags in-scope controls that aren't addressed by the submitted evidence
This process happens in seconds for most documents. The results appear directly in the assessment's risk analysis as credited controls, coverage metrics, and any remaining gaps.
## Assurance Levels
Not all documents carry equal weight. Artifact Intelligence assigns an **assurance level** to each artifact based on how rigorous and trustworthy the evidence is.
| Assurance Level | Description | Examples |
| --------------- | ----------------------------------------------------------------------------------- | -------------------------------------------------------------------- |
| **Advanced** | Rigorous independent third-party assessments with high confidence in implementation | ISO 27001, SOC 2 Type II, PCI DSS AOC/ROC, HITRUST r2 |
| **Standard** | Third-party audited or externally validated, but narrower in scope | SOC 1 Type II, HITRUST i1 |
| **Moderate** | Independent review of control design, or a lighter-weight certification | SOC 2 Type I, SOC 1 Type I, HITRUST e1 |
| **Limited** | Self-attested or vendor-authored — useful for coverage but taken at face value | Vendor questionnaires, privacy policies, security overview documents |
Each artifact type's own level is listed in-platform under **Glossary → Artifact Types**.
Assurance is also refined at the individual detection level. Evidence that only describes a control without testing it, evidence from an expired artifact, or evidence an auditor has manually downgraded all fall back to Limited assurance — the risk analysis labels the reason next to the detection.
## AI Assessment + Auditor Review
For assessments using the **AI Assessment + Auditor Review** method, Artifact Intelligence is supplemented by a VISO TRUST analyst who performs a focused review of high-assurance artifacts. Auditors look for things that require human judgment:
* **Qualified opinions or exceptions** in SOC 2 reports
* **Open critical or high findings** in penetration test reports
* **HITRUST validity dates** and certification scope
* **Subservice organizations and CUECs** (complementary user entity controls) in SOC 2 reports
* **Password-protected or confidential artifacts** that require manual handling
Auditor findings supplement AI detections — they don't replace them. If the AI detects a control as Present, an auditor may downgrade it to Not Present based on a qualified opinion. If the AI misses a relevant control, an auditor may add it.
AI analysis alone does not guarantee detection of every control in every artifact. For critical vendors or high-risk relationships, the AI Assessment + Auditor Review method provides the highest confidence in results.
## What Happens After Analysis
Once analysis is complete:
* **Credited controls** appear as Present in the risk analysis with the artifact as supporting evidence
* **Control gaps** appear as No Information — primary candidates for follow-up questionnaires or additional document requests
* **The residual risk score** updates to reflect the new evidence
* **The artifact** appears in the Artifacts tab with its classification, assurance level, and validity period
If control gaps remain after analysis, VISO TRUST surfaces a **follow-up questionnaire** recommendation — allowing you to ask the vendor directly about specific controls that weren't addressed by submitted documents.
## Artifact Validity
Every artifact has a validity period reflecting how long the document is considered current. SOC 2 reports typically cover a 12-month audit period; ISO 27001 certificates are valid for 3 years. Artifact Intelligence identifies the validity window during analysis and tracks expiration.
When an artifact expires:
* Its assurance drops to Limited, and detections from it are labeled **Artifact expired**
* Pending Changes are surfaced on the relationship
* If lifecycle management is enabled, VISO TRUST can automatically request a renewal from the vendor
## Managing Artifacts
All artifacts for a relationship are visible in the **Artifacts tab** of the relationship detail page. From here you can:
* View artifact classification, source, assurance level, and validity period
* Download artifacts
* Delete artifacts (subject to your role's permissions)
* Add new artifacts at any time — even on an active or completed assessment
* Exclude artifacts from the risk analysis, or re-include ones previously excluded
To correct a misclassified artifact type, go to **Trust → Artifact Intelligence** and change the artifact's **Artifact Type** there. The Trust section is available to Admins and Program Managers.
### Excluding Artifacts from Risk Analysis
Not every collected artifact belongs in the risk analysis. A document may be superseded by a newer one, duplicated, incomplete or unreadable, or irrelevant to the vendor or the assessment scope. Select the artifact in the Artifacts tab and select **Exclude from analysis** to remove it. Excluding an artifact removes its detections from the risk analysis, which can affect control coverage and risk calculations.
