Vendor register, or synced in
Create a vendor with its basic details, or sync vendors from another system, then work them all in one place.
Vendor due diligence Run due diligence on your vendors
Classify each vendor on your own criteria, ask for the answers and documents you need, and keep it all on one record. Do the check before you sign, and prove you did.
Unlimited users • Free onboarding and support • No commitment
.jpeg)
.jpg)
.jpg)
.jpg)
-1.png)
.jpeg)
.jpg)
Vendor due diligence Meridian screens a new data processor in days, not weeks, and keeps the paper trail
Peter Lund is legal counsel at Meridian Nordic. With around 1,200 active suppliers and processors, onboarding a new cloud vendor used to mean a scatter of emails, a risk assessment in a spreadsheet, and a data processing agreement that someone had to chase for weeks. Now Peter classifies the vendor on Meridian's own criteria, sends one questionnaire that asks for both answers and documents, and the vendor uploads everything through a link. When it's approved, the contract moves straight into Contract Management with its renewal date and obligations in view.
-
A risk score built from Meridian's own parameters, not a black box.
-
The DPA and security documentation land straight on the vendor record.
-
The vendor responds from their inbox, so there's nothing to install.
-
Approved vendors carry a contract with obligations and a renewal reminder.
Vendor due diligence Start with the vendor, or sync it in
Everything hangs off the vendor record, so that's where you begin. Create it with the basic details, or sync your vendors in from another system and work them in .legal.
-
Register a new vendor with its basic information in a few fields.
-
Or set up an integration so vendors flow in from another system.
-
Everything you gather later lands back on this one record.
Vendor due diligence Classify the risk on your terms
Not every vendor needs the same scrutiny. You set up an internal assessment with the parameters that matter to you, and answering a few questions gives the vendor a risk classification.
-
Define your own parameters, like whether they handle personal data or how large the deal is.
-
Decide how critical each parameter is, so the score reflects your risk appetite.
-
Nothing is scored automatically, the classification comes from your inputs.
Vendor due diligence Ask the vendor directly
Once you know the risk, you ask for what you need. You design the questionnaire, both the questions and the documents, and send it to the vendor as an audit.
-
Pull information like their IT security measures with questions you write.
-
Request specific documents, the DPA, a code of conduct, a certificate.
-
The vendor uploads and submits, and it files itself on the vendor record.
Vendor due diligence No login, no friction for the vendor
The vendor is an outside party, so we don't make them join your platform. You register a contact, and they get a link in their own inbox.
-
The vendor opens a link, no account and nothing to install.
-
They can work with their own colleagues to answer and gather documents.
-
Everything they submit lands back on the vendor, gathered in one place.
Vendor due diligence One process for new and existing vendors
A new vendor and one you've worked with for years need slightly different questions, but it's the same engine underneath. So you set it up once and reuse it.
-
Build one questionnaire for onboarding and a second for existing relationships.
-
Put a periodic review in your annual wheel, say once a year per critical vendor.
-
Get a reminder in the system when it's time to send the updated questionnaire.
Vendor due diligence From approved vendor to live contract
Saying yes is the start, not the end. Once a vendor is approved, the contract goes into Contract Management and you manage it for as long as it runs.
-
Upload the contract with its metadata about the deal and the vendor.
-
Keep running audits with the vendor across the life of the contract.
-
Let AI help upload and tag the contract, and scan it against your best practice.
Vendor due diligence Rails, not a ready-made assessment
We give you the technical part, distributing a questionnaire and pulling documentation back from an outside party. We don't hand you a plug-and-play template set, because the right design depends on how you're organised.
-
You design the classification and the questionnaire, we distribute and collect.
-
A few templates exist to start from, like a data processor audit.
-
The risk decision stays yours, .legal runs the process, it doesn't vet the vendor for you.
Vendor due diligence Frameworks this covers
One due diligence process, several regimes that expect it.
-
NIS2
Learn about NIS2Show that you assess and monitor the vendors in your value chain, part of the supply-chain security an essential entity must run.
-
GDPR
Learn about GDPRDo due diligence on a processor and collect the data processing agreement before any data flows, in line with Article 28.
-
ISO 27001
Learn about ISO 27001Evidence that you evaluate and monitor supplier security, the supplier-relationship controls in Annex A.
-
DORA
Learn about DORAFor financial entities, keep due diligence and contracts on ICT third-party providers in order across the value chain.
Our Customers
+400
companies
+10.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
