Open Source / Self-Hosted

Vendor risk management
done properly.

A production-grade application for tracking vendor risk scores, due diligence, review cycles, and compliance documents. Built to run on your own infrastructure, with your own data.

View Live Demo Book a Call
vrisks-demo.jermsmit.com
Vendor Risk Assessment dashboard showing KPI cards, risk tier distribution chart, and vendor register

Spreadsheets are not a risk program.

1

No audit trail. When a vendor's risk status changes, there is no record of who changed it, when, or why.

2

Documents go missing. Certificates, contracts, and assessments scattered across drives and inboxes with no expiry tracking.

3

Reviews slip through. Without a structured review schedule, overdue assessments go unnoticed until an incident forces the question.

4

No consistent scoring. Different people assess the same vendor differently, making portfolio-level comparisons meaningless.

"Most organizations know their vendor risk posture is a problem. The harder question is why they are still managing it in a spreadsheet two audits later."
Vendor Risk Assessment was built to answer that question with a practical, deployable solution.

Everything in one place.

Six core modules covering the full vendor risk lifecycle, from onboarding to ongoing oversight.

Vendor Register

Centralised catalog of all vendors with auto-assigned IDs, category classification, contract dates, contact records, and status tracking.

Risk Scoring

Composite scoring across five configurable domains with adjustable weights. Every scoring event is preserved, giving you a full history and trend line for each vendor.

Due Diligence

19 structured questions across 5 domains, fully configurable by admins. Per-vendor response tracking with completion progress shown at a glance.

Review Tracker

Schedule vendor reviews with due dates and status management. Overdue reviews surface automatically on the dashboard so nothing falls through the gaps.

Document Vault

Drag-and-drop document upload per vendor with expiry date tracking. Documents expiring within 30 days are flagged on the dashboard before they become a compliance gap.

Audit Log

Every write operation is recorded with user, timestamp, entity reference, and IP address. An immutable trail for auditors and internal governance reviews.

Four tiers. Clear thresholds.

Composite scores are calculated from weighted domain scores and mapped to one of four tiers. Thresholds are configurable by administrators to match your organization's risk appetite.

Critical

4.0+

Immediate attention required. Remediation plan and escalation path expected.

High

3.0+

Elevated risk. Active monitoring and documented mitigation controls required.

Medium

2.0+

Moderate risk. Annual review cycle and standard due diligence expected.

Low

<2.0

Minimal risk exposure. Lightweight monitoring on a standard review cadence.

Up and running in an afternoon.

A single installer script handles everything on Ubuntu. No containers required, no cloud account needed.

1

Install

Run the installer on any Ubuntu server. Node.js, PostgreSQL, and all dependencies are handled automatically.

2

Configure

Set your domain weights, tier thresholds, and due diligence questions from the admin panel. Defaults are production-ready out of the box.

3

Import

Bulk import your existing vendor list from an XLSX or CSV file. Each row is validated before anything is committed.

4

Operate

Score vendors, complete due diligence, schedule reviews, and track documents. The dashboard surfaces what needs attention.

Built on a modern, maintainable stack.

No proprietary runtimes. No vendor lock-in. Standard technologies that any capable engineer can maintain and extend.

FrontendReact 18, Vite, TanStack Query
BackendNode.js 20, Express, Prisma ORM
DatabasePostgreSQL 16
AuthJWT with rotating refresh tokens
Runtimetsx — TypeScript, no compile step
Servicesystemd — auto-starts on boot
Port8082, nginx-compatible
DeploymentBare metal or Docker Compose

Your infrastructure. Your data.

+All data stays on servers you control. Nothing leaves your environment.
+No per-seat SaaS fees. Deploy to as many users as your server supports.
+Automated database backup before every update. One command to roll back.
+Dark and light theme. Runs cleanly behind an nginx reverse proxy.
+SSO-ready with OAuth2 and SAML 2.0 provider stubs in the admin panel.
+Read-only public access. Authentication required only for writes.

Three roles. Sensible defaults.

Granular access control without the complexity. Assign roles manually or promote SSO users from the admin panel.

Viewer

Read-only access

Can browse the full vendor register, review scores, due diligence responses, and documents. No authentication required for this level — the application is read-accessible by default.

Editor

Full operational access

Can create and update vendors, submit risk scores, complete due diligence responses, schedule reviews, upload documents, and import vendor lists. The day-to-day working role.

Admin

Full administrative access

Everything an Editor can do, plus user management, identity provider configuration, scoring weight and tier threshold configuration, and access to the immutable audit log.

See it running. Ask anything.

The live demo is seeded with sample vendors across all four risk tiers. Book a call if you want to talk through deployment, customization, or what it would take to make this work for your organization.