Third-party dependency and operational resilience intelligence.
Understand what your organisation depends on, what risk those dependencies introduce, and maintain the evidence to prove they are being managed.
Dependency, risk and evidence live in three places. None of them is a record.
Regulated firms are required to know what they depend on and to prove they are managing that risk. Most of what they actually have is this:
The spreadsheet
One tab per vendor, last edited by someone who left. No history, no sign-off.
The inbox
Questionnaires sent, chased and answered in email. The evidence is an attachment nobody can find.
The supplier portal
A static assessment, answered once, reviewed annually if at all.
Most TPRM platforms tell you who your suppliers are. Ventry shows you what your organisation depends on, what happens when those dependencies change, and whether you have the evidence to prove you're managing it.
What needs attention, what changed, and what to do next
Regulatory returns from the same record
Record the relationship once. Ventry produces the files and shows you what is still missing — it does not submit on your behalf, and it does not determine that you are compliant.
UK Material Third Party Register
FCA, PRA and Bank of England. The official workbook, filled from your own register, with every value traceable to its source.
DORA Register of Information
The 15 official EBA templates, produced as an inspectable Excel intermediate and the xBRL-CSV reporting package.
Evidence manifest
Every export ships with a manifest binding each populated cell to its source record, sealed with a SHA-256 hash.
Third-party risk changes after onboarding
A supplier can pass assessment while what it provides changes underneath it. Ventry never decides anything for you — Watch, Launch and Exit each end in a human review.
- Watch
- Monitors supported changes across dependency, evidence, entity and regulatory context, and brings material changes back for human review. Every signal ends in a review, never a verdict.
- Launch
- Governs activation through unresolved risk, evidence, identity, dependency and regulatory context — and a named human approval, not a procurement workflow.
- Exit
- Tracks residual access, data, technology and downstream dependency through transition, so an organisation can prove what was actually removed, transferred, or consciously retained.
How Ventry protects your record
- Tenant isolation
- Every record is scoped to your organisation and enforced by row-level security in the database, not application logic alone.
- Insert-only audit trail
- The formal security audit log accepts inserts only — no role can update or delete an entry, for any record.
- Immutable evidence
- Evidence is hashed on upload. Superseding a file keeps the original intact; nothing is overwritten or silently replaced.
- Human authority, always
- Watch, Launch and Exit surface signals and gates. None of them approve, decide or file anything automatically — a named person always does.
Ventry does not hold or claim any third-party security certification. The above describes what the system does — not a compliance determination on your behalf.
Available to a limited number of design partners
Ventry is available to a limited number of design partners working in third-party risk, security and operational resilience.
Free — £0 · Starter — £149/mo · Professional — £399/mo · Enterprise — contact sales