Pass your customer's vendor due diligence in one round
Vendor due diligence usually takes four rounds because answers arrive without evidence and the customer's compliance team has to ask again. Audomate maps every questionnaire question to your documents, drafts an answer with a page citation, flags what you cannot prove yet and produces a one-page report written for the person who has to tick a box.
Written for the reader, not the writer
The customer's compliance officer needs the requirement, the evidence and where to find it. Not adjectives.
Every answer cites a page
“See Information Security Policy v3.2, section 7.1” closes the question. “Yes” reopens it.
Gaps flagged before your customer finds them
Audomate tells you what you cannot prove and drafts the missing document — so the questionnaire goes back complete.
Reusable
The same evidence pack answers the next bank's questionnaire in an afternoon.
Why questionnaires take four rounds
Round one: the vendor answers “yes” to 60 questions. Round two: the customer asks for evidence on 25 of them. Round three: the vendor sends policies; half of them do not say what the answer claimed. Round four: the customer's lawyer sends an addendum. Every round costs both sides weeks, and the answers are written at night by the vendor's founder.
What a one-round answer looks like
| Question (typical) | A weak answer | The answer Audomate drafts |
|---|---|---|
| Where is our data processed and stored? | In the EU. | Production: Google Cloud europe-west4 (NL); backups: europe-west1 (BE); support access from Poland. No transfers outside the EU. Source: Hosting and Data Location Policy v2, p. 3. |
| How will you notify us of an ICT incident? | We will inform you promptly. | Initial notification to a named contact within 4 h of classifying a major incident, an intermediate report at 72 h, a final one within a month. Source: Incident Response Procedure v4, section 5; aligned with the Art. 19 DORA deadlines. |
| Do you use subcontractors for our service? | Some. | Two: [cloud provider] — hosting, [provider] — email delivery. Neither supports a critical or important function. The list with locations and contract dates is attached; changes are notified 30 days in advance. Source: Sub-processor Register, 2026-09. |
| Can we audit you? | On request. | Yes: an annual audit right, access to premises and systems on 10 days' notice, and unrestricted access during an incident affecting your services. Source: Master Agreement, clause 14, aligned with Art. 30(3)(e) DORA. |
The one-page report
After the questionnaire, Audomate generates a summary the customer's compliance team can file: service scope, the regulation and articles assessed, requirements met, requirements met with a compensating control, open items with dates, and an evidence index. It is the document that ends the thread.
Questions we get most often
Updated 7 September 2026 · This page explains the rules in plain language and is not legal advice. What applies to you always depends on your own contracts and services.
Reach this outcome in four weeks
One regulation, your real documents, a cited gap list and remediation drafts — plus a verified mark if you pass.