Guide
How ComplianceCheckr works
ComplianceCheckr automates the first pass of third-party software due diligence. You supply the evidence, it produces a structured compliance and risk checklist you can defend.
1. Give it a source
Paste a vendor URL — a trust center, security page, or documentation index — or upload a PDF such as a security whitepaper, SOC 2 summary, or DPA (up to 20MB).
2. The checklist runs
ComplianceCheckr reads the evidence and grades the tool across six risk domains: security, privacy, compliance & certifications (including FedRAMP and CMMC), access control, availability, and contractual risk.
3. Read the verdicts
Each question gets a pass, attention, fail, or unknown verdict with the source text quoted as evidence and a recommended next action where relevant.
4. Keep the paper trail
Every review is saved to your account with an overall risk score and summary, so you can revisit the decision or hand it to an auditor later.
Tips for effective reviews
Point at the densest page
A trust center or security overview beats a marketing homepage. If the vendor publishes a security portal, use that URL — more evidence means fewer 'unknown' verdicts.
Upload the document when it's gated
Whitepapers, SOC 2 reports, DPAs and pen-test summaries usually sit behind a login. Download them and upload the PDF instead of linking to the download page.
Name the tool precisely
Use the exact product name and edition (for example 'Notion Enterprise' rather than 'Notion') so the findings match the tier you're actually buying.
Treat 'unknown' as a question, not a failure
Unknown means the evidence didn't cover it. That's your follow-up list for the vendor's security questionnaire.
Re-run after the vendor updates
Certifications and subprocessor lists change. Re-running a review keeps a dated record of what the vendor claimed at each point in time.
Run one review per source
If a vendor has both a public trust page and a private PDF, run both. Comparing the two often surfaces gaps between marketing claims and contract language.
Working as a team
Share an organization
Create a workspace under Organization, then invite teammates by email or share the join code. Owners and admins manage membership; every member can see the whole review history.
Switch scopes
On the reviews page, toggle between "My reviews" and "Organization" to see who reviewed what. Check the org list before starting a review — a teammate may have already covered the vendor.