The exclude dialog asks for a reason and an optional comment. Both are posted to the relationship's activity feed, under **Activity → All activity**, so your team can see who excluded the artifact and why.
Excluded artifacts are also left out of the assessment summary. The existing summary doesn't update on its own: regenerate the assessment summary after excluding an artifact to see it removed there.
Excluded artifacts stay in the artifact list. Use the **Excluded artifacts** visibility filter to find them, and select **Include in analysis** to bring one back into the risk analysis.
### Artifact Sources
The **Source** column in the artifact list labels each artifact as **Public** or **Private**:
* **Public** — discovered by VISO TRUST through public research (trust pages, websites, other public sources)
* **Private** — everything else: artifacts uploaded by your team, submitted by the vendor through the collection portal, or sourced from VISO TRUST's own evidence
The icon, tooltip, and **Source** filter all reflect this same Public/Private distinction. Private artifacts show a lock icon. Sorting the Source column still groups artifacts by who provided them, so vendor-submitted and team-uploaded artifacts stay separated even though both are labeled Private.
## Presumed Artifacts
When a vendor claims a compliance certification but no actual document has been collected, VISO TRUST creates a **presumed artifact** as a placeholder for that certification — for example, *Presumed SOC 2 Type 2*. Presumed artifacts give the claimed certification partial credit in the risk analysis until the real document arrives.
In the artifact list, presumed artifacts:
* Appear for all roles alongside regular artifacts, subject to the same filters
* Match the **Presumed** option in the **Type** filter menu — and only that option, so file artifact type filters like Third Party Audit exclude them
* Can't be opened or downloaded, because there is no document behind them
* Show a Source tooltip identifying them as presumed from compliance certifications on the trust profile
In [risk analysis](/risk-and-monitoring/risk-analysis), detections from a presumed artifact are titled with the audit report type followed by **Attestation** — for example, *SOC 2 Type 2 Attestation*. The card shows no quoted passage, and its **Compliance attestation** badge carries a tooltip explaining that the control is likely present based on evidence of compliance certification.
When a real artifact of the same audit type is added, it supersedes the presumed artifact automatically. If that real artifact is later removed, the presumed artifact is restored.
### If a Presumed Artifact Is Missing
Presumed artifacts are created automatically from compliance certifications on the vendor's trust profile. You can't add one manually.
If a vendor claims a certification but no presumed artifact appears in the artifact list:
1. Check the **Type** filter in the Artifacts tab and select **Presumed** — presumed artifacts are excluded by file artifact type filters like Third Party Audit.
2. Request the actual certification report through a collection request, or upload the document yourself from the Artifacts tab. A real artifact gives full credit and doesn't depend on a presumed placeholder. See [Attestations](/trust-and-questionnaires/attestations) for how claimed certifications are upgraded to validated evidence.
3. If the vendor's certification is publicly verifiable and the presumed artifact still doesn't appear, contact [support@visotrust.com](mailto:support@visotrust.com).
# Attestations
Source: https://docs.visotrust.com/trust-and-questionnaires/attestations
How VISO TRUST captures vendor attestations — formal declarations that controls are in place — including submission certifications and the audit trail.
An **attestation** is a vendor's formal declaration that certain security controls or compliance requirements are in place. Attestations differ from documentary artifacts — rather than providing an audit report or certification, the vendor asserts directly that a control exists or a standard is met.
## Types of Attestations in VISO TRUST
### Submission Certification
At the end of every vendor collection request, the vendor certifies that the information they submitted is accurate and complete before submitting. This certification is recorded and included in the assessment's audit trail. It doesn't affect the risk score directly, but it establishes a formal declaration of accuracy from the vendor.
### Compliance Attestations
When a vendor publicly claims a compliance certification (e.g., displays a SOC 2, ISO 27001, or PCI DSS badge on their website or trust page) but hasn't provided the full audit report, VISO TRUST records this as a **compliance attestation** — a lower-confidence signal that the vendor likely meets the relevant controls.
