Pistos tiers every vendor by risk, runs the assessment, turns answers into findings, tracks the fix and records the decision, then keeps watching between reviews. Control frameworks, business impact analysis and a trust center live in the same platform, so your team stops chasing spreadsheets and email threads.
Match assessment effort to vendor risk: light questions for low-risk vendors, deep ones for the critical few.
Free for 30 days · No credit card required
Put your real vendor list into Pistos, send your first assessments and see your risk picture. You only need your work email — no credit card and no call with sales.
If you do not subscribe, your account becomes read-only when the trial ends, and your data is deleted 90 days later.
Up to 150 vendors and 10 team seats for the whole trial.
Nothing is charged and nothing renews by itself.
Confirm your email, choose a password and add your first vendor.
Two-step verification on every account, and each company's data kept separate.
No spreadsheets, no email threads — one record that follows each vendor from question to answer to finding to fix to decision.
Add your vendors, or start one from a Jira, ServiceNow or Salesforce request through the API (Growth and above). A short scoping questionnaire sets each one's risk tier and which modules they get.
Send questionnaires and watch vendor progress in real time. Vendors can forward the invitation to whoever should answer, and later rounds start from the last answers.
Validate each answer and record findings with severity. Optional AI suggestions help with free-text answers.
Track fixes to closure, then record and sign off the vendor decision.
Watch vendors between assessments, from public information and your own records, and share your trust center with customers.
One system of record for vendors, controls, evidence and the people who need to see it.
Send questionnaires, collect vendor responses and track completion progress from a single assessment tracker.
Configurable risk rules score every vendor automatically, so critical relationships surface without manual triage.
A short scoping questionnaire tiers each vendor and decides which modules they get. Then assess in rounds: each new round starts from the last answers, so vendors only confirm what changed.
Record findings with severity, owner and due date, track remediation to closure, and ask vendors for fixes. Every finding stays linked to the answer that raised it.
Approve, approve with conditions or reject each vendor, with sign-off from an approver. Open findings are flagged before a decision can be closed.
Get a suggested severity and rationale for free-text answers. You review and save; nothing is written for you. Optional, and switched on per company. Growth plan and above.
Between assessments, Pistos watches each vendor using passive public lookups and your own records: email-security, TLS and web-header gaps, new or risky domain changes, newly exploited vulnerabilities in the products they use, and overdue evidence and findings. Each vendor gets an explainable level, alerts and a daily digest. Signals are leads for a person to review; they never change the assessed rating. Growth plan and above.
Learn more →Add a vendor's legal name and Pistos screens it against the US OFAC sanctions list and, for listed companies, the SEC filings that report breaches and financial distress. Matches are by name, so a person always confirms or rejects each one, and a confirmed match raises the vendor's level. Included with monitoring.
Before anyone acts on something monitoring found, you can send the vendor a private one-time link to tell its side. The reply is recorded with the signal and your decision, and nothing is deleted. Included with monitoring.
Vendors get a 14-day invitation they can forward to the colleague who will answer, sign in with an emailed link instead of a password, and invite teammates onto the same account. Each new round starts from their last answers, so they only confirm what changed, then submit for review. Vendors always answer for free.
Your company home opens with an overall posture line, a risk picture of vendors by criticality, a ranked list of what needs attention first, renewals with their risk, and what changed since last week. Monitoring has a portfolio view too, and one click produces a PDF summary for leadership.
Already have a vendor's completed questionnaire in a spreadsheet? Import it against a vendor in your inventory instead of retyping. Pistos remembers how your columns map, so the next import is quicker.
Keep the policies, certificates and evidence each vendor must provide current, with expiry dates, reminders and one-time upload links.
Map control categories and requirements to your policies and procedures, and see SOC 2 and ISO coverage from the reports you review.
Model your environment, departments and assets to understand impact and prioritize continuity planning.
Publish certifications and security documentation, and manage inbound NDA and access requests in one place.
Consultants and MSPs manage every client's risk program from one login, with each client's data kept separate.
Start vendor assessments from your own tools, hear back when they finish, and let your team sign in with the identity they already have. Included in the Growth and Enterprise plans.
One API call creates the vendor (or reuses the one you have) and starts its assessment. Signed webhooks tell your system when the vendor submits and when a decision is made, and every request is safe to retry. Test keys let you build without creating anything.
Raise a vendor request in Jira, ServiceNow or Salesforce and have the assessment start from it. Step-by-step setup guides for each system are built into Settings, so your admin can copy and paste rather than write code.
Your team signs in with their Microsoft work account (Entra ID). Your company proves its own email domains and tenant, no accounts are created behind your back, and your identity provider's multi-factor sign-in applies.
Compare your Microsoft Entra ID directory with your Pistos users. Pistos suggests who has left or who is missing, and nothing changes until an administrator decides.
API access with 5,000 calls a month, webhooks, ticket setup guides, Microsoft sign-in and the directory check.
Everything in Growth, with unlimited API calls for high-volume programs.
A look at the screens your team works in every day. Illustrative sample data.
| Vendor | Finding | Severity | Status |
|---|---|---|---|
| Northwind Payroll | No MFA for admin accounts | High | In remediation |
| Contoso Cloud | Backups not tested this year | Medium | Open |
| Fabrikam Logistics | Security policy out of date | Low | Resolved |
Scaled to vendor portfolio size and program maturity.
