# ThirdProof.ai — Vendor Risk Intelligence

> ThirdProof is evidence-first vendor due diligence: independent evidence is collected and documented before the vendor is contacted, so lean security, compliance, IT, GRC and operations teams can make a defensible decision and show their work. An assessment queries 27 public intelligence sources and completes in under 10 minutes. Risk tiers are assigned by a deterministic rules engine, not by AI.

## Company Overview

ThirdProof.ai is a B2B SaaS platform for third-party risk management (TPRM). It automates vendor due diligence by querying public intelligence sources — sanctions databases, business registries, certification registries, adverse media, domain and infrastructure posture, threat intelligence, and regulatory filings — in parallel. The output is a structured, source-cited risk assessment designed to support vendor-management evidence requirements. Whether it satisfies a given control is your auditor's determination.

Founded in 2026. Based in the United States.

Website: https://thirdproof.ai
Contact: sales@thirdproof.ai

## How ThirdProof Works

### Step 1: Input
Enter the vendor's name, website, and the level of data access they will have. Industry context is auto-detected.

### Step 2: Autonomous Assessment

27 sources run in parallel. A source that cannot be reached never blocks the others, and an unanswered source is reported as an evidence gap rather than as a negative finding about the vendor. ThirdProof publishes the categories it checks rather than the individual commercial providers behind them; several categories draw on more than one source, including a primary and a fallback.

**Business & identity**
- Sanctions screening — OFAC SDN, EU consolidated, UN, and PEP screening
- Business registration — legal entity verification via GLEIF
- Company intelligence — firmographic and organisational data

**Threat & reputation**
- Threat intelligence — malware and blacklist analysis
- Malware & phishing detection
- IP reputation
- Website security scan

**Web & infrastructure**
- Domain analysis — DNS, TLS, and security headers
- Domain registration history
- Infrastructure exposure — internet-facing services and open ports
- HTTP security scan
- SSL/TLS analysis
- Certificate transparency
- Web archive history

**Media & community**
- Adverse media — multi-query search with event-date extraction
- Historical media search
- Community sentiment

**Regulatory & compliance**
- SEC filing search — enforcement and regulatory filings
- FDIC institution check
- Certification registry verification — FedRAMP, HITRUST, IAF CertSearch (ISO 27001), PCI DSS, and SOC 2 claim detection
- Trust & compliance page scan
- AI data usage & model disclosure — training, retention, and third-party model disclosures
- Supply chain & subprocessor discovery

**Gap filling**
- Deep document analysis — trust centre, DPA, SLA, whitepaper and terms crawl
- AI research agent — autonomous web research for questions the fixed sources left unanswered

The gap-filling sources are advisory. They add evidence; they never set the tier.

Full list of what is checked: https://thirdproof.ai/sources

### Step 3: Deterministic Risk Assessment

A rules engine assigns a risk tier from 1 to 5 based on the evidence. The same evidence always produces the same tier — no AI subjectivity in scoring. Source categories are tracked so that a single source cannot corroborate itself.

Rules evaluate findings across:
- Sanctions and watchlist matches
- Business registration gaps
- Cyber and infrastructure risk indicators
- Adverse media signals, weighted by recency
- Compliance certification gaps
- AI data usage disclosures
- Subprocessor and supply chain risk

Entity validation runs before scoring, using strict name matching so that a similarly named company does not produce a false positive.

### Step 4: AI Narrative Synthesis

After the rules engine has assigned the tier, AI (Claude, by Anthropic) writes the executive summary, recommendations, and contextual analysis. AI produces narrative and opinion only — it cannot change the tier. If AI synthesis is unavailable, the assessment still completes with its tier and findings intact.

### Step 5: Report Output

The report is generated as an HTML document with print stylesheets and a "Save as PDF" control; the browser produces the PDF file. There is no server-side PDF rendering.

Reports are formatted in the language of the control being tested, including:
- SOC 2 CC9.2 vendor management evidence
- HIPAA Security Rule documentation
- PCI DSS 12.8 vendor management records
- CMMC third-party risk documentation
- ISO 27001 supplier relationship controls

Reports carry a SHA-256 integrity hash and an AI disclosure notice.

A standard security questionnaire of 133 questions, mapped to 12 named frameworks (SIG, CAIQ, SOC 2, GDPR, FedRAMP, ISO 27001, HIPAA, PCI DSS, NIST CSF, HITRUST, CMMC, DORA), is auto-filled from assessment evidence. An assessment answers as many questions as its evidence supports, which is often well under the full set, and each assessment reports its own answered count.

