The working home for vendor and contract risk
Granur exists because security, procurement, legal and vendor-management teams deserve better than a shared inbox and a spreadsheet to vet every vendor and track every agreement moving through their organization.
What makes Granur different
Most companies run vendor due diligence through email chains, questionnaires and spreadsheets, with application owners and partnerships and procurement teams chasing security and legal for approvals by hand, and once the contract is signed the compliance checks are rarely looked at again. Granur puts every vendor, AI tool and agent through one pipeline, from due diligence and compliance screening against SOC 2, the EU AI Act, ISO 42001 and more, to obligations, renewals, spend and agent permissions tracked automatically, so application owners, partnerships, procurement, security and legal work from the same record instead of chasing each other.
Contracts don't move through an organization in a straight line — they get routed between intake, finance, legal, and security review, sent out for signature, and then tracked for renewal for as long as the relationship lasts. Most teams manage that whole lifecycle across email threads, shared drives, and a tracker that's always slightly out of date.
We built Granur to give that process a single home: one visual pipeline where a contract's stage, owner, and outstanding reviews are always visible, and where renewal dates and obligations surface automatically instead of depending on someone remembering to check.
Made for technology, AI and data vendors
A furniture supplier and an AI platform shouldn't go through the same review. Granur's checks, contract fields and alerts are shaped around the vendors technology teams depend on.
SaaS and cloud platforms
Where your data and your users live. Granur checks for SOC 2 and ISO 27001 evidence, tracks when those certificates expire, and flags notice periods before a contract renews.
AI models, tools and agents
Screened against the EU AI Act, NIST AI RMF, ISO/IEC 42001 and the OWASP Top 10 for LLM apps. For AI agents, Granur records what data each one can reach, what it may do on its own and what needs a person's approval, and asks owners to re-confirm that on a schedule.
Data providers and processors
Vendors that hold or process personal data are checked against GDPR, CCPA/CPRA, HIPAA and other privacy rules, and Granur pulls data-handling commitments out of the contract so they're tracked, not forgotten.
Infrastructure and developer tools
Usage-priced and fast-growing. Granur shows spend by vendor and category and which renewals carry the most value, so you can renegotiate before the window closes.
What changes for your team
Less time on every review
Contract details, dates and obligations are read straight from the uploaded agreement instead of retyped. Vendors upload their own security documents through a link, and each review lands with the right person automatically.
Less risk slipping through
Every vendor is screened against the frameworks that apply before it's approved, and followed up as certificates expire and AI permissions change, instead of being filed away after signing.
No surprise renewals
Notice dates and the value at stake surface well ahead of time, so you decide whether to renew, renegotiate or exit instead of finding out after the fact.
Audit-ready by default
Every approval, decision and change is recorded with who made it and when, so the evidence an auditor or customer asks for is already in one place.
Want to see it on your own contracts?
Bring your tracker over and watch it fill in the pipeline in minutes.