Answers to the questions we hear most often about Vendor Pulse, Zeron's third-party risk management (TPRM) product.
What is Vendor Pulse? Zeron's TPRM product. You keep a vendor register, send questionnaire assessments and risk evaluations to those vendors, review what comes back, and track the risks that result.
What sections does it have? The sidebar carries Dashboard, Vendors, Master Data, ZIN Advisor, Documents, Reports, and Admin (with Management and Settings under it). Where ZIN AI is available, a second ZIN Advisor entry at the top opens the chat assistant.
What permissions do I need? Access is controlled by permission scopes rather than fixed job titles. Each section checks its own scope — for example vendor:view for Vendors and master:view for Master Data — and shows an "Unauthorized" screen if you lack it. See Vendor Pulse: Roles & Permissions Reference for the full list.
How do I add a vendor quickly? Go to Vendors and click Single Add. Start typing the company name — after 3 characters Vendor Pulse searches an external company profile database and fills in the details when you pick a match. Company Name and Company Domain are both required to continue. On on-premise deployments there are no suggestions; you type the name and domain yourself.
Can I load many vendors at once? Yes. Vendors → Bulk Upload, then Download Template, fill in the Vendors sheet and upload it. .xlsx and .xls, up to 15 MB. The import is all-or-nothing: if one row fails, nothing is imported.
What counts as a duplicate vendor? The same Company Name and the same Company Domain together. A matching name with a different domain is not a duplicate.
How do I classify vendors? With a Category and Subcategory on the vendor form. You define these under Master Data → Product & Service Categories. Both fields are optional.
What is Master Data? Your library of reusable questionnaire Templates, plus your Product & Service Categories. You build a template once and use it for many vendors. It was previously called MasterVault.
What is the difference between Standard and Custom templates? Standard templates come with the platform and are read-only. Custom templates are yours to edit and delete.
Can I change a Standard template? Not directly. Export it, edit the workbook, and upload it through Create Template as a new custom template.
What question types are there? Two: Single Choice and Text.
Which questions do my reviewers rate? Only the ones set to Organisation Remark Required in the template. Other questions are read but not rated.
If I add questions to a template, are they added to assessments that already exist? No. An assessment takes its list of questions from the template at the moment it is created. New questions appear from the next assessment created from that template, including the next cycle of a repeating assessment.
What are the assessment states? Three, shown by the status dropdown on a vendor's Assessment Process tab:
| State | Meaning |
|---|---|
| Upcoming assessment | Scheduled for a future date and not yet sent. The vendor cannot see it |
| Ongoing assessment | Sent to the vendor and waiting on them |
| Completed assessment | Submitted by the vendor and waiting on your review |
When does an assessment become Completed? When a vendor Admin clicks Submit Answers in the portal.
Why did a Completed assessment go back to Ongoing? Because your team clicked Submit Reviews. That emails your review to the vendor and reopens the assessment so they can respond and submit again.
Do I have to click Submit Reviews? Only if you want the vendor to act on your review. If you accept everything, leave the assessment under Completed assessment.
Can vendors respond directly? Yes, through the vendor assessment portal. There is no username or password: each person uses their personal emailed link and a one-time code sent to their email. Vendors have their own roles in that portal: Admin, Collaborator and Viewer.
Who on the vendor side can submit? Only an Admin. The vendor's SPOC is the Admin; colleagues they invite are Collaborators unless given the Admin role. Collaborators can answer everything but do not see a submit button.
What stops a vendor submitting? Any mandatory question that is incomplete — including one that requires evidence where no document has been attached.
Can I change an assessment after it has been sent? Only its Assessment Due Date, with Edit on the row. The name, template, scheduled date, interval and submission deadline are fixed at creation.
What happens when the due date passes? The row shows Overdue, reminders are refused, and the vendor can no longer open the portal for that assessment. Extend the due date to let them back in.
How does re-assessment scheduling work? When you create an assessment you can set an Assessment Scheduling Interval. Once that assessment is sent, the next one in the series is scheduled automatically one interval later. Leave the interval at Never repeat for a one-off.
Can I delete an assessment myself? Yes, with the vendor:assessment:delete permission: ⋮ → Delete on the row. It removes the vendor's answers too and cannot be undone. Deleting one occurrence does not stop a repeating series. See How to Manage Re-Assessment Schedules and Remove an Assessment.
Can I send a reminder? Yes — the row's ⋮ menu has Send Reminder under Ongoing assessment and Completed assessment. You can copy up to five extra business email addresses. It is refused once the due date has passed.
A vendor answered by email in a spreadsheet. Can I load it? Yes. Open the assessment, click Import Assessment, download the template, fill it in and import it. Use a ZIP to include evidence files.
