Proof&Trust targets the supply-chain obligation created by NIS2 Article 21(2)(d), which makes the security posture of direct suppliers the responsibility of the buying organisation. Instead of chasing annual questionnaires across document stores, the platform ingests contracts, vendor masters and document repositories, then automatically validates the authenticity, validity and scope of certificates, attestations, SBOMs, penetration-test reports and policies.
Each artifact receives an evidence-grade score based on completeness, recency, source trust and control coverage. These scores roll up into a vendor risk index that is recalculated continuously rather than frozen at an annual snapshot, and vendors are auto-classified into tiers — critical/high, important/medium and baseline/low — according to dependency, concentration and evidence quality. Tier changes are timestamped, traceable to the underlying evidence, and exportable as audit-ready proof, so a new CVE or expired certificate can move a vendor up the risk ladder within minutes.
The vendor says a sample portfolio can be scored in under 30 minutes with no integration and no credit card, in an EU-hosted environment with data residency and encryption in transit and at rest. Reporting is mapped across all ten NIS2 Article 21(2) measures, and the platform also supports Article 23 incident-notification drafting with 24-hour early-warning timing. The offering is aimed at compliance, security and procurement teams in regulated sectors such as banking, energy, healthcare, telecom and the public sector.
