Drop the SOC 2 in and the register fills itself: period, auditor, opinion, exceptions, carve-outs, each shown with the line it came from. Then StillVerified watches the bridge letter holding the gap and emails you 60 days before coverage goes stale, while the vendor still has time to answer.
No card. Magic-link sign in, so there is no password to manage.
Sixty, thirty and seven days before coverage ends. One digest per morning, not one email per vendor. Lapses get their own notice and keep getting it.
Upload the SOC 2 and the dates, auditor, opinion, exceptions and carve-outs come back filled in, each with the line they were read from. Your review and your decision still sit beside them, written by you.
Export the whole thing as CSV with coverage status and decisions included. Useful when an auditor asks for your third-party list and wants it today.
Logging one attestation by hand means opening a seventy page report and hunting for nine facts. That is the tax that kills vendor registers, and it is why yours is a spreadsheet with a calendar reminder you keep snoozing. Upload the report instead and the form comes back filled in.
It reads the report and reports what is in it. It does not tell you whether a vendor is acceptable, score the risk, or draft the memo, and it cannot tick the box that says you reviewed the complementary controls. Those are claims about your work, and in a year the only thing standing between you and an auditor is that the judgement in your register was actually yours.
It runs on Cloudflare Workers AI, inside the same account already serving the app. Your vendors' reports reach no company that is not already processing your data, and reading one does not store it.
A date tracker tells you when a report goes stale. The harder question is whether the report was worth much to begin with. StillVerified flags the places where "yes, we have SOC 2" turns out to mean less than you assumed.
The big compliance automation platforms are built for the company preparing for its own audit, and priced for it. This is for the other side of the table: the two-person security team, the small MSP, the county or city IT department, the SaaS company that just finished its first audit and now has to review forty vendors of its own. If you are doing this in a spreadsheet with a calendar reminder you keep snoozing, that is the job this replaces.
That is the only question this answers, and it answers it every morning.