Getting started
I didn’t receive my account setup email. What do I do? Check your spam folder first. If it’s not there, contact your Customer Success Manager or email support@visotrust.com. If your organization uses SSO, confirm with your Admin that you’ve been assigned access in your identity provider. I can’t log in with Google or Microsoft. If your organization has SSO configured, your first login must go through your SAML identity provider. Navigate to app.visotrust.com, enter your email, and follow the redirect to your IdP. Social logins (Google, Microsoft) work for subsequent logins after your first successful SSO session. I can see the platform but can’t take any actions. You likely have Viewer access. Viewers can view relationships, assessments, and risk data but cannot create or edit. Contact your Admin to request a role change if you need edit access.Relationships and vendors
How do I add a vendor that isn’t in the VISO TRUST directory? When adding a relationship, search for the vendor name. If it doesn’t appear, click Create new third-party organization at the bottom of the results. Enter the vendor’s name and website URL. Providing a URL is important for public research and instant assessment accuracy. Why is my vendor’s risk score different from what I expected? Risk scores are driven by the combination of data types and business cases configured for the relationship. Check the relationship’s Context settings to make sure the selections accurately reflect how you use this vendor. Also review what artifacts have been collected. A vendor with no analyzed documentation will have a higher residual risk than one with a validated SOC 2. What does “Pending Changes” mean on a relationship? It means new information exists that hasn’t been incorporated into the current assessment summary yet. Triggers include expired artifacts, a context update, newly discovered public artifacts, new risk advisories, newly added supplemental questionnaires, or a risk model update since the last assessment ran. Run a public search or initiate an assessment update to resolve it. Can I have multiple relationships with the same vendor? Yes. Use the Products & Services scoping feature to create separate relationships for different products or services from the same vendor. Each relationship has its own assessment context and risk score. How do I archive or unarchive a relationship? Open the relationship, click the gear icon to open the Relationship configuration dialog, and go to Onboarding and lifecycle management. Set the status to Archived to archive it, or change it back to Onboarded or Not Onboarded to restore it. Archived relationships are hidden from the default Relationships list. Add the Archived status filter to find them. See Relationship Lifecycle for details.Assessments
How do I start an assessment? There are three ways:- Instant Assessment: runs automatically when you create a relationship (if enabled)
- Upload artifacts: go to the relationship, click Add information, and upload documents directly
- Collection request: go to the relationship, click Start assessment, and send a request to the vendor
Risk scores
Why did a vendor’s risk score change without a new assessment? Several things can trigger score changes without a full assessment. These include artifacts expiring (reducing assurance on credited controls), context updates (adding or removing business cases or data types), newly detected risk advisories, or a change published to Your Framework. Publishing a new risk tolerance re-runs the model across your whole portfolio. Check the relationship’s Activity tab for a log of what changed. Can I override a vendor’s risk score? Yes. When an assessment is in Review Risk status, click Override Risk to manually set a different inherent or residual value. Document your reasoning, because overrides are recorded in the audit trail. Overrides remain in effect until the next assessment update. What’s the difference between inherent and residual risk? Inherent risk is the starting point: potential exposure based on your relationship context, before accounting for vendor security controls. Residual risk is what remains after crediting the vendor’s proven controls. Controls lower risk by reducing the likelihood of an incident, never the impact, so residual risk can never drop below what your data sensitivity allows. Act on residual risk; use inherent risk to understand worst-case exposure. The full breakdown for any vendor is in the relationship’s risk analysis.Artifacts and documents
Why was my artifact classified incorrectly? Classification is automatic but not perfect. If an artifact in your Trust Center → Knowledge base is misclassified, contact support@visotrust.com to correct it. If the artifact is outdated or irrelevant, an Admin or Program Manager can exclude it from questionnaire answering instead. See Excluding artifacts. Can I upload a password-protected document? Password-protected artifacts require manual handling. When you upload one, note in the comments that it’s password-protected. Then provide the password through a secure channel to support@visotrust.com so auditors can access it. Why does a vendor’s SOC 2 only give partial credit? If VISO TRUST detected a SOC 2 badge on the vendor’s website but hasn’t reviewed the actual report, it grants partial credit (lower assurance). To get full credit, request the actual SOC 2 report through a collection request so VISO TRUST can analyze it. Can I delete an artifact a vendor submitted? Delete permissions depend on your role. Some roles can remove any artifact, while others can only remove artifacts their own team uploaded. Vendor-submitted artifacts are otherwise retained as part of the audit trail.Notifications and access
Business Owners are getting too many emails. How do I reduce them? Go to Settings → Org Profile → Notifications and adjust the notification matrix. Toggle off notification types that aren’t useful. You can also turn off Business Owner Notifications entirely on the Overrides card and route alerts through a central team. Override All Email Recipients redirects mail to a single inbox, but it redirects vendor-facing email too. To keep a copy of all mail in one inbox without changing delivery, use BCC All Emails instead. See Notification routing before enabling it. A user can’t see a relationship they should have access to. Check the user’s role. Contributors see all relationships in the organization by default, but some filtered views may hide relationships they’re not subscribed to or don’t own. If the relationship still isn’t visible, check whether it’s archived. I need to give a vendor access to submit documentation outside of a collection request. All vendor document submission happens through the collection portal, which is accessed via a collection request. There is no way to give a vendor ongoing platform access. Each submission is through a specific, time-limited collection link.Getting help
For issues not covered here:- Email: support@visotrust.com
- In-platform: Use the help button to contact support
- Your Customer Success Manager: For account-specific questions and configuration guidance