Compliance attestations are treated differently from validated artifacts:
* They generate **partial credit** toward control coverage
* They carry **lower assurance** than a reviewed audit report
* They remain visible in the Artifacts tab with their source marked as **Public**
To upgrade from a compliance attestation to full credit, request the actual certification report through a collection request. Once the report is submitted and analyzed, it replaces the attestation with validated evidence.
### Questionnaire Attestations
When vendors respond to questionnaires — either supplemental questionnaires sent during an assessment or follow-up questionnaires targeting control gaps — their written responses are a form of self-attestation. The vendor is asserting, in writing, that they have or don't have specific controls in place.
Questionnaire responses are stored as artifacts and carry **Limited assurance** — self-attested, not independently verified. Where possible, supplement questionnaire responses with documentary evidence to increase confidence.
## Managing Attestations
All attestations are visible in the **Artifacts tab** of a relationship. You can filter by source to separate publicly collected artifacts (**Public**) from those provided by the vendor, your team, or VISO TRUST (**Private**).
Key actions:
* **Request the full document** — for any publicly claimed certification, send a collection request to get the actual report
* **Review the audit trail** — the Activity tab records when attestations were received and what decisions were made based on them
* **Override assurance** — Admins can adjust how compliance certifications influence residual risk at the org level in **Settings → Your Framework → Risk calculations**
## Attestations and Residual Risk
The influence of attestations on residual risk depends on your organization's configuration:
* By default, publicly claimed compliance certifications reduce residual risk slightly — even without the full report
* You can disable this so certifications only count when the actual document is submitted and analyzed
* Questionnaire response attestations always contribute to control coverage, but at the Limited assurance level
See [Your Risk Model](/risk-and-monitoring/risk-model) for information on configuring how attestations influence scoring.
## Requesting Specific Attestations
During a collection request, you can ask for specific attestations by selecting **Request specific artifacts** and choosing the relevant artifact types. For example, if you need a vendor to confirm their penetration testing cadence but they don't have a formal report, you can request a written attestation of their testing schedule as part of the assessment scope.
Vendors can respond with a document or a written statement — both are captured and analyzed by Artifact Intelligence.
# Answering Questionnaires
Source: https://docs.visotrust.com/trust-and-questionnaires/questionnaire-answering
How VISO TRUST questionnaires get answered — automatically by Artifact Intelligence using existing documents, or by vendors in the collection portal.
Questionnaires in VISO TRUST can be answered in two ways: automatically by Artifact Intelligence using existing documentation, or directly by the vendor through the collection portal. This page covers both paths — including the full vendor experience from receiving a request to submitting a response.
## AI-Answered Questionnaires
When a questionnaire is configured with **Answer with AI**, VISO AI answers each question automatically by reading the full text of the artifacts on the vendor relationship. Artifacts you've excluded from the relationship are not used. Each answer comes back with source citations — the specific passages and artifacts it relied on — and a confidence score.
This approach:
* Requires no effort from the vendor
* Works best when the vendor has submitted high-quality documentation that addresses the questions
Answering starts automatically once the assessment completes and every artifact on the relationship has finished processing. Questionnaires added to the relationship after the assessment completed are not answered automatically. Those show a **Pending change** prompt in the questionnaire's section of the [risk analysis](/risk-and-monitoring/risk-analysis#answering-through-an-assessment-update) asking you to run **Update assessment**, which answers them as part of the update. An update also re-answers completed questionnaires from the vendor's latest artifacts.
A question counts as answered only when the AI backs its answer with cited evidence. If the AI can't confidently answer a question from available evidence, the question is marked unable to answer, its control domain remains unvalidated, and it may trigger a follow-up to the vendor. If the AI drafts an answer without citing any supporting passage, the question also remains unanswered. Unanswered questions show no answer text in the risk analysis, even when a draft exists.
Answers, their citations, and the reasoning behind each one appear in the questionnaire's section of the risk analysis. See [Questionnaires in risk analysis](/risk-and-monitoring/risk-analysis#questionnaires).
## Vendor-Answered Questionnaires
When a questionnaire requires direct vendor response, it is included in the collection request sent to the vendor. The vendor completes it through the **collection portal** — a secure, guided interface they access via email.
