Platform

Always-on agents collect the evidence, review it, and watch it so your team acts on conclusions, not raw data.

Four agents that run in the order the work actually happens, and two packages that decide how deep you go on any given third party. Run it standalone, or alongside the GRC and third-party risk systems you already have.

Get in touch

The ThirdPartyIQ flow from raw signal through assessment, finding and recommended action to human approval

The shift

Evidence first. Assessments second.

Existing third-party risk platforms are built around the questionnaire: send it, collect the answers, and leave your team to judge whether they meet what you require. ThirdPartyIQ changes the sequence: start from your requirements, assemble what is independently knowable, verify each requirement against it, monitor it continuously, and ask a third party only what the evidence cannot answer.

Today, questionnaire-first

Build and send a questionnaire with hundreds of questions to every third party
Chase documents by email, then wait for responses that arrive late or not at all
Read the answers and the SOC 2 reports by hand, then judge whether they meet your requirements
Re-assess annually, so risk changes go undetected between reviews

Weeks to onboard · Annual coverage · Hours of third-party time

With ThirdPartyIQ, evidence-first

Documentation is collected on your authority and kept current as new versions publish
Every document is read in full and each of your requirements is verified against it, with the source cited
What a third party reports is reconciled against what can be independently corroborated
Always-on agents monitor continuously and surface material change as it happens

Less than a day to a report · Always-on coverage · Minutes of third-party time

The agents

What the platform does

Each agent feeds the next. Collection makes the review possible, the review makes your requirements verifiable, and the assembled evidence is what lets monitoring tell you whether a change actually matters to you.

CollectIQ

Collect, without asking

Get every document a third party has already published, without sending a request.

Getting the documents is the hardest part of third-party diligence, and it is almost entirely manual today. CollectIQ finds the third party’s trust center, obtains authorized access on your behalf, and retrieves what is there. What cannot be retrieved is requested directly from the third party as a short document list, not a questionnaire.

Key capabilities

Trust center retrieval: Authorized access to the portals third parties already publish to.
Targeted requests: Only the gaps go to the third party, as a short document list.
Freshness tracking: Version detection and access status on every document, so a new release is caught the day it appears rather than at the next annual review.
Unassessed third parties: Payment-data reconciliation surfaces who is being paid but never reviewed.

CollectIQ showing 36 documents retrieved from a third party's private trust portal, with one remaining gap requested directly

ReviewIQ

Every page read, every finding cited

Turn a 90-page SOC 2 into a one-page decision.

Collecting the documents is only half the work. ReviewIQ reads each one in full, classifies it, extracts the structured metadata that matters (term, expiration, renewal, scope, auditor, period), and produces a cited report. What risk teams read by hand today becomes structured evidence that can be compared, monitored, and reused across every assessment.

Key capabilities

Full-document analysis: SOC 1, SOC 2 Type I and II, bridge letters, contracts, security overviews, insurance certificates, financials.
What ReviewIQ finds in a SOC 2: Exceptions and the controls they affect, controls pushed back onto you, systems left out of scope, subprocessors and fourth parties, bridge letter gaps.
Year-over-year comparison: What changed since the last report, in plain language, with the prior version cited.
Findings linked to source: Every finding carries the page and passage behind it.

ReviewIQ showing a SOC 2 control claim cited to the exact auditor test on page 40, awaiting analyst confirmation

AssessIQ

Requirements first, questionnaires second

Know whether a third party meets your requirements before you send a single question.

A questionnaire collects answers. A requirement is what your organization actually expects a third party to meet, and today your team is left to judge, form by form, whether the answers add up to it. AssessIQ starts from the requirements instead. Because the evidence is already collected and read, it verifies each requirement against that evidence directly, then maps the evidence and the result back to your control library and to whichever assessment questionnaire you need to complete. Your team qualifies the third party on requirements met rather than a form returned, the evaluation is shorter, and the third party sees a short residual list covering only what the evidence could not settle.

Key capabilities

Requirements verified from evidence: Each requirement tested against the collected documents and signals, with a citation and a confidence level.
Mapped back to any questionnaire: Evidence and results pre-fill your own assessment and the standard questionnaires you use, aligned to your control library and to expectations set by regulators and auditors.
Every answer sourced: The analyst confirms against the evidence rather than trusting the output.
Discrepancy detection: Where a third party’s own responses contradict the documents and signals, you see it.

AssessIQ governed evidence library showing 30 claims across six risk domains with confidence levels and source citations

MonitorIQ

Continuous monitoring that tells you what a change means for you

Know the moment a third party’s risk shifts, and know immediately whether it matters to you.

MonitorIQ tracks six risk domains and every document a third party publishes. The difference is the "so what." Each change is weighed against how critical that third party is and the specific services it delivers to you, and only the relevant ones arrive, as findings with the impact described in plain language and an action recommended.

