The clean answer when the auditor asks.
Vittnor — Supply Chain Assurance for the mid-market. Scope your supplier portfolio. Assess what matters with structured questionnaires. Collect evidence with provenance. When the question comes, hand over a signed decision trace — not a spreadsheet reconstruction. Built in central Europe by a cybersecurity practitioner — for the buyers that enterprise GRC suites priced out and ignored.
Microsoft Azure, EU regions only.
Read the long-formFull list, updated on every change. DPA template available before the deal.
Read the long-formHash-anchored, signed, decision-traced. Stands up six months later, unchanged.
Read the long-formThree angles into the same product.
The platform is the same regardless of who's using it. The framing changes depending on what you're trying to defend — to whom, and how fast. Pick the angle that matches; the rest of the product story flows below.
Audit defensibility, not framework gymnastics.
Decision-trace and signed evidence stand up six months later, unchanged. Article-anchored gap reports map directly to the NIS2 control set your auditor will reference.
- Article 21(2)(d) gap reports anchored to the directive, not interpreted away from it
- Reviewer attribution + timestamp on every approval, immutable post-fact
- Hash-anchored evidence model — same artefact, same answer, six months later
A supplier graph you can query in minutes.
When a supplier discloses an incident, you need to know which of your services depend on them, which sub-suppliers are downstream, and what evidence you currently hold — fast.
- Tier 1 + sub-supplier lineage in a single graph, queryable by impact path
- Reviewer-flagged certificate expiries, with re-review prompts on the calendar
- NIS2 Article 21(2)(d) control mapping by design
Article 20 governance support, not jargon.
NIS2 makes management bodies personally accountable for cybersecurity oversight. The platform produces the board-ready evidence that lets you discharge that accountability.
- Structured monthly summary — supplier posture, open exposures, decisions taken
- Named accountability — your name appears on the documents the board signs
- Audit-readiness sign-off you can hand to the auditor without rebuilding
Four screens. Four stories.
Real product, redacted. Supplier names and numbers are placeholders; the workflow is real.
Risk scored by worst dimension.
Each in-scope subject — a whole supplier type or a single service — carries its own risk assessment, scored across six dimensions: availability, confidentiality, privacy, supply chain, jurisdiction, resilience. Every score is colour-coded, Low to Critical, and the supplier's tier is the worst dimension across active assessments — not an average. One weak dimension never hides behind five good ones.
EnlargeEvery customer request in one inbox.
Suppliers see every inbound customer request in one place — who is asking, what is due, and how far along each answer is. When a buyer requests changes, the request is flagged for attention the moment it comes back — not rediscovered in an email thread weeks later. The questionnaire back-and-forth scattered across inboxes stops here.
EnlargeThe chain doesn't stop at tier one.
Suppliers disclose the sub-processors behind the service — who runs the cloud, the telemetry, the endpoints — each with criticality, region, and the contract clause that declared it. Removing one requires a reason and leaves an archived entry, so historic dependencies stay discoverable. Captured at each review cycle, not reconstructed after the incident.
EnlargeEvery decision, stamped and exportable.
Every approval, rejection and resubmission is logged with the actor, the reason and the timestamp. Auditors get a chronological export that closes regulator questions in minutes, not hours.
EnlargeYour supplier list ends at one name. The risk doesn’t.
Most supplier-management tools audit who you’re paying. Vittnor maps the chain behind them — Tier 1, Tier 2, Tier 3 — and surfaces the supplier you didn’t know was a supplier. Because that’s where the risk actually lives, and that’s where it always has.
How: sub-suppliers captured from supplier-disclosed lists at each review cycle and held alongside the L1 record. Reviewers flag what changed since last cycle. Automated drift detection ships in V1.2 (2027). More on supply chain depth →
The supplier's evidence answers most of your questionnaire.
Your suppliers upload their SOC 2 Type II report, their ISO 27001 certificate, their sub-processor list, their DPA. The platform extracts the structured facts and pre-fills the matching items in your supplier questionnaire — every suggested answer cited back to the exact source page or clause. You accept, edit, or reject. The reviewer's decision is signed and hash-anchored.
How: Azure Document Intelligence extracts text and structure from each supplier artefact; AI-suggested answers carry mandatory citations to the source. No automated approval — every suggestion needs a reviewer sign-off, captured as an audit event with model, version, evidence set, and timestamp.
Hand the regulator the file. Walk away.
When a regulator, an auditor, or your board asks "how did you decide on this supplier eighteen months ago" — most companies reconstruct the answer under pressure. With Vittnor, you hand them the trace. Every decision timestamped, every signature attributable, every evidence reference hash-anchored. Already prepared.
How: append-only decision log with reviewer attribution, evidence linkage, and content-addressable hashing. Exportable as a single signed dossier. What NIS2 expects in your supplier files →
Vendor breach in the news. Supplier exposure mapped in one search.
An attack on a major vendor becomes your problem if your suppliers depend on them. Vittnor captures those dependencies at every supplier review — direct relationships and the sub-suppliers behind them — so when something happens, the answer is already structured and searchable in the file you maintain.