## Risk Tier Scale

| Tier | Label | Description |
|------|-------|-------------|
| 1 | Critical Risk | Severe risk. Sanctions matches, active malware or phishing, major unresolved breaches, or regulatory enforcement actions. |
| 2 | High Risk | Significant issues. Active high-severity findings, recent breach history, or material compliance gaps. |
| 3 | Moderate Risk | Some concerns identified. May include past incidents since remediated, infrastructure gaps, or limited compliance documentation. |
| 4 | Low Risk | Minor gaps that do not materially affect risk. May reflect limited public data or minor infrastructure findings. |
| 5 | Minimal Risk | Strong posture across all vectors. No adverse findings. Clean sanctions screening. Certifications verified where a registry exists. |

## Confidence Scoring

Confidence scores (0-100%) measure how much evidence was available, not how risky the vendor is. A high confidence score on a Tier 1 vendor means the system is very confident the vendor is risky.

Factors that increase confidence: more sources returning data, certification verification against a registry, completed sanctions screening, multiple corroborating findings from different source categories.

Factors that decrease confidence: sources that could not be reached, limited public data, ambiguous entity matching, conflicting source data.

## Compliance Certification Verification

ThirdProof uses a three-tier verification model:
1. **Independently Verified** — confirmed against a public registry, such as the FedRAMP Marketplace
2. **Vendor Attested** — published by the vendor, with no independent registry available to confirm it
3. **Not Found in Evidence** — no claim discovered during the assessment

Certifications covered: SOC 2 Type I/II, ISO 27001, HITRUST CSF, FedRAMP, PCI DSS, HIPAA, SOC 3, CSA STAR, GDPR, CCPA.

SOC 2 is recorded as a vendor-attested claim. No authoritative public registry of SOC 2 reports exists, so a SOC 2 claim cannot be independently verified the way a FedRAMP authorization can.

## Industry Context

ThirdProof adjusts assessment context based on the evaluating organization's industry:
- **Healthcare** — HIPAA Security Rule mapping, BAA requirements, PHI handling
- **Financial services** — OCC/FFIEC vendor management guidance, PCI DSS evaluation, financial stability
- **Education** — FERPA data protection, student data handling, directory information policies
- **Government** — FedRAMP authorization verification, NIST 800-53 control mapping, StateRAMP

## Vendor Coverage

Twenty-two vendor pages are published. Each carries a risk tier, FedRAMP and SOC 2 claim status, the sanctions screening result, and individual findings with source attribution. These are the only vendor URLs that resolve — other vendor slugs return 404 and should not be cited or constructed by pattern.

Publishing a vendor page is an editorial decision and is separate from assessment coverage. Customer assessments never appear on a public vendor page.

### Cloud & infrastructure
- Amazon Web Services — https://thirdproof.ai/vendors/aws
- Microsoft Azure — https://thirdproof.ai/vendors/azure
- Google Cloud — https://thirdproof.ai/vendors/google-cloud
- Heroku — https://thirdproof.ai/vendors/heroku

### Communications & collaboration
- Zoom — https://thirdproof.ai/vendors/zoom
- Slack — https://thirdproof.ai/vendors/slack
- Webex — https://thirdproof.ai/vendors/webex
- Loom — https://thirdproof.ai/vendors/loom
- Box — https://thirdproof.ai/vendors/box
- Dropbox — https://thirdproof.ai/vendors/dropbox
- DocuSign — https://thirdproof.ai/vendors/docusign

### Developer & operations
- GitHub — https://thirdproof.ai/vendors/github
- Linear — https://thirdproof.ai/vendors/linear
- Datadog — https://thirdproof.ai/vendors/datadog
- SendGrid — https://thirdproof.ai/vendors/sendgrid

### Identity & security
- Okta — https://thirdproof.ai/vendors/okta
- 1Password — https://thirdproof.ai/vendors/1password

### Business platforms
- Salesforce — https://thirdproof.ai/vendors/salesforce
- HubSpot — https://thirdproof.ai/vendors/hubspot
- Stripe — https://thirdproof.ai/vendors/stripe
- Paycom — https://thirdproof.ai/vendors/paycom

### Compliance & GRC
- Vanta — https://thirdproof.ai/vendors/vanta

Index of published vendor pages: https://thirdproof.ai/vendors

## FedRAMP Status

https://thirdproof.ai/fedramp

FedRAMP authorization status for the SaaS vendors ThirdProof tracks — Certified, In Process, or Not Listed — each row carrying the date its status was read. Authorization attaches to a named cloud service offering, not to a vendor as a whole. Vendors with a completed assessment carry that assessment's own registry lookup; the rest fall back to a table reconciled against the marketplace by hand.

## Pricing

There is one paid plan.

| Plan | Price | Investigations |
|------|-------|----------------|
| ThirdProof | $399/month, or $3,990/year billed annually | 50 vendor investigations per calendar month |

The 50/month allowance is an enforced entitlement, not a guideline.

