Hold your vendors to your own bar.
A vendor's breach is your incident — and your regulator's question. Tier them, send the assessment via magic link, score the response, and keep watching after they pass.
What goes wrong without this
Your data sits in vendors you assessed once, years ago — if at all.
Email-and-spreadsheet questionnaires stall and never close the loop.
A vendor's breach becomes your incident — and your regulator's question.
Send. Sign. Score.
Vendor receives a magic link, fills in the SIG-Lite + KVKK assessment, attaches DPA / ISO / SOC 2 evidence — no account, no email ping-pong. You see the score the moment they submit.
Every score is explainable.
Responses scored across four axes — security, privacy, compliance, continuity — with weighted findings, certificate provenance and a live breach feed. Accept, request remediation, or reject with a one-click verdict.
Security
Certifications (ISO 27001 / SOC 2), encryption, MFA, incident handling — weighted by evidence freshness.
Privacy
DPA, lawful basis, subprocessors, cross-border transfers — mapped to KVKK md.9 and GDPR Art.28.
Compliance
Framework alignment (ISO 27001, NIST CSF, EU AI Act if applicable), attestation freshness, certificate provenance.
Continuity
Business continuity plan, RPO / RTO, recovery testing, vendor concentration risk.
It doesn't stop at signature.
Vendors don't stay safe forever. Breach feed, certificate expiry, control drift and revalidation calendar keep the score honest after the deal closes.