Contact Analyst

For questions about what Vendorisk.ai does, whether it fits your procurement process, plans and seats, invoicing arrangements, or a press enquiry, write to [General contact email]. Billing changes you can make yourself - upgrading, downgrading, updating a card, cancelling - are faster through the billing page, which opens the Stripe customer portal.

Please do not send security findings or data subject requests to this address; they will be slower to reach the right person.

Requests to access, correct, delete, restrict, port or object to the processing of your personal data go to [Privacy contact email]. The same address reaches us for questions about our privacy policy and for a copy of the safeguards we rely on for international transfers.

What to include

• The email address on the account, so that we can find it.
• Which right you are exercising, and what you would like to happen.
• If your request concerns a specific workspace, its name - an account may belong to more than one.

Two honest notes. There is no self-service export or delete button in the product yet, so these requests are handled by a person rather than instantly. And where your employer administers the workspace, some content is theirs to decide about, so we may need to involve them.

Vulnerability reports go to [Security contact email]. Read the security disclosure policy first: it sets out what is in scope, what is not, our safe-harbour commitment for good-faith research, and what to include in a report.

One thing that is not a Vendorisk.ai security issue: a vulnerability in a company that one of our dossiers describes. Those are unrelated third parties, and the report belongs with them, under their own disclosure policy.

If you work for a company we have assessed, or you are named in a dossier, and you think we have it wrong, this is the route that matters. We would rather be corrected than be confidently inaccurate, and we treat a well-evidenced dispute as a bug report against our research. Write to [Disputes contact email].

What to include

1. The company - its name and primary domain, so that we match the right record and not a similarly named one.
2. The dossier URL - the page you are looking at.
3. The specific claim - quote the sentence, event, risk tier, score or citation you dispute. A request to review the whole dossier is much slower to act on than a pointer to one line.
4. The public evidence that contradicts it - a published statement, a regulatory filing, a status-page history, a current certification or audit report, a corrected or retracted news article. Public sources are what we can cite in a correction.
5. Your role - whether you are authorised to speak for the company, or are an individual named in the leadership notes.

How we handle it

Where a claim is not supported by the source we cited, or the source has since been corrected or withdrawn, we amend or remove the claim and re-run the assessment. Where a claim accurately reports what a public source said, we will normally keep it and annotate it with your response and any newer evidence, rather than deleting accurate reporting. If you are an individual named in a dossier and you object to the processing, say so explicitly and we will treat it as an objection under the privacy policy.

We do not accept payment, advertising, a commercial relationship or a threat as a reason to change a risk tier. Assessments are not for sale in either direction, and telling us so will not speed anything up.

We are a small team, so here is what is realistic. General enquiries: [Support response SLA]. Privacy and data subject requests: [DSAR response SLA], and in any event within the statutory period. Security reports: see the acknowledgement and triage targets in the security disclosure policy. Disputes: we will confirm receipt, tell you what we are checking, and come back with the outcome and any change we made.

What we cannot do: give legal, regulatory or security advice; certify or attest to any vendor's compliance; act as an intermediary between you and a vendor; or confirm what any other customer has researched. The nature and limits of the assessments themselves are set out in the terms of service.