Financial health
Cybersecurity
Sanctions
Legal
Reputational
Regulatory

Key capabilities

Impact-based findings: Findings explain the potential impact to your organization, not just the raw signal.
Criticality-weighted relevance: A change is scored against how critical the third party is and what it supports.
Recommended actions included: Investigate, escalate, mitigate, or accept, with the evidence cited.
Trigger-to-action log: What changed, what it meant, what was recommended, who decided. Exportable for an examination or audit.

MonitorIQ narrative explaining what a financial change means for the organization and the four impacts to validate

How it is packaged

Two levels of depth, chosen per third party

Not every relationship warrants the same attention. You choose the depth for each third party.

DiligenceIQ

Point-in-time diligence on one third party.

Agents included

CollectIQ
ReviewIQ
AssessIQ

Agents retrieve the documents, review them, verify them against your requirements, produce the cited diligence report, and pre-fill your assessment questionnaire. Starts from a short intake (who the third party is, what it does for you, what data or system access it has) and uses your own profile in the analysis. Fourth parties are identified, with the option to run diligence on each of them too.

For the third parties you need to understand once.

OversightIQ

Continuous oversight of one third party.

Agents included

CollectIQ
ReviewIQ
AssessIQ
MonitorIQ · 12 months

Everything in DiligenceIQ, plus a year of continuous monitoring across the six risk domains and every document that third party publishes, with version-diff reporting and an updated diligence report each time something changes. This is the package for critical and high-risk relationships.

For the ones you need to understand every day.

What a finding looks like

From signal to decision

Dashboards hand you the signal and stop. The same alert on two different third parties is two different answers, and context is the difference. Here is what happens when ThirdPartyIQ sees one.

MonitorIQ risk alerts showing what changed, what it means, and the recommended response for three third parties

A critical third party's financials weaken

The signal

Monitoring picks up late filings and weakening financial indicators at a third party your core operations depend on.

The reasoning

Agents correlate the signal against the financial statements on file, confirm the trend is real rather than noise, and weigh it against what this third party actually does for you.

What you receive

A finding with cited evidence, a specific recommended action, and a notification to the team that owns the relationship. Months before an annual review would have caught it.

A new SOC 2 report is published

The signal

A third party's updated SOC 2 report is retrieved the day it becomes available. Nobody requested it, and nobody had to.

The reasoning

The report is read against last year's: new exceptions, a subservice organization that was not there before, and a coverage gap the bridge letter does not close.

What you receive

Findings cited to the pages they came from, and a short set of targeted questions covering only what the report cannot answer.

A watchlist update matches a name

The signal

A sanctions screening update includes a name matching a principal at one of your third parties.

The reasoning

Agents check the match against the corporate records and evidence already on file, separating a false positive from real exposure before it interrupts anyone.

What you receive

A cleared alert with the reasoning logged, or an escalation with cited evidence and a recommended response. Either way, the record shows the work.

Our governing principle

AI recommends. Humans approve.

Examiners and auditors are paying close attention to how organizations use AI in high-stakes workflows. ThirdPartyIQ is designed to satisfy that scrutiny. The platform does the reasoning and shows its work, then presents a conclusion with the evidence behind it and waits.

Every recommendation is evidence-cited. Every decision is logged. The audit trail of what triggered each action is exportable for examination or audit. The professional judgment stays with your team.

AI reasons: Reads the evidence, correlates signals across domains, separates noise from real risk, and reaches a conclusion with the citations that support it.
Humans approve: Every risk rating, every assessment conclusion, and every document submitted to an examination carries a named approval.
Reviewers see: The cited diligence report on each third party, and an exportable audit trail: what triggered each action, what evidence supported it, who reviewed it, what they changed, and when they approved.

Consolidated intelligence

One connection to every risk domain. Decisions, not dashboards.

Most teams stitch together a separate source for each kind of risk, then spend their time reconciling formats and reading raw data off a dashboard. ThirdPartyIQ senses signals from licensed data sources, trust centers, and public records across every domain, consolidates and normalizes them into one portal, reasons across them alongside the evidence on file, and returns a clear risk rating and recommendation for each category. You connect once, not to a dozen sources.

Financial health
Cybersecurity
Sanctions
Legal
Reputational
Regulatory
- Documents
- Payment history

One connection, normalized

No juggling multiple data sources, separate logins, or mismatched formats. One portal consolidates and normalizes every source, so you stop assembling data and start using it.

Signals read against evidence

A signal on its own is noise. Because the source documents are already collected and structured, every incoming signal is correlated against what is on file for that third party before it becomes a finding.

One consolidated subscription

One subscription covers the data sources behind every domain, so you can broaden coverage without licensing each one or stacking separate point solutions.

See the platform in the context of your program

Tell us about your third-party inventory, your review schedule, and your team size. We’ll walk you through what ThirdPartyIQ looks like for your organization.

Get in touch