You asked. Nobody checked.

What you stop doing

• Writing a questionnaire, and maintaining next year’s version of it.
• Sending it, chasing it, and explaining your own question to somebody answering it from memory.
• Reading a paragraph of free text and deciding what it meant.
• Booking the call to ask what an answer meant, and writing up notes nobody reads.
• Mapping each supplier’s answers onto your auditor’s framework, by hand, one at a time.
• Filing the result somewhere the next person to hold this job will not find it.
• Doing all of it again at renewal, for answers that may not have changed.

What you will be able to rely on it for

• A band for each of the ten categories — Strong, Established, Developing, Early, and Not assessed where nothing was measured.
• The weakest band any assessed category reached, stated once. A floor checks by eye, not by reading ten rows.
• The supplier’s Spartan Score, in full, because you are the buyer: it is shared with you and never shown on a public page. You can sort your suppliers by it, filter on it and see it move.
• The assurance level: whether they told us, whether we read their environment and checked, or whether we are still reading it.
• How many points behind those bands were confirmed by reading their environment rather than by being told. It is the line between checked and asserted.
• Who issued it, when, and what it is valid until, so a document you pinned last quarter says whether it is still current.
• The same document in English and in French, at one address, with one digest behind both.

What it keeps back until you ask, and why that is the reason it works

• The working. The evidence ledger, the risk ledger and the recommendations are not on the Passport. You will not need them on day one. When you do, for your auditors, you ask from the supplier’s Passport and the supplier releases them to you, or does not.
• Nothing the supplier did not decide to share. It is their document: private until they say otherwise, sent to you by a private link, public only if they choose to publish it, and they can withdraw it.
• Nothing about which products they buy, from us or from anybody.

A floor is a sentence, not a number

The most useful line on the page, and the whole of what you have to write down.

No category below Established.

Put it in the agreement, the onboarding standard, or the renewal clause. A percentage in a contract is something to argue about: whose number, measured how, rounded which way. A band is cleared or it is not. The Passport states the weakest assessed category once, so the check is one line for both sides. It is also a floor a small supplier can meet, and a standard nobody in your chain can reach is one you will end up waiving.

And you will be able to ask for what it does not show

A Passport is the result, not the working. When you need the working — the evidence ledger for your auditors, the audit report, the risk ledger, the evidence behind one category — you will drill into that supplier from your dashboard and ask from the Passport itself.

The request will be relayed inside the platform to the business that published it, and they release it or they refuse. We will never send a message in your name, from your address, or to anybody on your behalf. Exactly one message leaves, and it comes back to you: a confirmation that you hold the address you typed.

Confirming an address proves you hold that mailbox and nothing else. The supplier sees what you told them as claims, not as facts, and they may decline. That is their judgement, and you still have the relationship you arrived with.

None of this is open yet. Join the waitlist and you will hear first when reading a supplier’s Passport, and asking for what the page withholds, can be tried.

If you carry a portfolio rather than one supplier

Reading one Passport will not need an account with us: a supplier sends you a private link, and asking for more is a request on that page.

The moment you hold a list rather than a supplier, there is a second product, and it is the dashboard. The Passport Management Service is built for the person whose job this is — security, GRC, third-party assurance. It holds your suppliers in one view: how many are aligned, how many have fallen below your standard, your average Spartan Score, filtered by criticality, renewal date, score and compliance. It raises an alert when one is suspended, drops, or has not answered its report, and it lets you drill into any Passport and request its detail, including the evidence ledger for your auditors.

You will import your suppliers and set the standard you need from them, and the service will hold each of them to it.

Both sides bring their own community along: a buyer brings its suppliers and an MSP brings its customers, so security improves for everybody rather than one company at a time.

You cannot sign up for it on this page, and nothing here is open yet; we would rather say so than show you a tour. It will start as a conversation: what you hold your suppliers to is yours, not ours to assume.

You are also somebody’s supplier

This page is written from your side of the table, and you are only on that side for half of your week. Whoever buys from you is asking the same question, and somewhere in your organisation somebody is answering it from memory in a stranger’s spreadsheet.

The same document from the other end: one assessment about your own business, released by name to everyone who asks. At the first level, the whole product rather than a sample — which is also the strongest thing you can say to a supplier you are about to ask. At Verified, you can publish it at one public address, if you choose, instead of releasing it twenty times.