Vendor Due Diligence Checklist

Business registration and legal entity verification. Confirm the vendor is a registered legal entity through GLEIF (Legal Entity Identifier) databases. ThirdProof's assessment of Stripe verified its legal entity identifier and corporate registration automatically. Domain age and registration history. Check WHOIS records for domain age — a 30-year domain history (like Stripe's) indicates established presence, while a recently registered domain warrants scrutiny. Corporate officer verification. Confirm leadership identities against business registry records. Jurisdiction and entity structure. Document the vendor's country of incorporation and any parent/subsidiary relationships that affect regulatory exposure.

OFAC SDN screening. Check the vendor entity, its officers, and its parent company against the U.S. Treasury's Specially Designated Nationals list. This is a mandatory gate — no contract proceeds without cleared screening. Multi-regime sanctions check (EU, UK, UN). For vendors with international operations, screen against EU Consolidated Sanctions, UK OFSI, and UN Security Council lists. Wise operates across 50+ countries, making multi-regime screening essential. SEC enforcement filing search. Query SEC EDGAR for enforcement actions, 10-K risk disclosures, and material litigation. FDIC institution check. For financial vendors, verify against the FDIC BankFind database for institution status and failed bank records. Adverse media and enforcement actions. Search news archives and regulatory databases for enforcement actions, breaches, lawsuits, and compliance failures. ThirdProof's assessment of Wise revealed multiple AML-related enforcement actions from CFPB and international regulators — findings that sanctions screening alone would miss.

SSL/TLS configuration. Check protocol version (TLSv1.2 minimum, TLSv1.3 preferred) and cipher strength. Stripe and Dropbox both scored A+ on SSL/TLS analysis. HTTP security headers. Evaluate Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and related headers. Common gap: QuickBooks scored F (0/100) on HTTP security headers despite being a major financial platform. Infrastructure exposure. Scan for open ports, exposed services, and known CVEs. Stripe showed only 2 open ports with zero CVEs — minimal attack surface. Malware and phishing status. Check the vendor's domain against malware databases and phishing blocklists. IP reputation. Query abuse databases for reports of malicious activity from the vendor's IP ranges. Domain reputation across threat intelligence engines. Cross-reference the domain against 90+ security engines for malicious or suspicious flags.

SOC 2 Type II report. Request directly from the vendor. SOC 2 reports are not published in a central registry, so independent verification requires scanning the vendor's trust page and cross-referencing claims. BambooHR claims SOC 2, SOC 1, and PCI DSS on its trust page — all classified as vendor-attested until the actual reports are obtained. ISO 27001 certification. Check for current certification from an accredited certification body. HITRUST CSF certification. Relevant for healthcare vendors and business associates handling PHI. FedRAMP authorization status. Verify at marketplace.fedramp.gov — not the vendor's marketing page. Dropbox, for example, maintains 10 other compliance certifications; its FedRAMP status, read live: not on the FedRAMP Marketplace. PCI DSS compliance level. Required for any vendor processing, storing, or transmitting cardholder data. Request the Attestation of Compliance (AoC).

Published subprocessor list. Identify the vendor's subprocessors (fourth parties) and assess downstream risk. ThirdProof's subprocessor discovery scanner checks for published lists — a surprisingly common gap. Stripe, Wise, and QuickBooks all lacked publicly discoverable subprocessor pages during assessment. Fourth-party risk assessment. For each identified subprocessor, evaluate whether it introduces additional risk to your data. Data residency documentation. Confirm where the vendor stores and processes your data, particularly for cross-border transfer compliance under GDPR, CCPA, and data sovereignty requirements.

16 of the 30 rows are marked ThirdProof in the checklist above. Those are the ones a public source can settle: registry records, WHOIS and archive history, sanctions and watchlist screening, SEC and FDIC filings, adverse media, TLS and HTTP header configuration, internet-facing exposure, domain and IP reputation, certificate transparency, the certification claims on the vendor's own trust page, the registers that can independently confirm some of those claims, the published subprocessor list, and the vendor's stated position on AI training and data retention. ThirdProof queries 27 sources in parallel to close them, and the assessment completes in under 10 minutes without the vendor being contacted.

8 rows can only be closed by the vendor, and no tool changes that. A SOC 2 Type II report has no public register — Stripe's, for instance, is released to account owners and administrators through the Stripe Dashboard, not published — so it, the bridge letter, the ISO 27001 certificate and Statement of Applicability, the PCI DSS Attestation of Compliance, the penetration test summary, the data-residency clause and the BC/DR test result all have to be asked for by name. The remainder live in your own contract and review: the DPA, the breach notification window, the right to audit, and what happens to your data when you leave.

That split is the point of doing the public half first. When you do write to the vendor, you are asking for the short list of documents nothing else could have answered, and you already know which of their claims a register confirmed and which it did not. See how the evidence is collected, or read the vendor risk assessment template if you need the write-up format rather than the checks.