MarTech Vendor Risk Assessment
Score any marketing technology vendor across security, privacy, compliance, data residency, and operational risk. Built on the SIG Lite + CAIQ frameworks. 42 questions across 6 categories, weighted scoring, export as PDF.
Procurement Intelligence
Signing a vendor contract without a risk assessment is how marketing teams end up on the front page.
Enterprise procurement needs a documented risk file for every third-party processor. Marketing teams usually skip this because the checklist feels like IT work. This tool compresses the SIG Lite + CAIQ framework into 42 marketing-weighted questions and gives you a defensible risk score the privacy and security teams will accept.
Vendor details
Assessment questionnaire
Overall risk score
–
of 100
Category breakdown
Report
Frequently asked questions
Why run a vendor risk assessment?
Enterprise procurement, legal, and security teams need a documented risk file for every third-party processor handling your data. Without it, GDPR Article 28 and SOC 2 CC9 are failures.
What frameworks does this follow?
SIG Lite from Shared Assessments plus CAIQ from the Cloud Security Alliance, both industry standards. Compressed into 42 marketing-weighted questions.
What score counts as "low risk"?
85+ overall, with no category below 70%. A vendor missing SOC 2 or GDPR DPA cannot score above 70 and should trigger review regardless of overall score.
Should I run this before signing or after?
Before. Procurement should block signature until a vendor passes a documented risk review.
How often should existing vendors be re-assessed?
Annually at minimum, and whenever the vendor undergoes a material change (acquisition, product rewrite, sub-processor change).
What is a sub-processor?
A third party your vendor uses to deliver its service: for example, their hosting provider or email relay. Sub-processor transparency is a GDPR requirement.
Does SOC 2 Type I count the same as Type II?
No. Type I attests to control design at a point in time. Type II attests the controls operated effectively over 6 to 12 months. Type II is stronger evidence.
What if a vendor won't sign a DPA?
Walk. GDPR Article 28 requires a written data processing agreement with every processor. No DPA, no engagement if any EU data is involved.
Can I use this tool for engineering vendors too?
The weighting is marketing-focused but the SIG Lite / CAIQ base covers general SaaS. For infrastructure (databases, hosting) use a dedicated infra security review.
What does "data residency" cover?
Where customer data physically sits and is processed. Matters for GDPR, Schrems II, and local data sovereignty laws (India's DPDPA, China PIPL, Russia 242-FZ).
Is the exported report defensible in an audit?
Yes as evidence of a structured review. Auditors look for a documented process, consistent application, and remediation of findings. Pair with a dated signature from the reviewer.
Does the tool store vendor data?
No. Everything stays in your browser. The report downloads locally.
Free · no account
SEORCE for Chrome, Edge and Firefox
Audits the page you are on: headings, meta tags, schema, indexability, and whether AI crawlers can read it. Export the result as a PDF. Free, with no account.
It audits one page at a time and does not track AI answers. About the extension
For teams and agencies
The whole job of search and AI, in one platform.
Rankings, AI visibility, technical fixes, content and reporting sit in one project. Reports export to Excel, PDF and Google Sheets on a schedule, and pricing is per project, never per seat.
3,000+ users · Free forever plan, no card needed