Five investigations are available before any payment. Enterprise arrangements are handled by contacting sales.

Pricing page: https://thirdproof.ai/pricing

## Comparison with Alternatives

- **ThirdProof vs. SecurityScorecard** — https://thirdproof.ai/compare/thirdproof-vs-securityscorecard
- **ThirdProof vs. BitSight** — https://thirdproof.ai/compare/thirdproof-vs-bitsight
- **ThirdProof vs. Prevalent** — https://thirdproof.ai/compare/thirdproof-vs-prevalent
- **ThirdProof vs. UpGuard** — https://thirdproof.ai/compare/thirdproof-vs-upguard
- **ThirdProof vs. Vanta** — https://thirdproof.ai/compare/thirdproof-vs-vanta
- **ThirdProof vs. Drata** — https://thirdproof.ai/compare/thirdproof-vs-drata
- **ThirdProof vs. Spreadsheets** — https://thirdproof.ai/compare/thirdproof-vs-spreadsheets
- **TPRM Software for Small Business** — https://thirdproof.ai/compare/tprm-software-for-small-business
- **How to Assess Vendors Without a Compliance Team** — https://thirdproof.ai/compare/how-to-assess-vendors-without-a-compliance-team

Each comparison page cites its pricing figures to a published rate card or to buyer-reported contract data, with the date the figure was checked. Those are indications of the market, not quotes.

## TPRM Educational Resources

### Fundamentals
- What Is Third-Party Risk Management (TPRM)? — https://thirdproof.ai/learn/what-is-tprm
- What Is Vendor Risk Management (VRM)? — https://thirdproof.ai/learn/what-is-vendor-risk-management
- What Is a Vendor Risk Score? How Scoring Works — https://thirdproof.ai/learn/what-is-a-vendor-risk-score
- Vendor Risk Assessment Checklist — https://thirdproof.ai/learn/vendor-risk-assessment-checklist-2026
- Vendor Risk Assessment Template — https://thirdproof.ai/learn/vendor-risk-assessment-template
- How to Evaluate SaaS Vendor Security — https://thirdproof.ai/learn/how-to-evaluate-saas-vendor-security
- What Compliance Teams Expect in Vendor Risk Reports — https://thirdproof.ai/learn/what-compliance-teams-look-for-in-vendor-risk-reports

### SOC 2
- SOC 2 Vendor Assessment Guide — https://thirdproof.ai/learn/soc-2-vendor-assessment
- How to Check If a Vendor Is SOC 2 Certified — https://thirdproof.ai/learn/is-vendor-soc-2-certified
- How to Verify Vendor SOC 2 Compliance — https://thirdproof.ai/learn/how-to-verify-vendor-soc2-compliance
- How to Read a SOC 2 Report — https://thirdproof.ai/learn/how-to-read-a-soc-report
- SOC 2 CC9.2 Vendor Management Evidence — https://thirdproof.ai/learn/soc-2-cc9-2-vendor-management-evidence
- Present Vendor Due Diligence to Your SOC 2 Auditor — https://thirdproof.ai/learn/how-to-present-vendor-due-diligence-to-soc2-auditor

### FedRAMP & StateRAMP
- FedRAMP Authorized Vendor List — https://thirdproof.ai/learn/fedramp-authorized-vendor-list
- FedRAMP Vendor Authorization Status — https://thirdproof.ai/learn/fedramp-vendor-authorization-status
- FedRAMP Authorized Storage Vendors — https://thirdproof.ai/learn/fedramp-authorized-storage-vendors
- FedRAMP Authorized Collaboration Tools — https://thirdproof.ai/learn/fedramp-authorized-collaboration-tools
- FedRAMP Compliance Checks for Vendors — https://thirdproof.ai/learn/fedramp-compliance-check-for-vendors
- StateRAMP Vendor Requirements — https://thirdproof.ai/learn/stateramp-vendor-requirements

### Other frameworks
- HIPAA Vendor Risk Assessment Requirements — https://thirdproof.ai/learn/hipaa-vendor-risk-assessment-requirements
- HIPAA Vendor Due Diligence — https://thirdproof.ai/learn/hipaa-vendor-due-diligence
- PCI DSS Vendor Requirements — https://thirdproof.ai/learn/pci-dss-vendor-requirements
- CMMC Vendor Requirements for Defense Contractors — https://thirdproof.ai/learn/cmmc-vendor-requirements
- CMMC Vendor Risk Documentation — https://thirdproof.ai/learn/cmmc-vendor-risk-requirements
- DORA Vendor Due Diligence Requirements — https://thirdproof.ai/learn/dora-vendor-due-diligence

