Know who you're doing business with.
Report Card grades the vendors you buy from using public records: sanctions lists, SEC filings, breach notices, exploited vulnerabilities and live security checks. Every finding links to its source.
Private preview: access is by invitation only.
- Sanctions & watchlists Clear
- Cybersecurity posture A
- Financial health B
- Breach & incident history A
- Exploited vulnerabilities C
- Questions to ask the vendor 2
What's in a report
One report per organization, graded on the same scale for every vendor, with the evidence behind each grade.
Sanctions & watchlists
US, UN, EU and UK sanctions and export-control lists. A name match is held for your team to review, never assumed.
Cybersecurity posture
Email and web security settings, exposed systems and known-vulnerable software, read from public sources. No intrusive testing.
Financial health
Ratios from SEC filings, plus bankruptcy filings, pension takeovers and layoff notices that cover private companies too.
Breaches & incidents
Breach notices filed with state attorneys general and HHS, and incidents disclosed to the SEC. Recent events count most.
Early warnings
Changes of ownership, distress filings, flaws under active attack and service disruptions, flagged as they happen.
Fourth parties & concentration
The cloud, email and AI providers each vendor relies on, and where many of your vendors share the same one.
How it works
Add your vendors
Search for any organization, or import your vendor list in one go.
Say what you use each for
A few questions about data, access and dependency set each vendor's inherent risk tier, so the findings that matter for you come first.
Stay current
Every vendor is re-checked each morning. You see what changed, and the questions worth asking the vendor.
Built on public records
Report Card reads official, published sources. It doesn't buy data about people, and it doesn't test or probe anyone's systems.
- SEC EDGAR filings
- US Consolidated Screening List
- OFAC sanctions lists
- UN, EU and UK sanctions lists
- SAM.gov exclusions
- CISA Known Exploited Vulnerabilities
- NIST National Vulnerability Database
- State attorney general breach notices
- HHS breach portal
- Bankruptcy court filings
- PBGC and WARN Act notices
- FEMA disaster data
- Public DNS and certificate logs
- Provider status pages
- A name match isn't a finding. Possible sanctions matches wait for a person to confirm or rule them out.
- Recent matters most. The last 12 months count fully; older events count less, and very old ones drop out.
- Every grade shows its evidence, with a link to the record it came from.
- Your vendor list is yours. What you enter about your vendors stays private to your account.
Private preview
Report Card is in a private, invite-only preview and isn't available for purchase. If you've been invited, sign in with the email address your invitation was sent to.