Vendor Security Review Automation — Vendor Lens

Vendor Lens answers the third governance question: what did the vendor agree to, who verified it, and what's still open? AI adoption leans on third-party services; the assurance burden arrives as PDFs, questionnaires, and reports.

What it automates

• Questionnaire collection — vendor intake forms collected and tracked from submission through return.
• AI questionnaire coverage — the intake includes a dedicated AI Governance and Monitoring section: a documented AI governance policy, an inventory of AI systems and AI-enabled tools in use, risk classification of AI use cases, data-protection controls for information shared with AI services, monitoring of employee AI use, assessment of AI vendors and third-party AI services, AI-specific incident response, safe-use training, security monitoring of operated AI systems, and an approval gate for new AI systems. Answers feed the deterministic rules engine — a missing AI policy or an incomplete AI inventory becomes a tracked finding, not a silent pass.
• SOC 2 report ingestion — service-auditor reports are parsed and stored, so reviewers work from the document's actual contents instead of memory.
• CUEC extraction and review — complementary user entity controls are extracted automatically, mapped into the review workflow, and tracked as items: who reviewed them, what the customer actually does for each, and whether evidence supports it.
• AI-assisted review — a model pass reads the questionnaire responses and the SOC 2 report text to draft findings, a second pass verifies them, and the analyst approves or rejects each one. Every line carries provenance — vendor statement, independent evidence, AI-extracted, or analyst decision — so nothing reaches a review outcome without a human decision.
• Review cycles — each vendor review runs as a cycle with statuses and history rather than a one-time checkbox exercise.
• Auditor-ready reports — review outcomes export into report formats suitable for auditors and customer security teams.

How uploaded documents are protected

Vendors hand over genuinely sensitive material — SOC 2 reports and supporting evidence — so document handling is built for least exposure:

• Documents never transact through the portal's application layer. Vendors upload directly to the platform's object storage using short-lived, pre-signed upload links — the application never holds the file during transfer, and there is no staging copy to breach.
• Every upload is verified and fingerprinted. Before a document becomes available for review, the platform validates the uploaded file and records a SHA-256 checksum, so reviewers always know exactly which artifact they examined.
• Portal access is scoped and single-use. A vendor's link is disclosed once, stored only as an irreversible hash, and never re-emailed. The link expires on its own schedule; submitting the questionnaire locks the answers while keeping the document room open, so requested documents can still arrive.
• Encrypted at rest. The storage layer enforces server-side encryption on the documents bucket by default — every upload is encrypted on disk automatically, and key management moves to a managed KMS on the production path.
• Access is minimal and audited. Downloads are issued as expiring, pre-signed links, and every read — vendor or analyst — is recorded in an append-only audit trail. Bulk evidence exports are audited as well, and public-facing endpoints are rate-limited.

Status

Vendor Lens is MVP complete, running as a self-contained review stack. A deeper AI vendor-governance rule domain — human oversight for material AI decisions, training-data and customer-data use restrictions, model and output logging, prompt-injection controls, AI subprocessor and foundation-model provider due diligence, bias and fairness testing, and AI incident response — is authored and lands in the rules engine as the platform work proceeds. Bringing it under the Mirino Labs platform umbrella — shared tenancy and the unified console — is on the roadmap.