93 Compliance
← When a customer asks how you vet vendors

Example · the Registers tab in 93 Compliance

Vendors and systems, with their owners and review dates

This is the vendor register of Fernhollow Health, a fictional company we use for demos: who gets its data, what they get, how much it matters, what assurance they gave (a SOC 2 report, a BAA), and when each one is reviewed next. 93 Compliance flags what an auditor or a customer would ask about, like a vendor with no owner. Nothing here is made up for the page: it's the demo company's own data as of 12 November 2026, gaps included.

7 vendors3 high criticalityNo vendor reviews due1 systems without MFA5 systems

  • Amazon Web Services

    Hosting (ca-central-1, us-east-1)

    Data: PHI: appointments, contact details

    Assurance: SOC 2 Type 2, HIPAA BAA

    Owner: Tom Becker

    HighNext 15 Mar 2027

  • Okta

    Single sign-on

    Data: Staff identities

    Assurance: SOC 2 Type 2

    Owner: Tom Becker

    HighNext 15 Mar 2027

  • Twilio

    SMS appointment reminders

    Data: Patient phone numbers, reminder text

    Assurance: SOC 2 Type 2, BAA

    Owner: Marcus Oyelaran

    HighNext 15 Mar 2027

  • Google Workspace

    Email, documents

    Data: Internal; some customer correspondence

    Assurance: SOC 2 Type 2

    Owner: Tom Becker

    MediumNext 15 Mar 2027

  • Stripe

    Billing clinics

    Data: Billing contacts, card tokens

    Assurance: PCI DSS Level 1

    Owner: Dana Whitfield

    MediumNext 15 Mar 2027

  • Zendesk

    Customer support tickets

    Data: Clinic staff contacts; occasional PHI in tickets

    Assurance: SOC 2 Type 2

    Owner: Marcus Oyelaran

    MediumNext 15 Mar 2027

  • Slack

    Team chat

    Data: Internal

    Assurance: SOC 2 Type 2

    Owner: Tom Becker

    LowNext 15 Mar 2027

What this register tells you

  • Each vendor was last reviewed on 15 Mar 2026 and is reviewed every 12 months, so the next review for all of them is 15 Mar 2027. 93 Compliance marks a vendor “Review due” when that date passes.
  • No vendor has an owner yet. That's the first thing a customer's security questionnaire asks (“who manages this relationship?”), so the register says so on every row.
  • Zendesk gets “Clinic staff contacts; occasional PHI in tickets”, and the assurance on file is SOC 2 Type 2 with no BAA listed. A healthcare customer will ask about that one.
  • Criticality (high, medium, low) says how much a vendor's failure or breach would hurt: the high ones are reviewed first.
  • The register downloads as a CSV, and goes into the audit package as it is.

Keep your own registers

Add vendors and systems by hand, or let 93 Compliance suggest them from your policies and website. Then set up quarterly access reviews in one click.

Start free