How to Manage a Vendor Profile and Onboarding Status

Overview

Every vendor has a detail page with seven tabs and an onboarding status. This article explains what each tab is for, how to read the Profile tab, how to edit a vendor, how to onboard, reject or put a vendor on hold, and how to use the vendor's Documents and Team tabs.

Prerequisites

vendor:view to open the vendor list and a vendor's page
vendor:add to save edits and to change the onboarding status
At least one vendor. See How to Add a Vendor.

Opening a Vendor

Navigation: Sidebar → Vendors → click a vendor row

The vendor opens on the Profile tab. The tab bar carries seven tabs, and the vendor's onboarding status sits at its right-hand end.

Tab	What it holds	What you need to see it
Profile	Summary cards and company details	`vendor:view`
Digital Risk	External scan results for the vendor's domain. See How to Monitor Digital Risk (DRM).	`vendor:digital:view`, a domain on the vendor, and a cloud deployment
Manage Risk	The vendor's risks and their lifecycle. See How to Manage the Vendor Risk Lifecycle.	`vendor:risk:view`
Assessment Process	Assessments sent to the vendor. See How to Send and Track Questionnaires.	`vendor:assessment:view`
Documents	Every document held against the vendor	`vendor:view`
Vendor Analysis	AI briefing on the vendor. See How to Use Vendor Analysis (AI).	A cloud deployment
Team	The vendor's own people who can work on your assessments	`vendor:view`

A tab you are not allowed to open shows an access-denied screen instead of its content.

Reading the Profile Tab

Header

The top of the tab shows the vendor's logo, name and domain, an Assessment Process progress bar, and a pencil icon (tooltip Edit Vendor Details). Below it are the description and four details: Revenue, Employees, Location and Risk Manager. A detail with no value reads Not provided.

Summary cards

Each card has an information icon explaining it.

Card	What it shows
Vendor Category	The vendor's tier, shown as Tier 1 to Tier 4. Despite its name, this card does not show the product and service category.
Vendor's Industry	The vendor's industry
Vendor Onboarding Date	The date the vendor's status was set to Onboarded
Last Assessment Date	The scheduled date of the latest assessment that has started or completed
Impact / Materiality	Low, Medium, High or Critical, with the vendor's level highlighted
Risk Rating	The vendor's risk band, from its assessment results
Compliance Status	The vendor's compliance level, from its assessment results
Total Risks	A chart of the vendor's risks by status: Pending, Planning, In Progress, On Hold, Completed and Waived

A card with nothing to show reads No data found.

Editing a Vendor

Navigation: Sidebar → Vendors → [vendor] → Profile → pencil icon

On the Profile tab, click the pencil icon next to the vendor's name.
Change what you need. The form has the same sections as the add-vendor wizard, plus the vendor's own details:

Section	Fields
Vendor Details	Vendor Name (required), Vendor Description, Revenue, Employee Count
Service Details	Purpose of Engagement, Outsourcing, Core/Critical, Is Technology (IT) Related ?, Is Back Office Vendor ?, Data Classification Levels, Impact / Materiality, Risk Assessment Required, Category, Subcategory, Industry, Remarks, PO Number, Tier
Vendor Registration Details	CIN No, GSTIN No, Contract Date
Vendor SPOC Details	Name, Email, Additional Vendor Emails, SPOC Contact Number
Organization Details	Business Owner, Additional Business Owner Email, Business Owner Department
Assign Vendor Manager	Assign Manager

When you have finished, click Apply Changes. While saving it reads Applying..., then you are returned to the profile. To leave without saving, click Back to Profile Details.

What you cannot change here: the company domain, logo and location are not part of the edit form.

Saving notifies the assigned manager by email. If you change the manager, the new manager is told the vendor has been assigned to them.

Changing the SPOC email

When you change the SPOC email, the new contact is added to the vendor's Team tab as Admin and is emailed to say they are now the point of contact.

If the vendor's status is Ongoing assessment and it has an assessment in progress, an extra step appears:

A Vendor SPOC Email Change Detected dialog explains that the new SPOC must be sent the assessment link. Click Continue to save, or Cancel to go back.
After saving, a Send Assessment Reminders window lists the ongoing assessments with their progress, due date and days left.
For each assessment the new SPOC should receive, click ⋮ in the Actions column and choose Send Reminder.
Click Close when you are done.

A SPOC name cannot be saved on a vendor that has no SPOC email. You see SPOC name cannot be updated without a SPOC email.