### The Vendor Experience
The vendor receives an email with a link to the collection portal and a one-time passcode. The email may also include a personal message from your team.
The vendor enters their passcode and arrives at the portal landing page, which shows:
* Your organization's name (and branding, if configured)
* A summary of what's being requested
* Options to get started, request more time, forward the request, or opt out
The portal clearly distinguishes between:
* **Scope-based requests** — standard document types determined by the assessment framework (SOC 2 reports, security policies, etc.)
* **Specific artifact requests** — named documents or additional materials your team requested for this relationship
* **Questionnaire questions** — written questions requiring direct responses
All questionnaires in the request appear on a single page, organized into sections — the standard VISO TRUST questionnaire followed by any supplemental questionnaires. A navigation panel beside the questions lists each section with its answered count and progress, and highlights the section currently in view. Selecting a section jumps directly to it.
For each question, the vendor:
* Selects a response from the available options
* Adds a description to provide context or clarification
Selecting **Continue** checks every section for completeness. If any responses are missing, the portal jumps to the first unanswered question so the vendor can fill in the gaps.
When complete, the vendor reviews and certifies that their responses are accurate, then submits. VISO TRUST immediately begins processing the response.
### Forwarding the Request
If the vendor contact who received the request isn't the right person to answer — common when requests go to a sales contact instead of a security team — the vendor can forward the request to a colleague directly from the portal. Changing the contact while the request is active sends a new email to the updated recipient.
### Opting Out
Vendors can opt out of a collection request from the portal — intended for when they're no longer doing business with your organization. Opting out ends the assessment and cannot be undone; if it was a mistake, you'll need to start a new assessment.
## Follow-Up Questionnaires
After the initial assessment review, if controls remain unvalidated, VISO TRUST may send a **follow-up questionnaire** targeted at the specific gaps. This is a shorter, more focused questionnaire than the initial one.
Vendors have a configurable window (7 days by default) to respond to a follow-up. The portal experience is the same as the initial collection request.
## Answering as a Trust Profile
If your organization has a [Trust Profile](/trust-and-questionnaires/trust-profiles), Artifact Intelligence can use documents uploaded there to automatically answer questionnaires sent to your organization by VISO TRUST customers — without any manual effort.
This is the primary benefit of maintaining a complete Trust Profile: when customers assess you, the AI answers their questionnaires using your pre-uploaded documentation rather than requiring your security team to respond manually to each request.
## Tracking Responses
For questionnaires sent to vendors, track response status in the relationship's **Artifacts tab**. The questionnaire response appears as a **Questionnaire** artifact with its analysis status. Once processed, responses are reflected in the risk analysis on the **Assessments** tab.
For follow-up questionnaires, the assessment status changes to **Collecting Information** while the vendor responds, and returns to **Review Started** once the response is submitted and processing begins.
# Questionnaires
Source: https://docs.visotrust.com/trust-and-questionnaires/questionnaires
Build, configure, and send questionnaires in VISO TRUST to collect structured written responses from vendors as part of a security assessment.
**Questionnaires** let you collect structured written responses from vendors — asking specific questions about their security program, controls, or practices. Unlike artifact collection (which relies on documents), questionnaires put questions directly to the vendor and capture their answers as a response artifact.
Questionnaires are managed in **Settings → Questionnaires**. Creating and editing questionnaires requires Admin or Program Manager access.
## When to Use Questionnaires
Questionnaires are useful when:
* A vendor doesn't have formal audit reports and needs to self-attest to their security practices
* You want to ask specific questions not covered by standard artifact types
* Controls remain unvalidated after artifact review and you need targeted clarification
* Your compliance program requires vendors to answer specific questions in writing
## Creating a Questionnaire
Select **Add questionnaire** to create a new one.
* **Import** — use the provided CSV template to define questions in bulk
* **Create** — build the questionnaire question by question in the interface
Use a descriptive name — this is visible to vendors when they receive an assessment request containing the questionnaire.
Choose how responses will be collected:
**Answer with AI** — VISO AI answers the questions automatically from the artifacts on the vendor relationship, with source citations and confidence scores for each answer. Faster, no vendor effort required. You can still follow up with the vendor if clarification is needed. See [AI-answered questionnaires](/trust-and-questionnaires/questionnaire-answering#ai-answered-questionnaires).
