The security review
A buyer asks which subprocessors touch their data. You answer from a maintained document instead of a week of archaeology.
SaaS and vendor governance
Know what you run, and who runs it.
Tools get bought and connected faster than anyone can review them. Somebody expensed a service two years ago, wired it into your email, and left the company. We keep a living view of what you depend on, who owns each piece, and what it can reach.
What we keep current
Governance that survives contact with a real quarter, because operators maintain it as part of running your environment.
One list that is actually current
Every tool and vendor you depend on, with a named owner on your side and a named operator on ours. The value is not that a list exists; a spreadsheet is a list. The value is that somebody is accountable for it being true next quarter.
What it touches, and how it gets in
For each vendor: the kind of data it holds, whether it authenticates through your identity provider or a password somebody set once, and what access it has been granted. That is usually where the uncomfortable discoveries are.
Renewals you see coming
Renewal dates tracked before they auto-charge, so a contract is a decision you make rather than a line you notice on a statement. Tools nobody has opened in a year are worth surfacing before they renew, not after.
A subprocessor answer you can hand over
When a customer asks who else touches their data, the answer is a document you already maintain rather than a week of internal archaeology. Same discipline that makes an audit cheaper.
What discovery finds, and what it misses
Anything connected to your identity provider is visible to us. If a tool authenticates through Microsoft 365 or Google Workspace, or holds an OAuth grant against your tenant, we can see it, see what it was granted, and see who granted it. That is usually a larger list than people expect.
What no discovery finds is the rest: the service somebody pays for on a company card, the desktop tool installed once, the vendor relationship that lives entirely in a founder's inbox. Any provider claiming a complete automated inventory of your stack is overselling.
So we do both. Discovery covers what it can, and an operator closes the gap by asking, once at onboarding and then as things change. The list is honest about which entries came from which route.
Why it pays for itself
The same list answers four different questions.
The audit
Vendor management is a control in every framework we support. Keeping it current year round is cheaper than reconstructing it each cycle.
The renewal
You see what is coming, what nobody uses, and what quietly doubled, while there is still time to act on it.
The offboarding
When someone leaves, the list tells you every place they had an account, including the ones outside your identity provider.
Where it lands
The register lives where the rest of your program does.
Vendors, owners, renewal dates, and the subprocessor view sit alongside your risks, evidence, and requests, so the vendor question in a security review is a page you open rather than a project you start.
Find out what you are actually running.
Most teams are surprised by the first list. That is the point of having one.
Published tiers. Vendor and technology governance is part of the operated program, not a separate product.
Thirty minutes on what is connected to your tenant today and who owns it.