Changing the Onboarding Status

Navigation: Sidebar → Vendors → [vendor] → status drop-down at the right of the tab bar

Status	Meaning	How it is set
Assessment not send	No assessment has been sent to the vendor yet	The starting status. It is greyed out in the drop-down and cannot be chosen by hand.
Ongoing assessment	An assessment is under way	Chosen from the drop-down. No confirmation is asked for.
Onboarded	You have approved the vendor	Chosen from the drop-down, with a confirmation and remark
Rejected	You have declined the vendor	Chosen from the drop-down, with a confirmation and reason
On hold	The vendor is paused	Chosen from the drop-down, with a confirmation and reason

Onboarding a vendor

Open the status drop-down and choose Onboarded. The Confirm Vendor Onboarding dialog opens.
Tick I confirm that the vendor has been reviewed and approved for onboarding, with full awareness and acceptance of the associated risks.
Fill in Onboarding Remark — a short note on why the vendor is being onboarded or any risk considerations. It is required.
Click Confirm & Onboard Vendor. The button stays disabled until the box is ticked and a remark is entered.

The vendor's Vendor Onboarding Date is set to today.

Rejecting a vendor

Choose Rejected. The Reject Vendor Onboarding dialog opens.
Tick I confirm that the vendor has been reviewed and is not approved for onboarding.
Fill in Rejection Reason. It is required.
Click Decline Onboarding.

Rejecting is final from this screen. Once a vendor is Rejected the status drop-down is disabled and cannot be changed back.

Putting a vendor on hold

Choose On hold. The Put Vendor On Hold dialog opens.
Tick I confirm that the vendor assessment is being put on hold.
Fill in Reason for On Hold. It is required.
Click Confirm & Put On Hold.

A vendor that is on hold can be moved to another status later.

Where the remark shows up

The remark and the name of the person who changed the status appear when you hover the information icon next to the status drop-down, and when you hover the Vendor Status chip in the vendor list. If the vendor has a SPOC email, a status change also triggers an email notification.

The Documents Tab

Navigation: Sidebar → Vendors → [vendor] → Documents

This tab lists every document connected to the vendor.

Column	Description
Documents	The file name. Click it to open the document.
Document Type	Vendor Document (supplied by the vendor) or Private Document (uploaded by your team and never shown to the vendor)
Assessment Name	The assessment the file belongs to. Hover it for the template, category and question. Reads Not applicable for files not tied to an assessment.
Approval Status	Pending, Approved or Rejected
Risk Title	The risk the file is attached to, or Not applicable
Uploaded Date	When it was uploaded

To view a document: click the file name, or ⋮ → View. Files that cannot be previewed in the browser show Preview not available with the option to download.

To export documents:

Click Export.
In the Export Documents dialog, select the categories whose documents you want.
Click Export. The files download together and a confirmation reads Documents exported successfully.

Documents are not uploaded from this tab. They arrive from assessment answers, risk evidence and private document uploads. For the organisation-wide library see How to Use Document Central.

The Team Tab

Navigation: Sidebar → Vendors → [vendor] → Team

Team Members is a read-only list of the people on the vendor's side who can work on your assessments.

Column	Description
Name	The team member's name
Email	Their email address
Role	Admin, Collaborator or Viewer
Status	Invited, Active or Deactivated
Joined	When they joined the vendor's team
Last Active	When they were last active

The vendor's SPOC appears here as Admin as soon as a SPOC email is saved on the vendor. Other members are managed from the vendor's side — you cannot add, edit or remove team members from this tab. See How to Collaborate on Assessments.

Troubleshooting

The Profile cards say "No data found" → Risk Rating and Compliance Status come from assessment results, and Total Risks from the Manage Risk tab. They fill in once an assessment has been reviewed and risks exist.

The Vendor Category card shows a tier, not my category → That card displays the vendor's Tier. The product and service category is visible in the edit form.

Revenue, Employees or Location says "Not provided" → The company lookup had no value for them. Revenue and Employee Count can be typed in the edit form.

I cannot find the domain field when editing → The company domain cannot be changed from the edit form. If the vendor was created with the wrong domain, delete it and add it again with the right one.

Apply Changes fails → Editing needs vendor:add. Also check for Enter valid email!, Enter valid mobile No., Enter valid CIN No. or Enter valid GSTIN No. under a field.

"Personal email addresses are not allowed. Please provide a business email address." → Use a business address for the SPOC Email and Additional Business Owner Email.

The status drop-down is greyed out → The vendor is Rejected. A rejected vendor's status cannot be changed from this screen.

I cannot select "Assessment not send" → That status is only the starting state and cannot be chosen by hand.

The confirm button in the status dialog is disabled → Tick the confirmation box and enter the remark or reason. Both are required.

The Digital Risk or Vendor Analysis tab shows an access-denied screen → Both tabs are unavailable on on-premises installations. Digital Risk also needs vendor:digital:view and a domain on the vendor.

The Team tab is empty → No SPOC email has been saved for the vendor. Edit the vendor and add one.

"No SPOC email found. Please update the vendor SPOC email first." → You tried to send a reminder for a vendor with no SPOC email or additional vendor emails.

Need more help? Contact support@zeron.one