**Require vendor response** — questions are sent directly to the vendor during interactive assessments. The vendor answers in writing through the collection portal.
Toggle **Enable for every relationship** to apply the questionnaire to all vendor relationships by default. This default can be overridden at the relationship level.
## Managing Questionnaire Scope
### Organization Level
Questionnaires enabled at the org level apply to all new assessments by default. Go to **Settings → Questionnaires** to enable, disable, or edit questionnaires globally.
### Relationship Level
To include or exclude a questionnaire for a specific vendor:
1. Open the vendor relationship
2. Open the **Relationship configuration** dialog (gear icon) and go to **Context → Supplemental questionnaires**
3. Use the slide toggles to turn individual questionnaires on or off
4. Use **Restore organization defaults** to revert to org-level settings
Removing a questionnaire from a relationship excludes it from future assessments and hides responses in the risk analysis. Previously collected responses are retained.
## Questionnaire Results in Assessments
When a vendor responds to a questionnaire, the response is:
* Stored as a **Questionnaire artifact** in the Artifacts tab
* Listed in its own section under **Questionnaires** in the relationship's [risk analysis](/risk-and-monitoring/risk-analysis), with completion progress and every question and answer
* Analyzed by Artifact Intelligence to map answers to controls where applicable
Questionnaire responses carry **Limited assurance** — they're self-attested by the vendor. For high-risk controls, validate questionnaire responses against documentary evidence where possible.
## Follow-Up Questionnaires
**Follow-up questionnaires** are automatically generated when controls remain unvalidated after artifact review. They target the specific gaps identified in the assessment rather than being a general questionnaire.
You can configure follow-up behavior at three levels:
* **Always ask before following up** — VISO TRUST prompts you to review and decide whether to send a follow-up
* **Conditional based on residual risk** — automatically send a follow-up when residual risk is at or above a threshold (e.g., Medium)
* **Use assessment concierge service** — VISO TRUST manages the follow-up on your behalf
The follow-up response window is configurable (7, 14, 30, 60, or 90 days; 7 by default). VISO TRUST auditors validate the responses (when the AI Assessment + Auditor Review method is configured) and update the assessment findings.
See [Assessment Settings](/third-parties/advanced/assessment-settings) to configure follow-up defaults.
## One-Off Questionnaires
You can send a questionnaire as part of any individual collection request, even if it isn't configured as a default. When starting a collection request, select **Request manual response** and then select the questionnaire to include.
This lets you send targeted questionnaires to specific vendors without changing org or relationship defaults.
# Trust Profiles
Source: https://docs.visotrust.com/trust-and-questionnaires/trust-profiles
Manage your Trust Profile in VISO TRUST — the repository of your security documents used to auto-answer inbound questionnaires and power Vendor Discovery.
A **Trust Profile** is your organization's repository of security documentation inside VISO TRUST. It serves two purposes: it feeds Artifact Intelligence with your own artifacts to answer inbound customer questionnaires automatically, and it provides the source material for [Vendor Discovery](/third-parties/vendor-discovery) — surfacing vendors referenced in your documents.
Navigate to **Trust → Knowledge base** to manage your Trust Profile.
## What the Trust Profile Is For
When your organization is a vendor being assessed by a VISO TRUST customer, the assessment process typically involves submitting documentation through a collection request. The Trust Profile eliminates the need to respond manually to every request.
Artifact Intelligence analyzes documents uploaded to your Trust Profile and makes them available to:
* **Automatically answer questionnaires** — when a customer uses VISO Chat Agent to ask questions about your security program, the AI draws on your Trust Profile artifacts to generate answers
* **Pre-populate assessments** — when a customer assesses your organization, your Trust Profile documents can reduce the number of additional artifacts they need to request
* **Power Vendor Discovery** — VISO TRUST analyzes your artifacts to identify subservicers and vendors referenced in your documents, surfacing them in your [Vendor Discovery](/third-parties/vendor-discovery) feed
Artifacts uploaded to your Trust Profile are **not shared outside your VISO TRUST instance** without your control. They are used internally to answer questions and power discovery — they are not published publicly or automatically shared with customers assessing you.