30 days free, no credit card
30 days free, no credit card
| Starter | Growth | Enterprise | |
|---|---|---|---|
| Price | $500 / month | $1,200 / month | Custom |
| Vendors | Up to 50 | Up to 150 | Unlimited |
| Team seats | 3 | 10 | Unlimited |
| Vendor portal users (vendors answering assessments) | Unlimited | Unlimited | Unlimited |
| Vendor onboarding, inventory and assessments | ✓ | ✓ | ✓ |
| Question library, scoping and risk tiers | ✓ | ✓ | ✓ |
| Assessment cycles | ✓ | ✓ | ✓ |
| Findings, remediation and vendor decisions | ✓ | ✓ | ✓ |
| Artifact register, policies and procedures | ✓ | ✓ | ✓ |
| Reports and SOC 2 / ISO coverage | ✓ | ✓ | ✓ |
| AI-assisted finding review (optional, on request) | — | ✓ | ✓ |
| Continuous vendor monitoring | — | Up to 25 vendors | Every vendor |
| Sanctions and public-notice screening by legal name | — | Up to 25 vendors | Every vendor |
| Forwardable vendor invitations and colleague invites | ✓ | ✓ | ✓ |
| API access and signed webhooks | — | 5,000 calls / month | Unlimited calls |
| Start assessments from Jira, ServiceNow or Salesforce requests | — | ✓ | ✓ |
| Single sign-on with Microsoft Entra ID | — | ✓ | ✓ |
| Directory check (leavers and missing users) | — | ✓ | ✓ |
| Support | Priority | Dedicated CSM and custom SLA |
A vendor counts toward your limit while it is active and not archived. Vendors always answer for free. Company admins, reviewers and other staff use a team seat.
Give customers and prospects self-service access to your certifications and security posture, gate sensitive documents behind an NDA, and see who’s reviewing your program.
Run vendor risk and internal control programs from one system instead of scattered spreadsheets, and connect it to the tools you already use through the API and single sign-on.
Manage risk and compliance for every client engagement from a single, multi-tenant account.
A focused, guided questionnaire experience so responding to an assessment doesn’t become a project.
Authenticator-app codes with one-time backup codes. A used code cannot be replayed.
Each company’s data is kept apart, including every MSP client. A disabled account signs no one in.
Documents shared through the Trust Center are watermarked per recipient, and NDA-gated where you choose.
Sign-ins and security events are logged, and deactivated users are cut off at once.
API keys are shown once, can expire, be limited to your IP addresses and be rotated, and webhooks are signed. Your team can sign in with Microsoft, using your identity provider’s multi-factor sign-in (Growth and above).
Vendor uploads are treated as untrusted and are downloaded, never opened in the browser. Read our Privacy Policy and Data Processing Addendum.
Got questions? Here are the ones we hear most.
Pistos is vendor risk and compliance management software. It scopes and assesses vendors, turns answers into findings, tracks remediation and vendor decisions, and monitors vendors between reviews, with control frameworks, business impact analysis and a trust center in the same platform.
Only public information and your own records: passive lookups (DNS records, one TLS handshake and a few ordinary web requests), never intrusive scanning of a vendor's systems. For each vendor domain you add, Pistos looks at email authentication (SPF, DKIM, DMARC), the TLS certificate, web security headers, security.txt, new host names in public certificate logs, DNS entries that could be taken over, and domain registration. It matches the products you list against the CISA known-exploited-vulnerabilities catalogue, and it flags your own overdue documents, findings and assessments. You can screen a legal name against the US OFAC sanctions list and, for listed companies, SEC breach and financial-distress filings. Monitoring is on the Growth and Enterprise plans.
No. Monitoring gives each vendor a separate “what has changed lately” level that is explained signal by signal. It never overwrites the rating from your assessment. A person triages each signal, can escalate it to a finding, or can ask for an early reassessment, and Pistos never starts one for you.
Yes. You choose a signal and send the vendor a private one-time link. The vendor sees what was seen and where it came from, and can reply in writing. The reply is marked as unverified, changes no score by itself, and you decide whether to accept it or keep the signal. Name matches against sanctions or SEC filings are always confirmed by a person before they count.
Yes. An invitation link stays valid for 14 days, so the contact who receives it can forward it to the colleague who will answer. Vendors can also sign in with an emailed one-time link instead of a password, and invite teammates onto the same vendor account. Vendors never pay to answer, and they only see their own assessment.
Yes. Upload the completed spreadsheet and match its columns to Pistos fields once; the mapping is saved for next time. The vendor needs to exist in your Vendor Inventory first, and imported answers go through the same review and findings process as any others.
Security and compliance teams running an internal risk program, MSPs and consultancies managing multiple clients, and the vendors who need to respond to an assessment.
You configure the risk rules; Pistos scores every vendor against them automatically as assessments come in, so the riskiest relationships surface without manual triage.
Vendors get a focused, guided questionnaire experience — just what they need to respond to your assessment, not your full internal tooling.
A public page where you publish certifications and security documentation, and manage inbound NDA and access requests from prospects and customers.
Yes, on the Growth and Enterprise plans. Pistos has an API with signed webhooks, so a request raised in Jira, ServiceNow or Salesforce can start a vendor assessment, and your system hears back when the vendor submits and when a decision is made. Step-by-step setup guides for each system are built into Settings.
Yes, with Microsoft Entra ID on the Growth and Enterprise plans. Your company proves its own email domains and Microsoft tenant, no accounts are created automatically, and your identity provider's multi-factor sign-in applies. Pistos can also compare your directory with your Pistos users and suggest who has left.
Growth includes API access with 5,000 calls a month, webhooks, the ticket setup guides and Microsoft sign-in. Enterprise has the same with unlimited API calls. Starter does not include them.
Sign up for a free 30-day trial with your work email — no credit card needed. Prefer to talk first? Contact us and our team will go through your vendor list, frameworks and timeline with you.
