Run the program. Prove it to the regulator.
Altisium holds supplier assessments, due diligence and continuous monitoring on one record, then derives the registers your regulator asks for from that same data. One system instead of a risk tool, a spreadsheet and a reporting scramble every quarter.
Self-serve demo workspace. No credit card, no call.
Most teams are doing both of these at once
The program work and the regulatory work draw on the same supplier facts. Altisium stops them being two separate exercises.
Third-party risk operations
Onboard, assess, score, monitor and remediate every supplier on one auditable record.
- Assessments, vendor portal and evidence trail
- Explainable composite risk scoring
- Continuous monitoring from 14 signal sources
- Issues, incidents and approval workflows
Regulatory and AI governance
Six supervisory registers derived from the data your team is already maintaining, plus an AI governance workspace.
- DORA, NIS2, SS1/21, OCC, MAS TRM, CPS 230
- Derived from live vendors, contracts and incidents
- Inline edits, submission history and exports
- EU AI Act, ISO 42001 and NIST AI RMF (preview)
The evidence exists. It is just in six places.
Questionnaires sit in a spreadsheet. Monitoring lives in another tool. Contracts are in a shared drive, incidents in a ticket queue, and the regulatory register is rebuilt by hand every reporting cycle from all of them.
Altisium connects them, so a signal in one place updates the score everywhere, and the register you file is a view of your live data rather than a separate document that goes stale the day it is finished.
A spreadsheet can hold the facts. What it cannot do is let six different filings read the same row, so that correcting one supplier corrects every report that mentions it.
One repeatable loop, every supplier
The same five stages run for every third party you onboard, so nothing is left to whoever remembered to chase it.
Vendor directory with tiering and dependencies, guided onboarding, an intake form you build from your own risk rubric, contracts with obligations mapped, and a renewal radar.
Campaign-driven questionnaires from a versioned template library and question bank.
A risk register with explainable composite scores, exposure lookup by entity or business unit, concentration analysis, and a monitoring inbox that turns external signals into work.
Issues and remediation with owners and due dates, incident handling with severity and SLAs, and multi-step approval workflows that record who decided what.
Analytics and reports on live data, scheduled board packs, saved views for the questions you ask every month, and a Trust Center you publish to your own customers.
Six jurisdictions on one engine
Each register is a definition over your live supplier data rather than a separate product. Adding a framework is a matter of data, not a release.
Register of Information across contractual arrangements, with concentration analysis and structured submission output.
Article 21 supply-chain measures tracked against your suppliers, with Article 23 reporting readiness derived from live incidents.
Important business services mapped to the suppliers underneath them, with impact tolerance recorded per service.
Interagency third-party guidance evidenced across the relationship lifecycle, assembled into an examiner-ready pack.
Outsourcing register under Notice 644 with the incident notification clock and board attestation captured alongside it.
Critical operations and their service providers, tolerance levels, and the notification trail regulators ask to see.
Regulatory registers are included on Growth and above.
Fourteen sources, checked between assessments
An annual questionnaire tells you what was true last year. These run continuously and move the score when something changes.
US Treasury listings plus a self-hosted OpenSanctions index, screened against the vendor entity.
Negative coverage and enforcement actions matched back to the supplier record.
Insolvency, charges and changes of officer, from the statutory register.
Published vulnerabilities in the technology a supplier runs, ranked by the likelihood of exploitation and raised to critical when CISA lists them as actively exploited.
Internet-exposed services and open ports on the supplier estate.
Supplier domains observed being used in phishing campaigns.
Security headers and browser-facing configuration on supplier endpoints.
Certificate health and protocol support, checked on a schedule.
The commercial OpenSanctions dataset, broader than the self-hosted index.
What a suspect URL actually resolves to, rendered and recorded.
Exposed data stores and credential material surfaced against supplier domains.
Whether supplier infrastructure is observed in scanning or attack traffic.
The AI Act clock is already running
High-risk obligations under the EU AI Act apply from 2 August 2026. Altisium keeps an AI system inventory, a fundamental rights impact assessment wizard, a serious-incident queue, training and deployer logs, an ISO 42001 Annex A statement of applicability across all 38 controls, and a NIST AI RMF maturity register.
System inventory and FRIA
Classify each AI system, record the Article 27 fundamental rights assessment, and keep the Article 73 serious-incident queue.
Annex A statement of applicability
All 38 reference controls with status, justification, evidence reference and owner.
Maturity register
GOVERN, MAP, MEASURE and MANAGE scored across the subcategory set.
A risk tool has to be trustworthy itself
We hold ourselves to the standards we help you enforce on everyone else. The detail is in the Trust Center, with no NDA to read the basics.
Controls mapped and operated in alignment with SOC 2. Not certified, not under audit.
Security managed in alignment with ISO 27001. Certification is on the roadmap.
Data minimisation and privacy by design, with a published sub-processor list.
EU hosting in Frankfurt today. US hosting available as a dedicated Enterprise deployment.
The questions risk teams ask first
Do I have to buy the regulatory modules to use Altisium?
No. The third-party risk platform stands on its own and is on every plan. The six regulatory registers are included from Growth upward, and they read the same supplier data the platform already holds, so there is nothing to migrate if you add them later.
How is this different from a security ratings tool?
A ratings tool gives you an outside-in score. Altisium runs the program: the assessment you sent, the evidence that came back, the contract, the incident, and the ratings feed if you connect one. The score is explainable because you can see every input that moved it.
What does the AI Act preview actually mean?
The AI-governance registers hold their working state in your browser and write through to the server when it is reachable. You can use them, and they are not yet at the maturity of the six supervisory registers, which are server-backed and derived from live data.
Can we try it without talking to sales?
Yes. A self-serve demo workspace takes about two minutes, comes pre-populated with example vendors and assessments, needs no credit card and expires after seven days. Every paid plan then starts with a 14-day trial that converts only when you add payment.
Where does our data live?
Production runs in the EU, in Frankfurt, including the database and encrypted backups. The full sub-processor list with each provider's region is published on the site.
See it run against your own suppliers.
A working session, not a sales pitch. We map Altisium onto the program you already run and show you what the register would look like.