Build a governance practice
on rules that keep moving.

Support is by email at support@vividrisk.ai, answered by the team that builds the product. We will join a client call with you where it helps, and we would rather you ask than not. What we do not have is a staffed partner-enablement function: there is no assigned Partner Alliance Manager, no Solution Engineering bench, and no standing commitment to attend a set number of your client presentations. We would rather tell you the size of the company you are partnering with than have you discover it on your second deal.

Applications are reviewed by a person, not by an automated check, so we will not quote you a turnaround we cannot hold to — we aim to come back within two working days. Once your practice is approved you have the full partner console immediately and can onboard your first client straight away; the product is the training, and there is no course to sit first. To be plain about one thing: there is no Vivid Risk Practitioner certification. A self-paced practitioner assessment is a commercial proposal we have written down and not yet decided on, and until it exists the Certified tier is a commercial tier rather than a statement that anyone has passed anything.

The cross-mapper covers NIS 2, ISO/IEC 27001:2022, DORA and NIST CSF 2.0 today. For each control it finds the real matching text in your client’s own evidence and hands that to the model to judge, so one artifact can suggest coverage across several frameworks at once. Every suggested match is a draft for your review, not an automatic satisfaction of the control.

For organising and presenting evidence, yes — the vault gives auditors structured, exportable documentation with real upload timestamps and audit tags. Cryptographic hashing and a tamper-evident chain of custody are on the roadmap and not built, so we do not claim cryptographic non-repudiation today. Evidence file content is not stored at all: the vault records metadata, and you keep your own copy of every document.

Not yet, and we removed those claims from every live surface rather than leave partners selling them. AI system inventories, high-risk classification and conformity-assessment workflows are specified and not built. We hold the verified primary regulation text, so this is no longer blocked on sourcing; we are holding until the EU AI Office publishes the Fundamental Rights Impact Assessment template Article 27(5) requires, rather than shipping our own version that could diverge from it.

No. There are no OAuth connectors, no agents and no automated evidence collection — a claim you will see on most tools in this category and will not see here. Evidence is what you and your client record. That is the honest limit of the product, and it is why we sell it as a decision and reporting engine rather than as compliance automation.