Testing and defence led by a published security researcher with five CVEs, including a CVSS 9.1 Mirai botnet kill-switch.
All security →SOC 2, ISO, CPCSC, and the Canadian privacy stack, run end to end with an independent auditor.
All frameworks →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Assessing a supplier that will touch your data or systems? Pick the risk areas that matter and build a security questionnaire you can copy and send to that vendor. Match the depth to the risk. A SOC 2 or ISO 27001 report can answer most of it up front.
Optional. Personalizes the questionnaire header.
Pick what is relevant to this vendor. Check every box under an area, or toggle the whole area.
Select at least one risk area to build your questionnaire.
Pick risk areas on the left to build your questionnaire.
It is how you assess the security of a third party before or during a relationship where they handle your data or connect to your systems. The answers feed your third-party risk decision and your own compliance evidence.
Match the depth to the risk. A vendor with access to sensitive customer data warrants a thorough questionnaire; a low-risk tool needs only the basics. Sending 200 questions to a low-risk vendor wastes everyone's time and slows your own procurement.
Often yes. A current SOC 2 Type II or ISO 27001 certificate can answer most of these questions with independent evidence. Ask for it first, then use the questionnaire to fill any gaps the report does not cover. If you are pursuing your own report, our compliance services can get you there.
Yes, it is free with no signup. If you need a repeatable third-party risk program rather than a one-off questionnaire, that is what our third-party risk management service builds.
Not ready for a call yet?
A few short notes from Jacob on managing third-party risk without turning every vendor into a project. No fluff, unsubscribe in one click. Reply anytime; it reaches him directly.
From Jacob Masse, founder of traztech. No spam, unsubscribe in one click.
Want it done for you?
Third-Party Risk Management
We build a repeatable program to assess and monitor your vendors, not just one questionnaire.
Explore Third-Party Risk Management →We stand up a repeatable third-party risk process: tiering vendors by risk, running assessments, and monitoring them over time so you are not reinventing this for every supplier.
See Third-Party Risk Management Book a callThis gives you the shape of the problem. traztech Workspace gives you a proper vendor register: tier every supplier by the data they touch, send them a questionnaire, keep the answers next to the controls that depend on them, and set the review date so it does not lapse. Start free and run your whole vendor list through it.
No credit card, no trial clock, no locked features. Traztech makes money when someone wants help closing the gaps, not from the Workspace itself.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation across 76 controls with zero exceptions, on a team of 15.