What does Thirdsentry actually do?

Thirdsentry runs internal GRC and third-party risk management on a single data model. Internal posture (controls, policies, evidence, assessments, risks) and vendor posture (assessments, live external exposure, remediation) close on the same platform, with one agent drafting and reconciling across both surfaces.

Who is Thirdsentry built for?

Regulated mid-market companies, typically 200 to 2,000 employees, two or more active frameworks, and 50+ third-party vendors. Common buyers include GRC Managers, CISOs, and Heads of TPRM in fintech, insurance, healthcare SaaS, and other regulated B2B SaaS.

How do you catch a vendor whose reported posture stops matching reality?

The platform continuously compares each vendor's assessed posture (questionnaire-based) against live external exposure (continuous monitoring). When the gap exceeds threshold, divergence fires at Minor, Moderate, or Severe severity, the parent risk record updates, and a remediation task is generated automatically.

Where does the AI run, and is my data safe?

Primary inference runs on AWS Bedrock (Claude Sonnet 4.5) via STS AssumeRole, with no shared API keys and no third-party prompt proxies. Embeddings use Bedrock Titan v2. Tenant isolation is server-side via contextvars, so the model never sees another customer's data, every agent tool call is audit-logged, and a human approves every change before it reaches a published artifact.

Which frameworks ship out of the box?

The major frameworks ship system-seeded: SOC 2 TSC, ISO 27001:2022, NIST CSF 2.0, NIST 800-53 Rev 5, CIS v8.1, PCI DSS v4.0.1, HIPAA Security Rule, GDPR, NYDFS Part 500, and NYSDOH 405.46. You can also bring your own controls and evidence requirements via custom frameworks. Because the content is already authored, most teams have their first framework live in under two weeks.

How is Thirdsentry priced?

Flat-fee, unlimited users, AI included. The pricing axis is framework expansion, not seat count and not AI add-ons. Four tiers (Launch, Foundation, Professional, and Enterprise) sized from first SOC 2 through the regulated mid-market and enterprise scale.

The Agentic GRC Platform Built for Trust.

One system for every framework, every vendor, every questionnaire.

Live: a vendor’s assessed posture and their real-world exposure, side by side.

Live · Acme Vendor · 90-day window

Assessed postureLive exposure

Posture divergence detected

Assessed

Live exposure

Verdict

Aligned

The agent is monitoring assessed posture against live exposure. No action needed.

Illustrative outcome targets and sample data. What ThirdSentry is built to deliver, not a realized customer average.

60%
Less time on audit evidence. Collect once, reuse across every framework.
70%
Faster enterprise questionnaire turnaround with AI-drafted, cited answers.
Weeks
Go live in weeks, not a 6 to 12 month GRC rollout.
1
One flat fee, unlimited users, renewal capped at 10% in year two.

These are illustrative outcome targets: what ThirdSentry is built to deliver, not a realized customer average. Your results depend on where your program starts today. The pricing terms are not targets. Those are the terms.

The platform

Six jobs. One agentic platform.

One agent works across all six, on one set of records. Your controls, evidence, policies, vendors, and questionnaire answers are the same data, so work you do for one job counts toward the rest.

Compliance Program

Collect evidence once and satisfy every framework you carry, with controls tested continuously instead of once a year.

SOC 2 · Annual87% complete

Passed

142

Failed

Open

Controls & frameworks · Evidence vault · Continuous control testing

See the compliance program

Third-Party Risk

Score every vendor on business criticality, assessed posture, and live external exposure, and know the day those signals disagree.

Tier 1 vendors247 active

Acme Cloud

42Severe

Helix Analytics

74Moderate

Northbeam

91Compliant

Dual-Signal scoring · Continuous monitoring · Tiered drift alerts

See the vendor risk model

Security Review Response

Answer inbound SIG, CAIQ, and custom questionnaires from your own evidence, with every answer citing its source.

Inbound questionnaires8 active

Northwind Security Review92%

Meridian Vendor Assessment64%

Halcyon SIG Lite 202638%

Any format in, same format out · Cited answers · Trust Center portal

See questionnaire response

Policy Management

Run the full lifecycle from draft to retirement, with published versions locked immutably the moment they go live.

Information Security PolicyPublished

v1.0Jan 2024

v1.1Mar 2024

v2.0Sep 2024

v2.1Apr 2026

AI-assisted drafting · Named-reviewer approval · Immutable version history

See policy management

AI Governance

Inventory every AI use case, tier it against the standards your auditor recognizes, and route high-risk approvals through your control workflow.