## Adding Artifacts to Your Trust Profile
This is your Trust Profile management page.
Upload files by dragging and dropping, opening a file browser, or submitting a webpage URL.
Accepted inputs include:
* Security documents (SOC 2 reports, ISO 27001 certificates, penetration test reports)
* Compliance documents (DPAs, privacy policies, sub-processor disclosures)
* Policies and procedures
* Security overview pages (via URL)
* Any other documentation describing your security program
Artifact Intelligence processes each document automatically. Once analysis is complete, the artifact is available for VISO Chat Agent, questionnaire answering, and vendor discovery.
## Keeping Your Trust Profile Current
The value of your Trust Profile depends on how current your documentation is. Outdated artifacts reduce the quality of AI-generated answers and may give customers an inaccurate picture of your security posture.
Recommendations:
* Upload new SOC 2 or ISO 27001 reports as soon as they're issued
* Update your sub-processor list whenever it changes
* Remove or replace expired artifacts so outdated documents don't generate misleading answers
* Include your security and privacy pages via URL so VISO TRUST can monitor them for changes
## Trust Profile and VISO Chat Agent
When a VISO TRUST customer uses [VISO Chat Agent](/viso-chat/overview) to ask questions about a vendor, the AI searches the vendor's Trust Profile (if one exists) alongside other available evidence. A complete Trust Profile means more accurate, specific answers — and fewer follow-up requests sent to your security team.
## Trust Profile vs. Assessment Artifacts
| | Trust Profile | Assessment Artifacts |
| --------------- | ---------------------------------------------------------- | -------------------------------------------- |
| **Who uploads** | Your team (as the vendor) | Your team or the vendor, per assessment |
| **Scope** | All of VISO TRUST | A specific relationship and assessment |
| **Used for** | VISO Chat Agent, questionnaire answering, vendor discovery | Risk scoring, control mapping, residual risk |
| **Visibility** | Your VISO TRUST instance | The customer's VISO TRUST instance |
Assessment artifacts collected from a vendor are scoped to that specific relationship and assessment. Trust Profile artifacts are organization-wide and power AI capabilities across your program.
# VISO Chat Agent: VISO TRUST's Built-In AI Assistant
Source: https://docs.visotrust.com/viso-chat/overview
VISO Chat Agent is the AI assistant in VISO TRUST — ask natural-language questions to surface vendor data, assessment findings, and program insights.
**VISO Chat Agent** is the AI assistant built into VISO TRUST. Instead of navigating menus and dashboards to find information, you can ask questions in plain language and get immediate answers grounded in your program's actual data — vendor risk scores, assessment findings, artifact detections, advisory alerts, and more.
VISO Chat Agent is available to all client roles — Admins, Program Managers, Contributors, and Viewers. Open it from the assistant button in the top navigation bar.
## Context-Aware by Design
VISO Chat Agent is a single assistant that adapts to wherever you are in the platform. Open it from anywhere and it automatically scopes to what you're viewing:
* **Across your portfolio** — from most pages, ask about your entire vendor program: risk scores, assessment status, advisories, and more.
* **On a relationship, artifact, assessment, or trust profile** — the assistant narrows to that context, answering from that vendor's analyzed artifacts and assessment findings.
You don't switch modes manually — the assistant picks up the current context automatically, and you can always ask a broader question to widen the scope.
## What Makes It Different from a Search
VISO Chat Agent isn't a keyword search — it understands context. It knows about your relationships, risk scores, assessment statuses, artifact detections, and monitoring alerts, and it uses that data to answer questions rather than just returning a list of matching records.
When you ask "which of my high-risk vendors don't have a completed assessment?", VISO Chat Agent queries your actual program data to produce an answer — not a link to a filter.
## Contextual Prompts
VISO Chat Agent is aware of where you are in the platform. When you're on a risk advisory, for example, it may surface a prompt to help you understand the advisory's impact on your portfolio or draft a vendor outreach request. These contextual entry points are designed to reduce the friction between noticing something and acting on it.
