Decide with evidence, not questionnaires.
Governli is the Cloud Procurement Decision Platform. Run Vendor Due Diligence today, and expand into compliance, legal, risk and governance modules as your programme matures — all against the same evidence trail.
For Procurement, Information Security and IT Governance teams evaluating cloud and SaaS suppliers.
SOC 2 reports, ISO 27001 certifications, DPAs, security policies, contracts and other vendor documentation are analysed against your requirements to produce a transparent, traceable Decision Report (decision support). AI assists the analysis. Your organisation makes the decision.
Decision support for governance, risk and compliance teams. Not legal advice.
Vendor assessment · sample data
Northstar Cloud AB
- Requirements
- 42
- Evidence found
- 31
- Partial
- 7
- Evidence requested
- 4
Attention required
Partial evidenceData residency
Evidence confirms EU hosting. Subprocessor documentation indicates support access may occur outside the EEA.
Decision implication: Clarification required before approval
Illustrative sample data from a fictional vendor. Not a real customer assessment.
Designed for IT Governance, Information Security and Vendor Risk Management
Helping organizations assess vendors faster while maintaining governance, compliance and risk oversight.
The Governli model
Requirement → Evidence → Finding → Decision
Every Governli assessment follows the same traceable path. You start from your requirements, supplier documentation is reviewed against them, gaps become explicit findings, and a named reviewer records the decision.
- 01Requirement
Customer data must remain within approved regions
Requirements come from the Recommended Enterprise Baseline or your own policy set — fully editable.
- 02Evidence
Vendor documentation is mapped to the requirement
Supplier documents are reviewed against each requirement, with source citations retained.
- DPA.pdf
- SOC2-Type-II.pdf
- Subprocessor-list.xlsx
- 03Finding
Hosting location documented, support access unclear
Where evidence is incomplete or conflicting, Governli records a finding instead of a score you cannot trace.
Partial evidence - 04Decision
Review required before approval
AI assists the analysis. A named reviewer records the decision, and the rationale stays with the assessment.
Human decision
Findings you can act on, across the whole portfolio
A finding states what the evidence does and does not support, and what needs to happen next. Across your vendors, the Attention Center surfaces the assessments that need a human — awaiting supplier evidence, open findings or a pending review.
Illustrative sample data from a fictional example workspace.
Finding
Partial evidenceIncident notification
A notification process is documented, but no committed notification timeframe is evidenced.
Evidence reviewed
- Incident-Response-Policy.pdf
- SOC2-Type-II.pdf
Follow-up: Request contractual notification SLA
Vendor portfolio · sample workspace
12 assessments · 3 require attention · 2 awaiting supplier evidence
- In review
Northstar Cloud AB
31 of 42 requirements evidenced
- Attention
Example SaaS Ltd
2 open findings awaiting clarification
- Evidence requested
Sample Vendor AB
Awaiting supplier documentation
- Approved
Fjord Analytics AB
Decision recorded with rationale
Why Organizations Use Governli
Business outcomes for IT, Security, Compliance and Procurement teams.
Reduce Assessment Effort
Replace hours of manual document review with a structured, repeatable assessment methodology.
Improve Consistency
Apply the same methodology across all vendor assessments.
Support Compliance
Generate documentation that supports governance, audit and compliance processes.
Accelerate Vendor Onboarding
Help business and technology teams make informed decisions faster.
How It Works
Requirements-to-Evidence mapping in three structured steps.
1. Add requirements
Start from the Recommended Enterprise Baseline — built around common enterprise vendor due diligence practices and the areas organisations typically evaluate before approving a software supplier. It is not intended to replicate any single compliance framework and should instead be viewed as a professionally curated starting point that you remain free to customise. Fully editable from the first interaction to reflect your own policies, regulatory obligations and risk appetite. You can also upload your own from Excel, CSV or paste them in, or build from scratch.
2. Upload vendor evidence
Add any documentation that may serve as evidence — SOC 2, ISO 27001, DPA, security policies, architecture docs, pen test reports, BCPs, questionnaires, contracts, whitepapers.
3. Receive your Decision Report
Every requirement is mapped to evidence with status Evidence found, Partial, Evidence requested or Manual review — with source citations, gaps, conflicts and follow-up questions. AI assists the analysis; your organisation makes the decision.
View Sample Assessment Report
See exactly what you will receive before uploading any documents. The sample report shows the structure, findings, risk rating and recommended actions delivered for every vendor assessment.
- Executive summary for management review
- Risk rating with rationale
- Identified findings and missing controls
- Recommended actions before approval
- Evidence-based decision support summary
Security & Privacy
We understand that vendor assessments often involve sensitive documentation. Protecting customer information is a core design principle.
Encryption
All communication is encrypted in transit and uploaded documents are encrypted at rest.
Data Handling
Documents are processed solely for assessment purposes and customer data remains under customer control.
EU Storage
Primary database and file storage are hosted within the EU. AI analysis is a separate processing path documented on the Sub-processors page.
No Model Training
Customer documents and uploaded information are never used to train AI models.
Data Retention
Uploaded documents are retained only for the time required to generate and provide assessment results.
Future versions may provide configurable retention periods and immediate deletion options.
Transparent Pricing
Every customer receives the exact same Governli platform. Upgrade for greater assessment capacity — never for feature access.
Single Assessment
1 vendor assessment
Assessment Pack
5 vendor assessments
Professional
Up to 15 per month
About Governli
Governli helps organizations evaluate SaaS and IT vendors faster through structured, consistent and audit-friendly risk assessments.
The platform is designed to support IT, Information Security, Compliance and Procurement teams by transforming vendor documentation into clear decision support material.
By combining governance best practices with AI-assisted analysis, Governli helps organizations reduce manual effort, improve consistency and accelerate vendor onboarding without compromising risk management.
Governli is built on practical experience from enterprise IT, cloud services, vendor management, information security and governance processes.
Frequently Asked Questions
Where is data stored?+
Primary database and file storage are hosted within the EU. AI analysis is a separate processing path with no EU residency currently configured; processing locations and sub-processors are documented on the Sub-processors page.
How is my data protected?+
Uploaded documents are encrypted in transit and at rest. Access is restricted to the processing required for your assessment, and documents are deleted according to your configured retention period.
Is customer data used to train AI models?+
No. Customer documents and uploaded information are never used to train AI models.
How accurate are the assessments?+
Governli is decision support. Every conclusion is traceable to the underlying evidence, framework version and AI model version. Results are reviewed by appropriate stakeholders before any vendor is approved.
Can reports be exported as PDF?+
Yes. Every Decision Report can be exported as a PDF and attached to procurement tickets, change management records or audit trails.
Is Governli legal advice?+
No. Governli provides decision support for governance, risk and compliance teams. Final decisions should be reviewed by your information security, legal and procurement stakeholders.
Talk to the team behind Governli
Have a procurement deadline, security review or compliance question? We're happy to help.