AI use case registry12 tracked

Customer support copilot

High

Resume screening

Critical

Sales email drafting

Low

Use case registry · Risk tiering · NIST AI RMF, ISO 42001, EU AI Act

See AI governance

Fourth-Party Exposure

Map the subprocessors behind your critical vendors, so you know where concentration risk actually sits before an outage proves it.

Fourth-party concentration247 vendors

Cirrus Cloud

247 vendors

High

Paywave

89 vendors

Med

Relaystack

63 vendors

Med

Metricly

41 vendors

Low

Subprocessor mapping · Concentration risk · Critical vendor chains

See fourth-party mapping

The agent works on your data and your controls only, scoped to your tenant, with every action reviewed by a human and written to the audit log.

See how the agent works

Posture Divergence Detection

When the questionnaire and live exposure disagree, you find out first.

Three-layer scoring on every vendor: Business Criticality, Assessed Posture, and Live External Exposure. When the gap exceeds threshold, divergence fires automatically. The parent risk record updates, a remediation task is generated, and your owners get notified before the next reassessment cycle.

Three layers, one score

Severity tiered alerts

Auto-routes to owners

See how it works

Acme Cloud Storage

Tier 1 · Cloud infrastructure

Severe divergence

Business criticality88/100

Assessed posture87/100

Live external exposure42/100

Posture Divergence Detection

Δ 45 pts

Reported posture is strong (87) but live exposure degraded to 42. Reassessment fired automatically.

Parent risk record updated · remediation task assigned to David Chen

Illustrative example. Vendor and figures shown for demonstration.

How it works

Live in weeks. Then it keeps running.

01
Activate your frameworks
Pick from the major frameworks, already seeded, or bring your own controls. Overlapping controls map automatically.
02
Connect your evidence
Upload what you have and connect your cloud, identity, and ticketing systems. Evidence links itself to controls.
03
Onboard your vendors
Import your vendor list, tier it, and start assessed-posture and live-exposure scoring on each one.
04
Let it run
Nightly control tests, continuous vendor monitoring, and divergence alerts routed to owners. Your reviewers approve; nothing ships on its own.

Meet Effy

Your Agentic GRC Colleague, Not Another Chatbot.

Effy is one agentic colleague working beside your GRC team across audits, vendors, and questionnaires. It drafts policies, reconciles vendor signals, and answers security questionnaires with cited evidence, then routes every decision to the right human. The result: less manual work, fewer surprises, and audit and vendor cycles that close faster.

A human approves every changeEvery answer cites its sourceYour data stays your dataPause or undo at any time

Agent across your whole program

100%

Every action audit-logged

Human

Approves every decision

See how Effy works Read our AI safety statement

Effy

Your GRC colleague

Online

Draft the SOC 2 access review policy and tag every related control.

Drafted in policy library. Linked to CC6.1, CC6.2, CC6.3. Routed to David for approval.

Drafted7 sources cited2.1s

Answer the Northwind security review from our evidence.

Drafted 84 of 91 answers. 7 flagged for review (no matching evidence). Every answer cites its source, including Access Control Policy v2.1 and CC6.1 evidence.

Drafted91 sources cited38s

Ask Effy anything…

Illustrative example. Vendors and figures shown for demonstration.

Integrity stack

Enforced top-to-bottom in the data layer

Verified

01AUDITOR role
Read-only enforced in the database, not a UI permission toggle
02Immutable PolicyVersion
Locked at publish. Drafts and approved-but-unpublished stay separate
03Tenant isolation
getGrcOrgFilter enforced server-side, query-level, not config
04AuditLog + soft-delete
Every mutation logged; audit-significant records never hard-deleted

Defensible to your examiner, not just your auditor

Verified in codebase

Auditor-grade by architecture

Integrity is a property of the data layer, not a config setting.

Most platforms enforce auditor-grade behavior through RBAC configuration that admins can change. We enforce it architecturally: at the database query layer, in the schema, in the code path. An admin cannot accidentally weaken the guarantees, and an examiner can verify them in the codebase.

See the architecture

Latest Insights

Field notes from the GRC frontline.

Practitioner perspectives on vendor risk, compliance execution, and the operating reality of running a modern GRC program.

FAQ

Questions, answered.

Know the moment a vendor stops matching reality.

Bring your compliance and your vendor risk onto one platform, answer questionnaires in hours, and keep a record that holds up when your auditor asks. See it on your own vendors in a live walkthrough.

Book a demo See how it works