## How It Works
Open VISO Chat Agent from the top navigation or select a contextual prompt within the platform. Type your question or request in plain language.
VISO Chat Agent draws on your program's data — vendor profiles, risk scores, assessment history, artifact detections, advisory feeds — to interpret your question and determine the best response.
It may ask a clarifying question or offer suggested next steps. You can accept a suggestion, refine your request, or ask a follow-up.
For action-oriented requests, VISO Chat Agent can execute directly — generating a report or initiating a workflow — and shows you results in real time.
## What VISO Chat Agent Can Access
VISO Chat Agent works within your VISO TRUST instance only. It has access to:
* Your organization's vendor relationships and their risk scores
* Assessment history and findings
* Artifact detections and control coverage
* Risk advisories and monitoring alerts
* Questionnaire responses and Trust Profile artifacts (for vendor-specific questions)
It does not access data outside your VISO TRUST environment.
# Tips for Better Answers
Source: https://docs.visotrust.com/viso-chat/tips
Tips for better VISO Chat Agent prompts — be specific, scope your question, and reference vendors or assessments directly for more accurate answers.
VISO Chat Agent is designed to understand natural language, but the quality of its answers depends heavily on how clearly you phrase your request. These tips will help you get more accurate, specific, and useful responses.
## Be Specific About What You Want
Vague questions produce vague answers. The more precisely you describe what you're looking for, the more targeted the response.
| Instead of | Try |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------ |
| "Show me risky vendors" | "Show me vendors with a High or Extreme residual risk that haven't been assessed in the past 6 months" |
| "What's the status of assessments?" | "Which assessments are currently in the 'Collecting Information' phase?" |
| "Tell me about this vendor" | "What security controls does this vendor have validated in their latest assessment?" |
| "Any advisories?" | "Are there any Critical or High materiality advisories for vendors in my Finance business unit?" |
## Name the Vendor or Entity
For vendor-specific questions, always include the vendor's name. VISO Chat Agent can narrow its search significantly when it knows exactly which relationship you're asking about.
> "What is Salesforce's current residual risk score?"
> "Does Workday have a current ISO 27001 certificate on file?"
> "Who is the business owner for the Stripe relationship?"
## Break Complex Questions into Steps
If you're working through a multi-step decision, break it into a sequence rather than asking everything at once. VISO Chat Agent handles focused questions better than compound ones.
**Instead of:** "Show me all vendors with High risk who haven't responded to my recent advisory outreach and need a follow-up questionnaire and are in the Engineering BU"
**Try:**
1. "Which vendors in Engineering have High or Extreme residual risk?"
2. "Of those, which have an active advisory outreach request with no response?"
3. "For those vendors, what follow-up questionnaires have been sent?"
## Use the Contextual Prompts
When VISO Chat Agent surfaces a suggested prompt based on what you're looking at — like an advisory page or an assessment result — use it. These prompts are pre-tuned to the context and often lead to better results than starting from scratch.
## Specify Filters When You Have Them
If you're interested in a specific slice of your portfolio, say so. VISO Chat Agent respects filters like:
* Business unit ("in the Legal business unit")
* Vendor tier ("Tier 1 vendors")
* Tags ("vendors tagged 'critical infrastructure'")
* Risk level ("vendors with Extreme inherent risk")
* Time range ("in the last 90 days")
## Ask for the Underlying Evidence
When VISO Chat Agent gives you an answer about a vendor's security posture, you can ask it to show the supporting detections:
> "What's the source for that?"
> "Which artifact does that come from?"
> "Show me the detection reference for the incident response control."
This is especially useful when reviewing answers in a vendor relationship — you can verify that the answer is grounded in real, analyzed documentation rather than a general assumption.
## If the Answer Seems Wrong
* **Rephrase the question** — try describing what you're looking for from a different angle
* **Add more context** — include the vendor name, business unit, time range, or specific status
* **Check the source references** — VISO Chat Agent cites its sources; if the citation doesn't match your expectation, the underlying data may need updating (e.g., a relationship context that hasn't been configured, or an artifact that hasn't been uploaded yet)
* **Break it into smaller questions** — start with a simpler version of your question and build from there
VISO Chat Agent answers questions based on your actual program data. If a vendor's risk score or control coverage looks wrong in an answer, the issue is likely in the underlying assessment data — check the relationship directly and ensure context and artifacts are up to date.
