Know the Risk of Every Vendor You Share Data With

DPDPA S.8(2) requires every Data Fiduciary to ensure that any Data Processor they engage handles personal data only as directed and implements security safeguards that are contractually specified. This means: (1) a written Data Processing Agreement must exist before any processing begins, and (2) the DPA must specify security standards. DPDPA Shield's vendor risk module tracks both the DPA status and the vendor's actual security posture independently.

The score uses 5 factors with no paid APIs: Security Certification (30 points — ISO 27001/SOC 2/PCI-DSS/CERT-In full cert = 30, Type I/CSA STAR = 18, expired = 5, none = 0), Known Public Breaches (25 points — no breach = 25, historical = 8, recent = 0), Valid SSL/TLS (20 points — checked via Node TLS), Domain Age over 2 years (15 points — RDAP lookup), and DPO Formal Sign-off (10 points — 12-month review cycle). Total risk tiers: LOW (≥80), MEDIUM (60–79), HIGH (40–59), CRITICAL (<40).

DPA status (DPDPA S.8(2)) is a binary compliance requirement, not a risk factor. A vendor can have excellent security and still be non-compliant if you have no DPA with them. Conversely, a DPA doesn't mean the vendor is secure. We surface the DPA status as a prominent compliance banner on every vendor card so you can act on it independently from the security score.

Vendor Risk Intelligence is available on Growth, Business, and Enterprise plans. It includes automated enrichment, certification tracking, DPO sign-off workflow, and PDF report generation. Starter plan users do not have access to this module.