Supplier due diligence · Independent practice · Dublin, Ireland
Every finding in our reports can be traced back to a public source, so nobody has to take the result on faith.
Three sets of rules, one common demand: know your suppliers.
The international standard for managing information security.
An EU regulation on digital resilience in the financial sector, in force since January 2025.
An EU directive on cybersecurity for essential and important services. Ireland's transposing law is still moving through the Oireachtas, but the directive already shapes what covered organisations ask of their suppliers.
Built for the moment someone asks for proof.
This is for small and mid-sized companies that recognise themselves in one of these situations:
In each case a questionnaire will not satisfy anyone, and an enterprise platform costs more than the problem justifies.
The stakes are not abstract. NIS2 backs supplier oversight with fines of up to €10 million or 2% of global turnover, and holds management personally accountable for it. Documented due diligence is what stands between an obligation and a finding.
And to be honest about it: not every business needs this.
If you manage thousands of suppliers, a platform will serve you better.
If you have a handful of suppliers that matter and a customer or auditor who will look closely, you are in the right place.
Everything in the report can be traced back to where we found it.
Nothing goes into a report that cannot be walked back to its source. A customer, an auditor, or a supervisor reading an assessment can check any finding themselves, because every one of them comes from records that are publicly available.
We do not use a proprietary score and there is nothing hidden in the method. The sources are public. What you pay for is knowing where to look, what the findings mean against the framework your customer or regulator requires, whether that is ISO 27001, DORA or NIS2, and which findings need attention first.
The discipline comes from the open-source investigation world, where researchers publish their methods precisely so the work can be checked. We hold ourselves to the same standard, and it is what makes the work hold up under audit.
There are three ways to answer “how do you know your suppliers are safe?”
You send the supplier a form and they fill it in about themselves. Cheap and fast, but every answer is self-attested. When a customer or auditor asks how you verified the claims, there is no answer.
Self-attested
An automated score across thousands of suppliers. Useful at portfolio scale, but the method is proprietary, the score cannot be independently checked, and nobody reads your ten suppliers closely.
Unverifiable score
A person examines the public record on the suppliers that matter to you and writes down what it shows, with every finding traceable to its source. It is the only one of the three that survives a doubter.
Checkable evidence
All three have their place. We exist for the suppliers where someone is actually going to check.
One report per supplier, written so it can be checked.
Depth follows risk. A routine supplier gets a focused screening; most get a standard assessment; a critical supplier gets an enhanced one. Scope follows what your customers actually require, so you are not paying for work that does not apply to you.
Every finding traceable to its source and mapped to the specific controls your customer or certifier applies, whether that is ISO 27001 supplier controls, DORA, NIS2 or a combination.
Prioritised by risk, so you can see what needs attention first and what can wait until the next review.
Practical actions in a sensible order, with a realistic view of what can be fixed and by when.
Finding 3.2
The supplier's primary customer-facing domain permits TLS 1.0 connections, a protocol deprecated since 2021 and disallowed under the supplier's own published security policy.
Source: public TLS configuration of the supplier's production domain, verifiable by anyone, and the supplier's security policy as published on their website.
Maps to
ISO 27001 A.8.21
DORA Art. 28
NIS2 Art. 21(2)(d)
This is one finding from a full report. Read the complete sample report to see how the whole assessment reads.
An assessment describes a supplier on the day it was written. Certificates lapse, ownership changes, breaches surface, and infrastructure decays, which is why DORA and NIS2 both treat supplier oversight as continuous rather than one-off.
If you need the picture kept current, we re-run the same public-record checks monthly. Most months the result is a short note confirming nothing material has changed, which is itself evidence you can show an auditor. When something does change, you hear about it with the same source-traceable write-up as the original report.
When a customer puts you through due diligence, their assessor works from the same public record we do. A Supplier Readiness Check runs our method on your own organisation, so you see exactly what they will see, with a prioritised fix list in hand before the questionnaire arrives. Ask about it on the scoping call.
It is preparation, not certification: we show you what your own public record says, we do not issue a badge or vouch for you to a third party.
The work is done by hand.
A small senior team does the work, and your information is never handed to a third-party AI service, because that would put one more party inside the very supply chain you are trying to get under control. Our position is not against tooling. It is that every conclusion must rest on evidence a human has verified and can defend, and we hold every supplier we assess, including AI suppliers, to that same standard.
And the point of it all is not the certificate. It is knowing your suppliers well enough to keep working with them safely, which is why we treat the report as the start of a relationship rather than the end of one.
Independent by design. We sell no software, resell no platform, and answer to no vendor, so the assessment has only one customer: you.
Versioned, published, and checkable.
Every assessment follows a documented, versioned methodology. Each check names the public source it uses, such as the CRO register, IAF CertSearch, or a live DNS lookup, so any finding can be independently re-run by the reader.
Every report states on its cover the methodology version it was produced under. Issued reports are never altered afterwards; if a correction is needed, a new version is issued and the change is recorded. A report from months ago can always be read against the exact method that produced it.
Current methodology: version 1.2 (August 2026). Our published sample report was produced under version 1.2.
See the format for yourself. The sample is a full, illustrative report on a fictional supplier, classified TLP:CLEAR and free to share, so you can read exactly how a finding is worded and sourced before you engage us. No sign-up, no email required.
The complete methodology is shared with clients at engagement.
Every area we check is in the public record.
Three steps, no surprises.
You tell us who the supplier is and what your customer or regulator is asking for. We agree what the assessment needs to cover.
We work through the public record and map what we find to whichever of ISO 27001, DORA and NIS2 apply to your situation.
You receive the report and we talk you through it, finding by finding. We stay available afterwards to help close the gaps it raises.
How long it takes depends on the scope, but engagements are measured in days, not months.
The things people ask before they email.
Can your domain be spoofed?
Email spoofing is how invoice redirection fraud starts: a message that looks like it comes from your domain, asking a customer to pay into a different account.
Send us your domain name and we will check its email authentication, the SPF, DKIM and DMARC records that decide whether a receiving mail server trusts a message claiming to be from you. You get a plain-language answer: whether your domain can be impersonated, and how to fix it if it can. The same checks appear in our supplier reports, so this is also a small sample of how we work.
No cost, no obligation, and no follow-up sales sequence. One email out, one page back, always in the same fixed format. Checks are returned within three business days.
We check your own domain only, so please write to us from an address at the domain you want checked. We do not assess third-party domains for unrelated requesters.
Request the free checkContact
We are here to help you improve your compliance and security. A short, direct conversation is the best place to start, and replies come from the people who do the work, not an intake team.
We reply within two business days. The scoping call is free and carries no obligation: if the work is not a fit, we will say so.