The deal is ready.
The supplier assessment isn’t.

B2B companies that sell software, cloud, data or outsourced services to banks, insurers, payment and e-money institutions and investment firms, especially in the EU. It fits best where supplier assessments arrive regularly, or you are starting to sell into financial services, and the work falls on a few experts such as the CTO, the security lead and the compliance lead. Sales, assurance, delivery and legal work from the same customer record.

No, and it is not only about security. MatchAudit works for the supplier, not for the institution. The institution runs its assessment. That assessment covers ownership and control, financial standing, information security, architecture and hosting, data protection, operational resilience, business continuity, subcontractors and contractual commitments. MatchAudit helps the supplier understand each request, reuse approved information, close gaps, prepare a response and keep what it committed to.

No. DORA applies to your financial customers, not to MatchAudit and not because of MatchAudit. MatchAudit helps you answer what those customers require and keep the commitments they put in your contract. It is not legal advice, and your customer still decides whether it accepts your answers.

You upload the customer’s questionnaire as Excel, CSV, Word, PDF or an image, or paste the questions, and keep your evidence in the Evidence library. MatchAudit drafts each answer from current library evidence and cites the passage it used. For an Excel questionnaire you can download the customer’s own workbook with approved answers placed in the answer cells you confirmed; questions that are not approved or not mapped are left blank and listed. You can also share approved answers and current documents through a customer evidence room. Every submission keeps a record of what you shared and the evidence versions behind it. MatchAudit does not submit anything to a customer’s portal: a person enters or uploads the response.

AI reads the questions, reuses answers you have already approved and drafts the rest from your current library evidence, with a citation for every statement. If no evidence covers the service, region or legal entity in scope, nothing is drafted and the gap is shown with its reason. You set the approval rule: answers that are fully sourced, current, in scope, free of conflicts and make no new commitment can be approved automatically, which is on by default, or you switch that off and approve every answer yourself. Everything else waits in Review as “Needs your decision”. From a signed contract, clear obligations with a clause reference are added automatically and uncertain ones wait in Review. Customer assurance reports are different: an owner or administrator approves each one, with a note, before it can be exported. Nothing is sent to a customer automatically; a person always exports or shares.

MatchAudit does not assume one framework. It reads the requirements your customer actually sent, whether the request is shaped by DORA, the EBA outsourcing guidelines, an ISO 27001-based template, an industry questionnaire such as CAIQ or SIG, or a template the institution wrote itself. Each question is matched to your own facts and evidence, so the same approved information can answer differently worded questions from different customers.

The MatchAudit workspace and its AI assistance work in English, and most European institutions send their supplier assessments in English. If a customer sends you a request in another language, talk to our team before you subscribe so you know what to expect.

Every uploaded file is malware-scanned before it is stored, then kept in private storage and downloaded through short-lived signed links. Members only see the Evidence library if they are given View or Edit access, and every view and download is logged. The database, authentication and file storage run on Supabase in the EU (Ireland, eu-west-1). Customer Assurance runs on Vercel functions in Frankfurt; Vercel’s global network delivers pages and routes requests from locations close to each visitor. AI features send document content to OpenAI, which processes it globally. OpenAI does not use data sent through its API to train its models unless a customer opts in; we have not opted in, and our organisation’s data-sharing options with OpenAI are switched off. Every MatchAudit request asks OpenAI not to store it in our account’s request logs; OpenAI may still keep API inputs and outputs for up to 30 days for abuse monitoring. The Subprocessors page lists every provider and its region.

Yes. Send us the supplier assessment your company runs, or the one your customer has sent you about us, and our team will complete it. We do not hold a SOC 2 report or an ISO 27001 certificate and will not claim otherwise. The Security page states which controls are ours and which belong to our infrastructure provider.

€199 per month per workspace, excluding tax, including your first five billable customers. Billing is monthly with no annual commitment and no per-seat charge. Creating an account does not start a paid subscription: you review the price and approve a growth limit before authorizing payment. An owner or administrator can cancel renewal online at any time, and paid access continues to the end of the billing period.

Yes, and without sending us anything. Start with the hands-on sandbox, which uses fictional data only and must not be used for real customer information, or read the complete sample response pack. There is no self-service trial on your own data. Subject to availability, a company with a live supplier assessment can also request a complimentary sourced draft; that runs behind a mutual NDA before any of your documents move.

No, and the public pages of this website never accept a document. The request form takes your work email, your company, who is asking and when it is due. We reply within one business day and arrange a mutual NDA; your customer’s questionnaire, your policies and your evidence stay with you until it is signed, and they are then uploaded into your own workspace rather than emailed to us. If you want to see the product first, the sandbox runs on fictional data: you can upload dummy or sample documents there, and they are deleted when your access ends.

Assume yes. Once you hold customer-related information in MatchAudit we are a subprocessor under your own customer agreements, and most banks and insurers expect to be told and to see us named in your subprocessor list. We publish our subprocessors, and the Security page sets out which controls are ours and which belong to our infrastructure provider. If your customer sends you a questionnaire about us, our team completes it. We do not hold a SOC 2 report or an ISO 27001 certificate, and we will not claim that your customer will accept us.

Keep them. A GRC platform such as Vanta runs your controls and certifications; an answer library or trust page is built around the answer. MatchAudit is built around each customer’s request and contract: whether an answer still fits this institution and this service, which document version you sent, who owes the missing item, what you committed to and what is due next. The next questionnaire then starts from approved information instead of asking your colleagues again.

Four, each in its own way, and all read-only. Vanta, OneTrust and ServiceNow bring the values you map into the Evidence library as facts; changed values wait for a person to review them, and each keeps the record, field and date it came from. HubSpot brings in companies, owners, contacts, contract value, deal stage and expected close date; those fields stay read-only in MatchAudit and nothing is written back to HubSpot. An owner or administrator starts each sync. Anything held elsewhere is uploaded or entered by hand. If the system your team relies on is not one of these four, tell us which one it is.

Start with the assessment on your desk. Create your account, confirm your workspace subscription, then add that customer and the evidence you already have. Use its questionnaire to find the first missing document or answer, and give it an owner. Setup time depends on how much information you add first. You can contact our team before you subscribe if you want to discuss how your team works.