# What You Can Ask
Source: https://docs.visotrust.com/viso-chat/what-you-can-ask
Example VISO Chat Agent queries for portfolio insights, vendor lookups, assessment status, advisory triage, and other third-party risk program tasks.
VISO Chat Agent can answer questions about your program data, surface insights across your vendor portfolio, and initiate actions — all through natural language. Here's a breakdown of what you can do, with examples.
## Portfolio Insights
Ask broad questions about the state of your vendor program:
| Example question | What you get |
| -------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| "Which vendors have a High or Extreme residual risk?" | A filtered list of high-risk relationships with their scores |
| "How many assessments are waiting for risk review?" | A count and list of assessments in Review Risk status |
| "Show me vendors that haven't been assessed in the last 12 months" | Relationships with no recent completed assessment |
| "Which vendors in the Engineering business unit have open remediation requests?" | Filtered list scoped to a specific business unit |
| "What's our average residual risk across all onboarded vendors?" | A portfolio-level metric from Risk Insights |
| "Which vendors have expiring artifacts in the next 30 days?" | Upcoming artifact expirations across your portfolio |
## Vendor-Specific Questions
On any relationship, open VISO Chat Agent to ask questions about that specific vendor, answered using their analyzed artifacts and assessment findings:
| Example question | What you get |
| ------------------------------------------------------------------- | ----------------------------------------------------------- |
| "Does this vendor have a SOC 2 Type II report?" | Yes/no with the detection reference from their artifacts |
| "What's the vendor's incident response process?" | A summary extracted from their submitted documentation |
| "Are there any exceptions or qualifications in their audit report?" | Findings from the auditor review of the artifact |
| "Does the vendor use subprocessors, and who are they?" | Sub-processor information extracted from their DPA or SOC 2 |
| "What controls are currently unvalidated for this vendor?" | Control gaps based on the latest assessment |
| "How has this vendor's risk score changed over the past year?" | Historical risk trend for the relationship |
## Risk Advisories and Monitoring
Ask about emerging threats and their impact on your portfolio:
| Example question | What you get |
| ---------------------------------------------------------------- | ----------------------------------------------------- |
| "Which of my vendors are affected by the latest Okta advisory?" | Relationships with Okta as a vendor or nth-party |
| "Summarize the impact of the MOVEit vulnerability on my program" | An impact summary scoped to your vendor relationships |
| "Which vendors haven't responded to my advisory outreach?" | Status of pending vendor response requests |
| "Are any of my vendors on the affected list for this CVE?" | Exposure check across your portfolio |
## Assessments and Actions
Initiate workflows and get status updates:
| Example question | What you get |
| -------------------------------------------------------------------------- | ---------------------------------------------------- |
| "Start a new assessment for Salesforce" | Guided assessment initiation |
| "Send a follow-up questionnaire to the vendor with gaps in access control" | Drafts and initiates the follow-up |
| "Which assessments are in the 'Follow-up Recommended' stage?" | List of assessments awaiting follow-up decision |
| "Draft questions to ask a vendor impacted by a recent breach" | Context-specific questions based on advisory details |
| "Who is the business owner for the Workday relationship?" | Relationship contact information |
## Trust Profile Q\&A
From your Trust Profile (**Trust → Artifact Intelligence**), ask questions answered using your organization's own Trust Profile artifacts — useful for reviewing what evidence you have on file before a customer requests it:
| Example question | What you get |
| ------------------------------------------------------------------- | ------------------------------------------------ |
| "Do we have a current SOC 2 Type II on file?" | Status based on your Trust Profile artifacts |
| "What does our DPA say about subprocessors?" | Extracted language from your uploaded DPA |
| "Which security controls are covered by our current documentation?" | Control coverage summary from your Trust Profile |
| "Is our penetration test report still within its validity period?" | Validity check on the artifact |
***
VISO Chat Agent answers are grounded in your actual program data and artifact detections, with references to the source evidence. If an answer seems off, check the supporting references — they'll tell you exactly where the information came from.