Vendor risk and Trust Center

Supply chain compliance

OptiTech's vendor module handles both directions of the requirement chain: assessing the suppliers NIS2 and DORA make you responsible for, and answering the customers who assess you.

See what each plan includes in the plans overview.

Vendor risk management is available to every Professional and Enterprise organization right away. The DORA ICT contract register is an Enterprise feature. Want the Partner plan for managing many clients? Request it below.

Request Partner plan pricing

Drop your email and we'll reach out with multi-tenant console and white-label details.

Request Partner Pricing

Get started

• 

  Quickstart

  Register your critical suppliers as part of getting audit-ready.

• 

  DORA register

  The ICT contract register supervisors ask financial-sector companies for.

• 

  Answer questionnaires

  Answer incoming questionnaires from your verified controls.

• 

  Trust Center

  Publish your compliance status on your own security page.

Overview

The vendor register holds your suppliers with service descriptions, contacts, risk classification, and contract dates. Questionnaires go out from the platform, answers come back structured, and renewal dates are monitored so nothing lapses quietly.

The Trust Center lives on your own subdomain, typically security.example.com, and reflects your live control status rather than a PDF that goes stale.

• One register for every duty. NIS2 supplier requirements, DORA's ICT contracts, and GDPR's processor list all draw from the same vendor data.
• Questionnaires that answer themselves. Vendors respond once; their answers feed your risk classification automatically.
• The compliance graph. Vendors who receive your questionnaire get a free OptiTech account with their own status, so the next customer who asks them starts from their existing answers instead of zero.
• Board-ready reporting. Vendor risk lands in the same dashboards and board reports as the rest of your program.
• Auditor access. The vendor register and its history are part of the evidence chain your auditor portal exposes.

Pricing

Vendor risk pricing is simple. Here's how availability breaks down:

• Professional and Enterprise. The vendor register, questionnaires, risk classification, and Trust Center are included on Professional and Enterprise. There's no per-vendor charge on either plan.
• DORA register on Enterprise. The supervisor-ready ICT contract register is an Enterprise feature.
• Free for your vendors. Suppliers who answer your questionnaires use OptiTech free of charge. They only pay if they upgrade to run their own program.

See the OptiTech pricing page and plans for details.

Try it with the copilot

Two prompts that show the module end to end:

Assess a supplier: register the vendor, then let the copilot build the questionnaire from the frameworks that apply to the relationship.

Create a security questionnaire for our IT operations provider based on our NIS2 requirements

Answer a customer: upload their questionnaire and draft responses from your verified controls.

Answer this questionnaire based on our verified controls