AI agents for supplier assessments, grounded in your evidence.

Companies that sell technology, products or services to banks, payment institutions, insurers, fintechs and other regulated enterprises, especially in Europe. It brings sales, customer success, security, legal, finance and operations together around the work needed to onboard and support each customer.

No, and it is not only about security. MatchAudit works for the vendor, not for the institution. The institution runs its assessment. That assessment covers ownership and control, financial standing, information security, architecture and hosting, data protection, operational resilience, business continuity, subcontractors and contractual commitments. MatchAudit helps the vendor understand each request, use approved information again, close gaps, prepare a response and manage what happens next.

You upload the request your customer sent and the documents behind your answers as PDF, Word, Excel, CSV or images. MatchAudit reads the requirements, drafts each answer from your approved facts and documents, and shows the source next to every answer. Your team approves. You then keep a submission record of exactly what was sent, in which document version, through which channel and on which date, and you can export an approved report as CSV or JSON. MatchAudit does not fill in your customer’s own portal or template for you: your approved answers are there for your team to place into it.

MatchAudit does not assume one framework. It reads the requirements your customer actually sent, whether the request is shaped by DORA, the EBA outsourcing guidelines, an ISO 27001-based template, an industry questionnaire such as CAIQ or SIG, or a template the institution wrote itself. Each requirement is matched to your own facts and evidence, so the same approved information can answer differently worded questions from different customers.

The MatchAudit workspace and its AI assistance work in English, and most European institutions send their supplier assessments in English. If a customer sends you a request in another language, talk to our team before you subscribe so you know what to expect.

Your documents are not used to train AI models. Every AI call MatchAudit makes runs with provider-side storage switched off, and our model provider does not train on content sent through its API. The database, authentication and file storage run in the EU on Supabase in eu-west-1, Ireland. Evidence files are stored privately and downloaded through short-lived signed links. Subprocessors, and any processing outside the EEA, are listed on the Subprocessors page.

Yes. Send us the supplier assessment your company runs, or the one your customer has sent you about us, and our team will complete it. We do not hold a SOC 2 report or an ISO 27001 certificate and will not claim otherwise. The Security page states which controls are ours and which belong to our infrastructure provider.

€299 per month per workspace, excluding tax, including your first five billable customers. Billing is monthly with no annual commitment and no per-seat charge. Creating an account does not start a paid subscription: you review the price and approve a growth limit before authorizing payment. An owner or administrator can cancel renewal online at any time, and paid access continues to the end of the billing period.

There is no self-service trial. Subject to availability, a company with a live supplier assessment can request a complimentary sourced draft. The separate hands-on sandbox uses fictional data only and must not be used for real customer information.

Assume yes. Once you hold customer-related information in MatchAudit we are a subprocessor under your own customer agreements, and most banks and insurers expect to be told and to see us named in your subprocessor list. We publish our subprocessors, and the Security page sets out which controls are ours and which belong to our infrastructure provider. If your customer sends you a questionnaire about us, our team completes it. We do not hold a SOC 2 report or an ISO 27001 certificate, and we will not claim that your customer will accept us.

Keep them. Those are built around the answer: text to reuse, a page to publish, a form to fill in faster. MatchAudit is built around the customer relationship the answer belongs to — whether the answer is still correct for this institution, which document version you sent, who owes the missing item, what you promised and what that customer expects next. It reads facts from Vanta, OneTrust and ServiceNow, so information you already maintain keeps the record, field and date it came from, and the next questionnaire starts from approved information instead of asking your colleagues again.

AI reads the requirements, finds missing information and writes draft answers from your facts and documents. Your team checks the sources, approves the answers and decides what is shared. People still give the final approval and send the response to the customer. Public supplier requirements help you prepare. They are not the same as a request your customer sends you directly.

Keep them. MatchAudit connects today to Vanta, OneTrust and ServiceNow. Facts you map are read from those systems and keep the record, the field and the date they came from. An owner or administrator starts the synchronization; it does not run by itself in the background. Anything held in another system is uploaded or entered by hand and then behaves the same way. If the system your team relies on is not one of those three, tell us which one it is.

Create your account, confirm your workspace subscription, then add one customer and the information you already have. Use that customer’s request to find the first missing document or answer, and give it an owner. Setup time depends on how much information you add first, so start with the request that is open now. You can contact our team before you subscribe if you want to discuss how your team works.