- Direct suppliers — Tier 1 relationships, current as of the last review.
- Sub-supplier disclosures — Tier 2 and Tier 3 dependencies, surfaced from supplier-provided lists.
- Searchable attributes — Query by vendor name, technology, country, or risk attribute.
- Refresh cadence — Updated on every supplier review — not just when something goes wrong.
From scoping to next year's review.
Six stages, one cycle. The capabilities above (decision trace, supplier graph, Article 21(2)(d) mapping) are what makes each stage hold up — this is the flow they sit inside.
Scope your portfolio
Add suppliers — Tier 1 and below where visibility allows. Tag each by the service they provide and the data classification they touch. Sub-suppliers recorded separately as they are disclosed.
Risk-tier each supplier
Score by data sensitivity × service criticality × replaceability. Top-tier gets full assessment; lower tiers lighter-touch. Either way the tier choice is signed and timestamped, not implicit.
Request the evidence that matters
When residual risk warrants it, send a tailored questionnaire. You pick which artefacts — SOC 2 Type II, sub-processor list, breach-disclosure history, BCP test results, contract clauses on file. Supplier receives it via the supplier-side surface; you see what they have already uploaded to their evidence library and what is new.
AI-assisted answer extraction
When the supplier returns evidence, AI extracts structured facts and suggests answers to the items in your supplier questionnaire — every suggestion carries a mandatory citation to the exact source page or clause. You accept, modify, or reject each one. AI never closes the loop.
Decide and sign
Approval, rejection, or accepted-with-conditions — the decision is hash-anchored with reviewer attribution and timestamp. Future you, the auditor, and the regulator all see the same answer. Mark compliant, and the file is closed for this cycle.
Watch for change. Re-review on signal.
Annual cadence sits on top — every supplier file knows when it is due. Reviewers flag out-of-cycle re-reviews when something material changes: vendor breach disclosure, certificate expiry, sub-supplier addition, ownership change. Automated trigger detection — and the half-prepared file that comes with it — ships in V1.2 (2027).
Stage 06 feeds back into Stage 03 (or 02 if the change is material enough to re-tier). The cycle is the point — supplier assurance is not a one-off audit, it is the continuous practice the audit trail depends on.
This is what the lifecycle leaves behind.
One supplier review, rendered as the record it produces — scope, risk, questionnaire, decisions, closure. Scroll it the way an auditor would read it back: every entry carries its reason.
Cirrus Edge Networks
The following is the record of a supplier review. Every section below was authored in sequence — scope, risk, questions, decisions, closure — and each entry carries the reason behind it.
Illustrative record — buyer, supplier, and data are fictional.
Scope of review
Three services were enumerated on the supplier's register. Each was triaged against the five-question scoping policy. Of the three, one carried regulated traffic and was placed in scope; one was a public-only asset and exempted under §3.2; one is awaiting triage.
- SVC-001IN SCOPEEdge ingress and DDoS protection“Production traffic for regulated services.”
- SVC-002OUT OF SCOPEStatus page hosting“Public assets only — exempt under scoping policy.”
- SVC-003PENDINGInternal monitoring API“Awaiting triage.”
Risk assessment
Twelve scored questions were answered against the in-scope service. The normalised score is reported alongside the four highest-contributing drivers; the tier follows from the score and the category gates.
- Q1How critical to your operations?→Production traffic, regulated services+6
- Q6Privileged inbound access?→Yes — admin, persistent+6
- Q2Acceptable recovery time?→< 24 hours+4
- Q4Records exposed if breached?→1k–100k+4
Questionnaire assembled and sent
Nine questions are required by the Tier-2 pack. Of these, four were already satisfied by evidence on file in the buyer's library — those questions were skipped to save the supplier's time. The remaining five were dispatched to the supplier's designated security contact on 26 Apr 2026, 14:08 CET; a receipt was logged the same minute.
Decisions and reasons
The supplier returned nine evidence items, each attached to the question it answered and bound to a submission attestation. Every item was reviewed; the reviewer's verdict and the reason behind it are recorded below. The full record is the audit trail — no decision in this register stands without its reason.
- T2Information security policyAPPROVED— Signed v2.4 — covers in-scope service.
- T1ISO 27001 + SoAAPPROVED— Current cert; scope covers production.
- T1SOC 2 Type II reportAPPROVED— NDA-bound copy on file; last 12 months.
- T3Privileged access reviewAPPROVED— Quarterly cadence; service-scoped.
- T2Sub-processor declarationAPPROVED— Matches register; no new processors.
- T3Incident response runbookREJECTED— Missing notification SLA per contract Annex 3.
- T2Data processing addendumAPPROVED— SCC mappings present and current.
- T3Acceptable use policyAPPROVED— Public summary acceptable for service tier.
- T4Data protection / privacy policyAPPROVED— Self-attested OK for T4 evidence.
Closure
The review for the in-scope service is closed. On this cycle's score the reviewer raised the supplier's tier from MEDIUM to HIGH; one item carries an outstanding rejection for which a remediation request has been opened. The review cadence tightens accordingly — twelve months becomes six.
