Inbound
Questionnaires you receive
Your customers' security reviews, drafted from your own evidence and cited line by line, so a deal isn't held up for three weeks by a spreadsheet.
One vault of evidence, working both ways: audit-ready answers drafted from your own documents, and a live third-party risk register for every supplier in your supply chain — mapped across ISO 27001, SOC 2, NIST CSF and GDPR.
Free 3-day trial · No credit card · Cyber, Legal, Commercial & Financial in one vault
QUESTION 12 / 47
Describe how encryption keys are managed, rotated and revoked.
Keys are generated and held in AWS KMS (eu-west-2), rotated automatically every 90 days, and revoked within 4 hours of an access-change ticket. Root key material is never exported.
Built for the frameworks that matter
Inbound
Your customers' security reviews, drafted from your own evidence and cited line by line, so a deal isn't held up for three weeks by a spreadsheet.
Outbound
The same vault, pointed the other way: tier every supplier, send the due-diligence questionnaire, and know the moment their evidence goes stale.
Third-party supplier management
Most supplier reviews are an annual scramble through email threads and PDFs nobody has opened since onboarding. AuditVault keeps every supplier tiered, evidenced and in date — and tells you the day something lapses, not at the next audit.
| Supplier | Criticality | Assurance evidence | Review due | Status |
|---|---|---|---|---|
| Amazon Web ServicesCloud hosting · eu-west-2 | Critical | ISO 27001, SOC 2 Type II | 12 Mar 2027 | In date |
| Stripe Payments UKCard processing · sub-processor | Critical | SOC 2 Type II · PCI DSS | 08 Jan 2027 | Expires in 14d |
| CloudflareCDN and WAF | High | ISO 27001, SOC 2 Type II | 21 Feb 2027 | In date |
| [SUPPLIER]Transactional email | Medium | Questionnaire sent — 9 days outstanding | — | Chasing |
| [SUPPLIER]Payroll and HR | Low | Cyber Essentials Plus | 30 Sep 2027 | In date |
Illustrative example — not live customer data.
Score each supplier on the data they hold and the service they run, then let criticality drive the depth of diligence and the review cadence. A payroll vendor and a hosting provider shouldn't get the same 200-question form.
Issue due-diligence questionnaires from the platform and have replies summarised, scored and flagged where an answer contradicts the evidence attached to it — the same reading AuditVault does on the way in.
Each supplier carries a review date set by its criticality. AuditVault lists every review due in the next 30 days, drafts the reminder, and puts the dates in each owner's monthly digest, so no critical supplier drops out of assurance unnoticed.
Certificates, SOC 2 reports and insurance carry expiry dates. AuditVault emails the supplier's owner 60 and 30 days before one lapses and on the day, and keeps it in the work queue until the renewal is on file.
Record the companies each supplier relies on to serve you, what they do and where, beside its certificates, the data it handles and where that data is held.
One record per supplier from first assessment to exit: owners, contract dates, incidents raised against them, and an offboarding checklist with the evidence that access was actually revoked.
How it works
No re-keying, no spreadsheet of past answers, no chasing a supplier for a certificate that expired in March.
Your policies, certificates and past questionnaires on one side; your supplier list, contracts and their assurance reports on the other. Everything is indexed into one searchable vault.
Answers to inbound questionnaires are written from your documents and cite their source. Supplier replies are read the same way, scored against their tier, and flagged where the evidence doesn't support the claim.
Return the client's own template, or hand the auditor a supplier register with every review date, owner and decision on record — with the evidence trail behind each one.
One control set
Controls are cross-mapped, so the evidence you gather for ISO 27001 also answers the SOC 2 auditor and the NIST CSF assessment. Add a framework and see immediately what you already satisfy.
Four domains, one vault
Supplier due diligence never stops at security. AuditVault holds the legal, commercial and financial answers in the same vault, so one team can assess a vendor end to end.
Controls, evidence, the supplier register and the CVE risk register, in one place.
Explore CyberDPAs, sub-processor disclosures, contract dates, retention terms and clause precedent.
Explore LegalSupplier SLAs, uptime history, exit terms and the answers procurement always asks for.
Explore CommercialSupplier viability, insurance cover, business continuity and going-concern evidence.
Explore FinancialIllustrative example — not live customer data.
Vulnerability management
Every CVE gets an owner, a severity, a remediation SLA and a decision on record — across your own estate and the components your suppliers run.
UK data sovereignty
The reason UK buyers choose AuditVault over US-hosted GRC platforms — said plainly, near the top of the page instead of in the small print.
Every document, answer, supplier record and audit log is stored and processed in London. No international transfer, no adequacy question, no SCC paperwork.
Your evidence answers your questionnaires and assesses your suppliers. Nothing else. Committed contractually, not just stated on a page.
We hold ourselves to the standard we give you: our own supplier list is public, with notice before it changes.
Start solo and scale up, or bring the whole team in from day one. Every plan starts with the Cyber domain — add Legal, Commercial and Financial as your due-diligence load grows.
1 power user seat, up to 3 contributors
£195 /month
2 power user seats, up to 5 contributors
£395 /month
5 power user seats, up to 25 contributors
£1,250 /month
25+ seats, all knowledge domains
Talk to us
One UK-hosted platform for vendor risk management, supplier risk management, security questionnaire automation, and compliance with ISO 27001, SOC 2 and ISO 31000. See the full GRC software overview.