The platform vCISOs run on.
Fractional security leaders need a platform that scales across multiple clients without forcing each one into a separate spreadsheet. ThirdSentry's multi-tenant architecture and AUDITOR role were built exactly for this.
Run multiple programs without losing track.
Multi-client workspace
Each client is a separate tenant with full isolation. Switch contexts in one click. Effy and the evidence vault are scoped per-tenant, never bleeding across clients.
- Tenant isolation by architecture
- One-click context switching
- Per-client RAG namespace
Co-managed by design
Reviewer-approval workflows let your client team participate at the level you set. You drive the program; they participate where appropriate. Audit log captures every action by every actor.
- Configurable client participation
- Reviewer-override authoritative
- Per-actor audit trail
Partner support + pricing
Dedicated partner success channel. Volume pricing across clients. Quarterly business reviews focused on your book of business, not vendor metrics.
- Dedicated partner success channel
- Volume pricing across clients
- Quarterly business reviews
Frequently asked questions
How does ThirdSentry keep each vCISO client's data separate?
Each client is a separate tenant. Every database query is scoped to the client's organization, and the knowledge base the AI assistant retrieves from is filtered to that tenant too. Drafted policies, questionnaire answers, and risk records draw on that client's own controls and evidence plus the shared framework library, so nothing from one engagement carries into another.
Can we run both compliance and vendor risk for a client in one place?
Yes. Internal GRC and third-party risk sit on one data model. For each client you can run framework assessments, the risk register, policy approvals, and the evidence vault alongside vendor inventory, vendor assessments, and continuous external monitoring. A finding on a vendor and a gap in an internal control are reported from the same workspace.
Which frameworks can a vCISO run for clients on ThirdSentry?
Ten frameworks ship with the platform: NIST CSF 2.0, NIST SP 800-53 Rev 5, SOC 2, CIS Controls v8.1, ISO 27001:2022, PCI DSS v4.0.1, the HIPAA Security Rule, GDPR, NYDFS 23 NYCRR Part 500, and NYSDOH 10 NYCRR 405.46. Controls are cross-mapped, so a client adding a second framework reuses work already done on equivalent controls.
How do client staff take part without the vCISO losing control of the program?
Access is role-based and enforced on the server. Client staff can be given roles with narrower rights than the people running the program, and a reviewer's decision always overrides an AI-generated score. Every change is written to the audit log with the person who made it, so you can show a client or an auditor who did what.
Does the client's price go up when our vCISO team is added?
No. Every tier is a flat fee with unlimited users, so your consultants and the client's own staff can all have accounts without per-seat charges. AI features are included on every tier. Pricing scales with the frameworks a client runs, not with headcount, which keeps the cost predictable as the engagement team grows.