Build a governance practice
on rules that keep moving.

They go with the client. The practice owner can download one client’s whole workspace as a zip: every record tagged with that client, the registers as CSV, the client’s audit entries, and its evidence files up to 200 MB per archive, with any beyond that listed by name. If the client asks us directly, our Partners team can produce the same export. Every export is written to the audit log before anything is sent. Two things stay behind: your cross-map and Discovery work, which is your practice’s own analysis, and the report PDFs, which are drawn from the assessment data that is in the archive. If the client moves to another practice instead, we move its records across on the client’s request, and the new practice has to ask the client for consent.

Support is by email at support@vividrisk.ai, answered by the team that builds the product. We will join a client call with you where it helps, and we would rather you ask than not. What we do not have is a staffed partner-enablement function: there is no assigned Partner Alliance Manager, no Solution Engineering bench, and no standing commitment to attend a set number of your client presentations. We would rather tell you the size of the company you are partnering with than have you discover it on your second deal.

Applications are reviewed by a person, not by an automated check, so we will not quote you a turnaround we cannot hold to — we aim to come back within two working days. Once your practice is approved you have the full partner console immediately and can onboard your first client straight away; the product is the training, and there is no course to sit first. To be plain about one thing: there is no Vivid Risk Practitioner certification. A self-paced practitioner assessment is a commercial proposal we have written down and not yet decided on, and until it exists, every partner tier is a commercial relationship rather than a statement that anyone has passed anything.

The cross-mapper covers NIS 2, ISO/IEC 27001:2022, DORA and NIST CSF 2.0 today. For each control it finds the real matching text in your client’s own evidence and hands that to the model to judge, so one artifact can suggest coverage across several frameworks at once. Every suggested match is a draft for your review, not an automatic satisfaction of the control.

For organising and presenting evidence, yes — the register gives auditors structured, exportable documentation with real upload timestamps and audit tags. A file can be attached to each record and is stored with it. Each record is also added to your tenant's HMAC-SHA256 chain, so a later change to the record can be detected; the chain covers the record's details, including the file's name, type and size, not the file's bytes. That is tamper-evidence, not non-repudiation, which we do not claim.

You can keep each client's AI register in the AI Act workspace: the AI systems they use, a classification path for each that shows what their answers indicate, the duties that follow for their role with citations, and the records the Act asks for. Each client's AI systems count against that client's own plan, not yours. The console shows, for each client, whether the AI Act covers it, the band and how many systems are recorded. The client's own staff can be given read-only access to their register. It is not advice and not an assessment by Vivid Risk: It does not classify your AI systems for you. It shows what your answers indicate and the text behind it; the decision is yours. It does not file, register or notify anything with any authority, provider or person. It keeps your note of what you sent. It does not certify anything or carry out a conformity assessment.

In a narrow way, and only if your client chooses to. There are read-only connections for Google Workspace, Microsoft 365 and Microsoft Azure your client authorises, which read counts (how many accounts use multifactor sign-in, for example) and file them beside your client’s own answer. A connection never answers a control and never moves a score. There is no connector for any other system, and no software agent on anyone’s systems. Everything else is what you and your client record. That is the honest limit of the product, and it is why we sell it as a decision and reporting engine rather than as compliance automation.