KlaritiQKlaritiQ
Sign inGet my free audit readiness assessment
Vendor AI RiskFlagged: no documented data-residency commitment
Get my free audit readiness assessment
OverviewFeaturesPlatform ViewUnder the hoodHow It WorksLive PreviewWho It Helps
Vendor AI Risk

Outsourcing the model doesn't outsource the accountability.

Regulators have made this explicit: putting an AI vendor between you and a decision doesn't remove your responsibility for it. Screen vendors on the same dimensions you're held to.

Vendor Check runs a structured screen against the same dimensions your own organization is scored on, so a new AI tool doesn't quietly widen a gap you've already flagged. The output is a pass or flag, never an unexplained score.

How to track compliance with RBI's new AI governance rules →

Demo video coming soon
Grounded in the vendor's own document
Upload the vendor's proposal, SOP, or architecture document and every concern raised is drawn from that document's actual text.
Quote required, no quote, no finding
Every flagged concern must carry an exact quote from the uploaded document. A finding with nothing to point to isn't allowed to exist.
Recommendation, not just a score
The output is a clear recommendation: proceed, proceed with conditions, or escalate for review, not an unexplained numeric risk score.
Confirmed checks become evidence
Confirming a flagged concern writes it into the Evidence Locker, so it's available later in an audit defense export.
Straight from the platform

See exactly how it works, step by step, below.

Product screenshots coming soon
How it works
1
Upload the vendor's document
Drop in the vendor's proposal, SOP, or architecture document before signing anything, the same upload flow used across the app.
2
Extraction runs against the text
The document is scanned for concerns, each one required to carry an exact supporting quote from the source text itself.
3
You confirm or reject each finding
A human reviews each extracted concern and confirms or rejects it, the same confirm step used for evidence elsewhere in the app.
4
Confirmed concerns become evidence
Confirming a concern can create linked risk records and adds the finding to the Evidence Locker for future reference.
Under the hood

The values below are a sample. The field names and structure are the same ones the vendor screen actually extracts.

vendor_risk.json
{
  "vendor_risk": {
    "vulnerabilities": [
      {
        "concern": "No documented data-residency commitment for India",
        "severity": "high",
        "quote": "Data may be processed in any AWS region at vendor's discretion."
      }
    ],
    "compliance_notes": [
      "Data localization not addressed"
    ],
    "cost_impact": {
      "level": "medium",
      "note": "Remediation would need a contract amendment before signing."
    },
    "recommendation": "proceed_with_conditions",
    "recommendation_reason": "Resolved once a data-residency clause is added to the DPA."
  }
}
See it in the platform
Vendor screen · Illustrative
Security questionnaire on file
Data-residency commitment documented
Sub-processor list current
Breach notification clause present
Flagged: no documented data-residency commitment
Frequently asked
No. It's a structured first screen grounded in the vendor's own document text, meant to surface concerns worth taking into a deeper review, not to replace one.
Who this helps
The CTO
Screens a new AI vendor against real document text before procurement, instead of relying on the vendor's own marketing claims.
The Compliance Head
Gets a quote-grounded record of vendor risk concerns that feeds directly into the same evidence and audit trail used elsewhere.
The Board
Sees a clear proceed, proceed-with-conditions, or escalate recommendation on vendor risk, not an unexplained score with no backing.
Built for Indian Enterprises
Pilot partners, coming soon
DPDP Act-aware
ISO 42001 · on roadmap
SOC 2 · on roadmap
Related products
Risk Management
A live AI risk register tied to your readiness score, not a spreadsheet updated before an audit.
Evidence-Based Scoring
Every score backed by a timestamped, user-linked record, not a number on its own.
Decision Records
Know who approved what, and why, permanently.

Ready to see where you stand?