Not enterprise procurement. Not a consumer tool. The segment in between.
Most supplier-assurance platforms target the global procurement team running 5,000-vendor audits. We built ours for the businesses inside the supply chain — the 50–500-person manufacturer, the regional MSP, the medical device company — that suddenly need to prove their security posture to three different customers asking three slightly different questions, and answer for their own supplier risk under NIS2.
What you can use today, what ships, what comes after.
We claim the present accurately and name the future honestly — no feature marketed before it exists, and no hiding the line between what pilot members test now and what general availability brings.
What design partners test now
- Process-driven supplier scoping
- Structured assessment with AI-assisted ingestion
- Evidence records with reviewer attribution
- Decision-trace ledger with hash-anchoring
- NIS2-shaped audit exports — machine-readable, structured
What ships at general availability
- Microsoft Marketplace listing + procurement-friendly billing
- SLA commitments published at GA
- Single-tenant deployments on request
What ships next
- Review-trigger engine — automated re-review on cert expiry, sub-supplier change, contract amendment
- Sub-supplier change notifications
- Source drift detection — trust-center page changes, posture shifts
What the platform grows into
- Cross-framework crosswalks — NIS2 evidence reused across ISO 27001, DORA, SOC 2
- Shared assurance pools (buyers + suppliers in the same regulated chain)
- Sector-specific evidence templates per Annex I/II category
- Slovak / Czech / German UI translations
Built by the practitioner.
Vittnor is built by Pavel Láska — a CISSP/CISM practitioner with a decade-plus across banking, pharma, and education. He filled the spreadsheets, defended the supplier decisions, and prepped the audits this product now organises.
The full storyBratislava · CISSP · CISM · Microsoft Partner
Common questions
Is the product available today?+
The pilot is open today — Vittnor is in pre-launch and we are onboarding the first cohort of design partners now. The live production version (V1) is planned for Q4 2026 via the Microsoft Marketplace. Apply via the /pilot page to join the first cohort.
Do I need to be NIS2-regulated to use it?+
No. Many pilot conversations are with suppliers to NIS2-regulated firms who want to demonstrate posture quickly when assurance requests arrive — and with mid-market buyers who are themselves in scope.
How is this different from the NIS2 Supplier Exposure Assessment?+
The Assessment is a fixed-scope advisory engagement: a practitioner walks your supplier portfolio, produces an audit-ready exposure report and a prioritised remediation list, and hands it over. Vittnor is the SaaS — the platform you operate after that initial picture is in your hands. Many buyers do the Assessment first, then onboard the platform.
Does Vittnor replace our audit?+
No. Vittnor produces the structured, attributable evidence an audit draws on — the audit itself still happens with your auditor. What changes is how much of the preparation is already in place when they arrive.
How does the lineage tracing work?+
Where a supplier discloses its sub-processors and downstream providers, we capture the chain from supplier-disclosed lists at each review cycle, so the riskiest path is visible in one place. Most supplier lists only show your direct (Tier 1) relationships; the real risk often hides two or three hops deeper.
How is evidence reused across requests?+
Once a supplier uploads policies, certificates or attestations to their library, future requests from that buyer pull the existing evidence forward. Re-keying the same answers across spreadsheets stops.
What’s your data residency posture?+
EU-hosted by default — Microsoft Azure, EU regions only. Single-tenant deployments available on request for buyers with stricter requirements. No customer data leaves the EU without explicit configuration.
Do you offer a Data Processing Agreement?+
Yes. Standard DPA template available on request, GDPR Article 28-compliant. We’ll sign yours if it’s standard, or work through redlines.
Who are your sub-processors?+
Our sub-processor list is published and updated on every change. Currently: Microsoft (Azure hosting, database, blob storage, AI inference), EU regions only. No customer evidence is sent to third-party AI services.
What happens to my data when the pilot ends?+
Full export available in machine-readable format (JSON + signed PDF dossiers). Thirty-day grace period to export, then complete deletion, confirmed in writing.
How does this differ from OneTrust, Vanta, or Diligent 3rdRisk?+
Those are enterprise procurement-side tools, priced and configured for global teams running thousands of vendor audits. Vittnor is built for the mid-market — companies that need defensible NIS2 supplier assurance without a six-figure platform contract or a six-month implementation. We have 30–40% fewer features than enterprise GRC suites, at a price that reflects that. Honest tradeoff.
What’s a typical onboarding timeline?+
Pilot customers are live in under two weeks: import supplier list, run risk tier on the top 20, send the first questionnaires. Full coverage of a 100-supplier portfolio typically settles within 90 days.
Join the pilot — open today.
The pilot is open now. A small first cohort of mid-market buyers and their key suppliers — members join free or at compute cost and shape the roadmap. Production-ready V1 ships Q4 2026 via the Microsoft Marketplace. Mutual exchange — we help you, you help us.
Nothing to install, no credit card, no procurement cycle — your first suppliers are in Vittnor within two weeks. Published prices, no quote calls →