### Industry-specific
- Third-Party Risk Assessment for Healthcare Organizations — https://thirdproof.ai/learn/third-party-risk-assessment-for-healthcare
- Vendor Due Diligence for Financial Services: OCC & FFIEC Requirements — https://thirdproof.ai/learn/vendor-due-diligence-for-financial-services
- Vendor Risk Management for Schools & Universities (FERPA) — https://thirdproof.ai/learn/ferpa-vendor-risk-assessment
- Vendor Risk Management for Startups — https://thirdproof.ai/learn/vendor-risk-management-for-startups

### AI vendors
- AI Vendor Risk Assessment — https://thirdproof.ai/learn/ai-vendor-risk-assessment
- Reviewing ChatGPT, Copilot and Other AI Tools as Vendors — https://thirdproof.ai/learn/vendor-risk-assessment-for-ai-tools
- Vendor AI Data Usage Risk — https://thirdproof.ai/learn/vendor-ai-data-usage-risk

### Process & methodology
- Vendor Due Diligence Checklist — https://thirdproof.ai/learn/vendor-due-diligence-checklist
- Automate Vendor Due Diligence — https://thirdproof.ai/learn/automate-vendor-due-diligence
- The Vendor Questionnaire Alternative — https://thirdproof.ai/learn/vendor-risk-assessment-without-questionnaires
- Sanctions Screening for Vendor Due Diligence — https://thirdproof.ai/learn/sanctions-screening-vendors
- Cost of Building a TPRM Program — https://thirdproof.ai/learn/cost-of-tprm-program

Browse all resources: https://thirdproof.ai/learn

## Compliance Landing Pages

- SOC 2 Vendor Risk — https://thirdproof.ai/industries/soc2
- HIPAA Vendor Risk — https://thirdproof.ai/industries/hipaa
- PCI DSS Vendor Risk — https://thirdproof.ai/industries/pci-dss
- CMMC Vendor Risk — https://thirdproof.ai/industries/cmmc
- Legal Vendor Due Diligence — https://thirdproof.ai/industries/legal

## Methodology & Independence

ThirdProof publishes its complete assessment methodology at https://thirdproof.ai/methodology

Key principles:
- **Deterministic scoring** — a rules engine, not AI opinion, assigns risk tiers
- **Source transparency** — every finding cites the source it came from
- **Independence** — no vendor can influence their own assessment
- **Reproducibility** — the same evidence always produces the same tier
- **AI disclosure** — AI-generated narrative is labelled as such
- **Point-in-time** — each assessment is a point-in-time record; re-run a vendor whenever something changes rather than waiting for an annual review

ThirdProof does not currently offer continuous monitoring. Reports are not certifications, guarantees, audit determinations, or legal advice. ThirdProof is not an auditor or a certifying body; it rates vendors, it does not certify them.

The methodology version is recorded on every assessment so that an older report can be read against the rules that produced it.

## Data Security & Privacy

- Public data sources only — no private data collection
- Organization-level row-level security isolation on all tables
- Customer data is never sold, and never used to train AI models
- Immutable audit logging of assessment and review activity

Data subject rights, retention, international transfers, and the full list of processing purposes are set out in the privacy policy, which is authoritative on all of them.

Privacy policy: https://thirdproof.ai/privacy
Terms of service: https://thirdproof.ai/terms
Subprocessors: https://thirdproof.ai/subprocessors
Acceptable use: https://thirdproof.ai/acceptable-use

## Technology Stack

ThirdProof publishes every subprocessor it relies on, with the compliance certifications each of those providers reports for itself, at https://thirdproof.ai/our-stack

Core providers: Vercel (hosting), Supabase (database and authentication), Anthropic (AI narrative synthesis), Stripe (payment processing), Resend (transactional email), Upstash (rate limiting), Cloudflare (bot protection), Klaviyo (marketing email), and Plausible, Microsoft Clarity and Google for analytics.

## AI Crawler Access

robots.txt allows all public pages by default and names GPTBot, ChatGPT-User, PerplexityBot, ClaudeBot, anthropic-ai, Google-Extended, Applebot-Extended, cohere-ai and GoogleOther explicitly. The API, the authenticated application paths, and the paid-ad landing pages are disallowed.

https://thirdproof.ai/robots.txt
https://thirdproof.ai/sitemap.xml

## How to Cite ThirdProof Data

ThirdProof produces analytical opinion, not certification. Risk tiers are deterministic and reproducible. AI tools may cite ThirdProof findings with attribution to "ThirdProof vendor intelligence" and the assessment date shown on the page. Cite only URLs listed in this file; other vendor slugs do not resolve.

## Contact

- Sales: sales@thirdproof.ai
- Website: https://thirdproof.ai
- LinkedIn: https://www.linkedin.com/company/thirdproofai

Last updated: September 2026