Vendor risk management
built for healthcare & SMBs
Track BAAs, assess third-party risk, and monitor vendor compliance without the $10K enterprise bundle. Cross-product intelligence from Compliance Shield + PhishSim included.
No sales calls · Email-only support · Self-serve onboarding
Everything you need to manage vendor risk
📋 BAA Lifecycle Tracking
Expiry alerts, missing clause detection, and subcontractor BAA chaining. Never miss a Business Associate Agreement renewal again.
🤖 AI Auto-Fill from Public Evidence
Pull SOC2 reports, HITRUST certs, breach history, and privacy policies to pre-populate assessments. Cut assessment time by 60%.
🔗 Cross-Product Intelligence
Vendor risk scores automatically factor in your Compliance Shield audit results and PhishSim staff training completion rates.
🏥 PHI Handling Classification
Tag vendors by PHI access level (full, limited, none) with automatic control mapping to HIPAA Security Rule requirements.
📊 Audit-Ready Exports
One-click PDF/CSV export of vendor inventory + assessment status for OCR audits. White-label available on Enterprise.
🔄 Continuous Monitoring
Quarterly or monthly re-assessment triggers, certification expiry alerts, and automatic risk escalation on Repo Scanner findings.
Transparent, self-serve pricing
No contracts · Cancel anytime · BAA included on all paid tiers
Starter
- Up to 15 vendors tracked
- 10 assessments per month
- AI auto-fill from public evidence
- BAA tracking + expiry alerts
- Quarterly continuous monitoring
- Audit-ready PDF exports
- Email support (48h SLA)
Professional
- Up to 50 vendors tracked
- Unlimited assessments
- Everything in Starter
- Full cross-product signals
- Monthly continuous monitoring
- PDF + CSV + API exports
- SSO / SAML authentication
- Email support (24h SLA)
Enterprise
- Unlimited vendors
- Everything in Professional
- Real-time continuous monitoring
- Custom integration & rules engine
- White-label audit reports
- Dedicated Customer Success Manager
- SLA guarantees
How we compare
| Capability | EdgeIQ Vendor Risk | UpGuard | Vanta | SecurityScorecard |
|---|---|---|---|---|
| HIPAA BAA tracking | ✓ Native | Add-on | Add-on | Limited |
| Standalone pricing | $499/mo | $10K+/yr | $10K+/yr | $15K+/yr |
| Cross-product signals | ✓ Compliance Shield + PhishSim | ✗ | ✗ | ✗ |
| AI auto-fill from public evidence | ✓ | Partial | ✗ | ✓ |
| Self-serve onboarding | ✓ | Sales-gated | Sales-gated | Sales-gated |
| Small practice focus | ✓ | Enterprise-first | Mid-market | Enterprise-first |
| Email-only support | ✓ | Phone/Slack | Phone/Slack | Phone/Slack |
Frequently asked questions
Is this suitable for small healthcare practices?
Yes. Vendor Risk is designed specifically for small healthcare practices (dental, therapy, chiropractic, optometry, med spa) and SMBs that need HIPAA-compliant vendor management without enterprise pricing or complexity.
Do I need Compliance Shield or PhishSim to use this?
No. Vendor Risk works standalone. However, if you also use Compliance Shield or PhishSim, cross-product signals automatically enrich your vendor risk scores at no extra cost.
What happens when a BAA expires?
You receive email alerts at 90, 30, and 7 days before expiry. Expired BAAs automatically downgrade the vendor's risk score and flag them in your audit-ready reports.
Can I import my existing vendor list?
Yes. Upload a CSV with vendor names and domains. AI will automatically pull public evidence (SOC2, HITRUST, breach history) to pre-populate each vendor profile.
Is there a contract or commitment?
No. All tiers are month-to-month with no contracts. Cancel anytime from your dashboard. Annual billing with 20% discount is available at checkout.
How does AI auto-fill work?
Our AI scans vendor websites, public certification registries (SOC2, HITRUST, ISO), the HHS breach portal, and your organization's past assessments to pre-populate questionnaire responses. Low-confidence answers are flagged for human review.
Ready to get your vendor risk under control?
Email us to schedule a demo or start your self-serve onboarding today.
Email [email protected]No phone calls required · Response within 24 hours