One evidence-backed decision, before anyone signs anything
Every new vendor gets the same weighted rubric and mandatory gates. Every score names its evidence, and a good score can't buy back a failed gate.
From unknown AI tool to approved vendor
Follow one AI agent nobody signed off on, from the day it's spotted in use to an approval your security team can stand behind.
Find the AI tools already in use
Anyone can report a tool they or their team already use, with no form to fear. Granur flags personal data, missing contracts and missing security reviews, and starting an evaluation notifies the team and opens intake pre-filled.
Four steps, one clear outcome
Start one anytime — for an existing vendor, an existing contract, or a brand-new upload — or let it trigger automatically the moment a vendor is first flagged new at intake. Either way it runs once; a renewal skips it entirely, since that relationship is already vetted.
Started, any way that fits
Pick an existing vendor, an existing contract, or upload something new — or skip the wizard and let a new-vendor flag at intake open it automatically. Business purpose, who owns it internally, and — when a pilot is needed — what it has to prove are captured up front.
Scored with evidence
Each of eight dimensions gets a 0–5 score backed by documentation, a demo, a validated PoC, a reference customer, or a contractual commitment — never a self-reported number.
Checked against mandatory gates
SSO, SOC 2 Type II, data residency, and the integration you actually need are pass/fail — a strong score elsewhere can't buy back a failed gate.
Weighted into a recommendation
The eight scores roll into a weighted total, and together with the gate results and the strategic-risk fields, produce a clear Recommend, Recommend with Conditions, or Do Not Recommend.
Eight dimensions, weighted the same way for every vendor
The weights don't change based on what's being onboarded — a data provider, a platform vendor, and an AI agent are all scored against the same eight dimensions. What changes is what counts as evidence for each one (more on that below).
Every score names its source — so a 4/5 means something specific, not just a confident guess.
Illustrative scores — every real evaluation is scored 0–5 against actual evidence.
Four requirements a good score can't override
Pass/fail, checked independently of the weighted score — a vendor can score well everywhere else and still fail to clear onboarding.
Single sign-on (SSO) support
RequiredSOC 2 Type II report available
RequiredData residency meets requirements
RequiredRequired API / integration available
RequiredAll four are required. If any gate fails, the recommendation reflects it — regardless of the weighted score.
Every framework, screened honestly — never a silent pass
Attach the regulations that actually apply to a vendor — SOC 2, NIST AI RMF, NIST CSF, HIPAA, CCPA/CPRA, ISO/IEC 42001, the EU AI Act, and more — and each one expands into the controls that matter. Every control is marked Assessed, Estimated, or Not assessed, backed by real evidence; selecting a framework never marks it as passing.
Self-assessed against whatever the vendor actually supplied — a signed DPA, a current SOC 2 report, an ISO certificate. Not legal advice.
A data provider, a platform vendor, and an AI agent clear the same bar, differently
The eight dimensions and their weights stay fixed no matter what you're onboarding — but what counts as strong evidence for each one depends on what the vendor actually sells, or what the agent actually does.
Data & AI carries the evidence that matters most here: how coverage, volume, and freshness hold up against your actual use case, not just what the sales deck claims.
Typical evidence: a PoC validated against your own data, plus documentation of update cadence and schema.
Architecture & Integration and Performance & Scalability carry the evidence that matters most here: how it fits your stack, and whether it holds up at your volume.
Typical evidence: a live demo, a reference customer at comparable scale, and a contractual SLA commitment.
Security & Compliance and Data & AI carry the evidence that matters most here: what data the agent can access, what actions it can take without a human in the loop, and whether its behavior is bounded and auditable — not just how capable the demo looks.
Typical evidence: a sandboxed trial with scoped-down permissions, documented action boundaries, logs of what it actually did, and an ISO/IEC 42001 or CSA STAR for AI attestation when the vendor has one.
Two questions a weighted score alone won't answer
Beyond the rubric and the gates, every evaluation captures how dependent you'd become on this vendor — inputs the recommendation weighs alongside the score.
Once a vendor clears this, it lives in the full vendor directory — this rubric is a one-time decision, not an ongoing check-in. See vendor management, health tracking, and lifecycle
Run a real evaluation, not a guess
Pick a plan, flag a new vendor, and watch the weighted score, gates, and recommendation fill in.