How do things work on on-premise deployments? The assessment email carries the questionnaire as an Excel attachment instead of a portal link. The vendor returns the file and you import it.
Do evidence documents download when I click them? No. They open in a viewer inside the page. PDFs and images are shown; other file types offer a Download button.
Can the vendor see my private documents? No. Private documents are internal only.
Can I download all of a vendor's evidence? Yes. Export on the vendor's Documents tab, or in Documents, downloads a ZIP of the evidence for the questionnaire categories you choose.
What is a risk evaluation? A way to send specific identified risks — rather than a questionnaire — to a vendor and ask them to describe how they will handle each one and attach evidence. You start it on a vendor's Manage Risk tab: mark risks with Mark Evaluation, then use Risk Evaluation Actions → Send Evaluation.
Where do risks come from? Each risk carries a Risk Source: DRM, Assessment or Manual. Mark as Risk on an assessment answer creates an Assessment risk.
What lifecycle does a risk follow? Four stages: Risk Initiation, Risk Scoring & Prioritisation, Risk Management and Risk Closure.
What is the difference between Internal and External comments? External comments are shared with the vendor, who is notified. Internal comments stay within your team. External is selected by default, so check before you post.
Can I edit a comment I posted? Yes. Hover your own comment and click the Edit icon. It becomes a text box with Close and Save, and afterwards carries an italic (edited) marker whose tooltip shows the edit date.
Are there limits? You can only edit your own comments, and only within 15 minutes of posting. After that, post a follow-up comment. You can delete your own comment at any time. Comments are limited to 500 words.
Can I mention a colleague? Yes, on Internal comments: type @ and pick a user. If you mention someone twice in one comment, they get one notification.
Can vendors edit their comments? No. The vendor portal has no edit or delete action on comments.
What is the AI Questionnaire Assistant? A tool for your organisation when you are the one asked to fill in a security questionnaire. On ZIN Advisor → Questionnaire you upload the questionnaire file and ZIN drafts answers from your Knowledge Base for you to review, approve and export. A Chrome extension — offered as Add to Chrome from the Knowledge Base tab — does the same for questionnaires hosted as web forms. It is not used by your vendors.
What do Matched, Generated and No Match mean? Matched means the answer was reused from a close Knowledge Base entry. Generated means ZIN wrote it from related content. No Match means it could not answer. Confidence is green from 80%, amber from 50% and red below that.
What does the Checklist tab do? It turns a guideline or regulation into a list of questions you can add to a template. It accepts PDF only and reads only the opening part of a long document.
What can I import into the Knowledge Base? .xlsx, .csv, .docx and .pdf. Spreadsheets need Question and Answer columns. Existing questions are skipped, not overwritten.
What is Review with ZIN AI? A first pass over a vendor's submitted answers that proposes a verdict for each. It is switched on per organisation. See How to Review Assessment Answers with ZIN AI.
What is Vendor Analysis? An AI-generated view of a vendor, on the vendor's Vendor Analysis tab. The page carries its own note asking you to verify the content independently before acting on it. It is not available on on-premise deployments. See How to Use Vendor Analysis (AI).
Why can I not see the ZIN Advisor chat or the AI search bar? They appear only when the ZIN AI service is reachable from your deployment. When it is not, the entry is hidden and the chat page returns you to the dashboard. This is not a permission setting.
What is the Digital Risk tab? A view of a vendor's external, internet-facing risk. See How to Monitor Digital Risk (DRM).
Why is it Unauthorized? Three conditions must all hold: you have vendor:digital:view, the vendor has a primary domain recorded, and you are not on an on-premise deployment.
Why do I see "Unauthorized" on a page? Your group is missing that page's scope. An administrator can adjust it under Admin → Management. The Vendor Pulse: Roles & Permissions Reference lists which scope each area needs.
Why does a button appear but the action fail? Some controls are shown on one scope, or to everyone, while the action is checked against another — deleting an assessment and uploading a questionnaire are examples. The reference article has a table of these.
Symptom: No suggestions appear when typing a vendor name → Type at least 3 characters. On on-premise deployments there are no suggestions at all.
Symptom: A section shows "Unauthorized" → You are missing that section's scope. See the Roles & Permissions Reference and ask your administrator.
Symptom: The vendor did not get the assessment → Check the SPOC email on the vendor's profile, then resend with Send Reminder and ask them to check spam.
Symptom: The vendor has no Submit option → They are not signed in as an Admin. Ask the SPOC to submit, or have the vendor's Admin change that person's role.
Symptom: A vendor contact can read but not answer → They hold the Viewer role in the vendor portal. Their portal Admin can change it.
Symptom: The Edit action on my comment has gone → The 15-minute edit window has passed. Post a follow-up comment instead.
For more, see Troubleshooting Common Issues in Vendor Pulse.
Need more help? Contact support@zeron.one