Question 1

Can we run multiple parallel assessment tracks — security DDQ, DPIA, Transfer Impact Assessment, AI Impact Assessment?

Accepted Answer

Yes. Each assessment track is driven by a playbook you provide (or co-author with us). At setup we configure as many parallel "gates" as you need — for example a security gate, a DPIA gate, a transfer impact gate, and an AI impact gate — each with its own rules, evidence requirements, and pass/fail logic. A vendor only reaches "approved" when every gate is green.

Question 2

Can different people own different gates?

Accepted Answer

Yes. Each gate can have its own approver (or set of approvers). Ethira orchestrates the request — typically via Slack — so the right person is asked to sign off the right thing without anyone living inside the platform. Once they tick the box, the gate clears and the vendor advances to the next stage.

Question 3

How configurable is the risk rubric itself?

Accepted Answer

Fully. Out of the box Ethira ships with a generic risk model, but in practice every customer plugs in their own criticality model, weightings, and thresholds. If you have an existing playbook we ingest it; if you don't, we'll help you write one.

Question 4

If we update a playbook later, can we re-assess our existing vendor base against the new standard?

Accepted Answer

Yes. Update the playbook, re-run it across every onboarded vendor in one action, and you'll immediately see which existing relationships pass or fail under the new rules — without re-onboarding anyone.

Question 5

What does the agent fetch during onboarding, and how much of a DDQ does it auto-complete?

Accepted Answer

The agents fetch company and business standing data, certifications, data residency, data processing details, sub-processors, security posture, the legal documents (DPAs, sub-processor lists, policies), and recent news and incident signals. Roughly 40% of a typical DDQ is auto-completed on the first pass. The remainder is either bespoke to you (e.g. "assessor name") or requires a follow-up to the vendor — which Ethira drafts for you, ready to send from Slack or email.

Question 6

How does Ethira handle vendors with multiple products — e.g. Google with ten tools, Notion with several SKUs?

Accepted Answer

Each product is treated as its own assessable entity. The platform is rolling out an "umbrella" view that groups individual products under their parent vendor — so you'll see one parent record with N child product records, each with its own assessment. That means a new use case for an existing vendor triggers a fresh, scoped assessment rather than relying on a stale one against a different product.

Question 7

Can we remove sub-processors from the auto-fetched list — for instance, ones we've contractually excluded?

Accepted Answer

Yes. Ethira fetches the full sub-processor list by default — we'd rather over-fetch than under-fetch — but you can prune it freely to reflect the sub-processors you've contractually approved. The remaining list is the one used for monitoring and contract analysis going forward.

Question 8

What about software components that don't have a "vendor" — open source libraries, embedded code, components borrowed from elsewhere?

Accepted Answer

These live in the Ethira Inventory alongside your third-party SaaS. You can run a (configurable, lighter-weight) assessment against them, tag them with the products or systems they live inside, and bring them into your accountability chain. The assessment template differs from a typical vendor DDQ — there's no vendor to email a questionnaire to — but the surface area is in-scope.

Question 9

Do you cover AI tools, MCPs, and agents running inside our environment?

Accepted Answer

Yes. The Ethira Inventory is built to cover every actor in your environment — third-party SaaS, AI tools (yours and others'), MCPs, agents, datasets, microservices, repositories, devices. The goal is a single accountability chain across the full surface area, with linkages between actors so you can trace exposure end-to-end. The full inventory model is in active beta.

Question 10

How do you detect shadow IT and shadow AI?

Accepted Answer

Via the Ethira Chrome extension. It passively detects the tools your team uses, the PII types involved, and the sub-processors behind them. Everything it finds appears in your "Discovered" view, where you decide what to onboard, what to investigate, and what to block.

Question 11

If a sub-processor reports an incident, can we find every system in our estate that uses that sub-processor?

Accepted Answer

The underlying data model supports it — every fetched sub-processor is linked back to the vendor that uses it. We're confirming the exact in-product UX for reverse lookup and will follow up directly; if it isn't fully exposed in your workspace today, it's on the near roadmap.

Question 12

How does offboarding work?

Accepted Answer

Functionally simple today: a vendor is moved out of the active estate. The richer offboarding workflow — autonomous coordination of data return and deletion obligations, SLA-driven incident outreach, contract wind-down — is on the roadmap. Because every contractual obligation is already captured in the platform, that automation is a natural next step rather than a separate build.

Question 13

Can we maintain a "do not reassess" list — vendors we've already evaluated and turned down?

Accepted Answer

Yes. Anything that's been assessed remains in the data repository, so when someone tries to onboard a previously rejected vendor, the agent surfaces the prior decision rather than starting from scratch. We're confirming the precise UX for how that's surfaced in your specific workspace today and will follow up.

Question 14

Can Ethira flag redundant tools — e.g. "you already have five video editors, do you really need a sixth?"

Accepted Answer

Redundancy detection — surfaced at the point of onboarding so you can question a duplicate before approving it — is on the roadmap. It's a natural extension of the inventory: once every tool is catalogued with its category and use case, flagging overlaps becomes straightforward.

Question 15

Do we have to use the Ethira UI?

Accepted Answer

No. Most customers run day-to-day operations through Slack and MCP — Ethira is the system of record, but the operating layer sits inside the tools your team already uses. For example: outstanding-question follow-ups can be sent direct to vendors from Slack; approval requests fire into Slack with one-click sign-off; your RoPA and any other inventory data can be pulled into Claude (or any MCP-aware client) on demand.

Question 16

What contract and legal review integrations exist?

Accepted Answer

Three options, depending on your stack: run contract analysis natively inside Ethira against your playbook (pass/fail per rule, with the required action surfaced inline); send documents straight to Wordsmith (integrated end-to-end — outputs flow back into Ethira); or open the document in Claude with your playbook context for bespoke review. These aren't mutually exclusive; you can use any combination depending on the contract type and the team handling it.

Question 17

Can we add custom data fields — for instance bespoke columns in our RoPA?

Accepted Answer

Yes. The RoPA and any other view supports custom columns tailored to your reporting obligations. Tell us what you need and we'll add them.

Question 18

Where does our data live?

Accepted Answer

In your Ethira workspace, with role-based access. Approvers, business owners, and reviewers each see what they need to see; anything sensitive can be locked down by role.

Question 19

Can we pull our data out via API or MCP?

Accepted Answer

Yes. The RoPA, the vendor inventory, the contract analysis output, and the Discovered surface are all accessible via MCP — so you can query them from Claude, Slack, or any MCP-aware client without re-keying anything.

Frequently asked questions

Risk assessment & configuration

Vendors, products & sub-processors

Beyond third party — AI, MCP, agents, shadow IT

Operations — offboarding, blacklisting, redundancy

Integrations & where you work

Data, security & access