THE LIGHTHOUSE {{ screenName }}
Demonstration Sample environment — every client, vendor, finding and rating here is fabricated Book a 30-min call
01 · Add vendors

Start with the spreadsheet you already have

Paste the list. Ten short questions per vendor and you are set up. After that the checks run every morning whether or not anyone logs in.

{{ m.kicker }} {{ m.time }}
{{ m.title }}
{{ m.body }}

Paste a list

One per line — a domain, a name, or both. Anything we cannot match gets parked for you, never dropped.

Starts automatically
{{ c.label }} {{ c.cadence }}

What we found

{{ parsedSummary }}

{{ parsedCount }}
VendorDomainStatusChecks {{ row.name }} {{ row.domain }} {{ row.klass }} {{ row.checks }}

Nothing is ranked until you answer the questions. A vendor you have not assessed shows as unassessed — never as low risk.
02 · Rank

Ten questions you can answer from memory

How badly would this hurt, and how exposed are you — only you know that. Their controls we find ourselves, and the ranking moves as we find them.

Vendor
How bad, how exposed
{{ irqProgress }}
{{ q.ref }}
{{ q.text }}
{{ q.why }}
{{ q.weightLabel }}
{{ subjectName }}
If nothing were in place {{ inherentPts }}
{{ inherentTier }}
{{ creditLabel }}
Where it lands {{ residualPts }}
{{ residualTier }}

{{ residualNote }}

What we credited
{{ creditSummary }}
{{ c.label }} {{ c.state }} {{ c.credit }}
Findings
{{ findingSummary }}

Each finding names the control it breaks. Closing one is a signed record, and the rating moves only as far as the evidence behind the closure allows.

Nothing open on this vendor.
{{ f.severity }} {{ f.id }} {{ f.controlLabel }} {{ f.status }}
{{ f.title }}
{{ f.detail }}
Your TPTH™ analyst closes this with a signed record.
Closure attestation · immutable {{ f.recHash }}
{{ r.label }} {{ r.value }}
A correction is a new record, never an edit.
03 · The Board

Worst first

Ordered by where you actually stand once controls are counted. Work down from the top and stop when you run out of Tuesday.

Tiles {{ tileCountLabel }}
{{ t.kicker }}
{{ t.title }}
{{ t.provenance }}
{{ t.big }}
{{ r.label }} {{ r.value }}
{{ t.foot }}

Tonight's ranking

{{ registerNote }}

#VendorRawAfter controlsEvidenceWhy it is hereFeed {{ v.rank }}
{{ v.fn }}
{{ v.scope }}
 {{ v.inherent }} {{ v.residual }}
{{ v.driver }} {{ v.feed }}
04 · Evidence

Ask once, or stop asking

Two ways to close a gap: send a short request for one specific document, or have the vendor connect a read-only feed once and never answer an assessment again.

The offer we make your vendors

Connect read-only access once, and we stop sending questionnaires. They answer the same questions fifty times a year — this is the way out.

{{ t.value }}
{{ t.label }}

What we cannot see

{{ gapCount }}

Tick what to ask for. Each line names one document, not a topic.

{{ g.label }} {{ g.badge }}
{{ g.detail }}

Send it

{{ previewLabel }}
To: {{ toAddr }}
{{ previewSubject }}
{{ p.text }}
{{ previewFooter }}

Trust portal — how much it defrays

Following the TPRA Trust Portal Guidance means a portal is worth connecting to. How much assessment it replaces depends on one thing: how often the vendor commits to refreshing it.

{{ portalConformance }}
At this commitment level
{{ portalVerdict }}

{{ portalNote }}

A missed refresh does not quietly downgrade the vendor — it reopens the assessment and tells you why.

Portal conformance
{{ p.mark }}
{{ p.label }}
{{ p.detail }}

Ways a vendor can connect

Read-only, revocable, scoped to posture facts — never customer data. Each one retires a set of questions permanently.

{{ c.name }} {{ c.status }}
{{ c.body }}
{{ c.retires }}
05 · Frameworks

Only if someone is asking

Off by default. Turn one on and the checks you already run get mapped to its control families — so you can answer an auditor without building a second program. Coverage figures in this demo are illustrative.

Maturity, by domain

A level per domain, not a grade out of a hundred. Level 1 is ad-hoc; level 5 is measured and improving.

{{ maturityOverall }}
{{ m.domain }}
{{ m.levelName }}
{{ m.note }}

Levels are derived from what the platform can observe about your program — cadence, coverage, evidence quality and whether findings get closed. Mappings reference each framework's published control set; they are not a certification.
06 · Agents

Which checks run, and when

You are not building agents — you are tuning the four that exist. Anything a live framework overlay requires stays locked on.

{{ enabledLabel }}
{{ a.num }}
{{ a.role }}
{{ a.name }}
{{ a.stat }}

{{ a.blurb }}

{{ c.label }} {{ c.badge }}
{{ c.detail }}
{{ c.cadence }}

When to bother you

A one-person team cannot absorb noise. These decide what reaches you today versus what waits for the weekly digest.

{{ t.label }}
{{ t.value }}
{{ t.note }}
Boundary

Out of scope

This record belongs to a tenant your session does not carry.

{{ deniedDetail }}

Logged Denied read · {{ deniedRef }} · {{ claimRole }} · written to the access log
{{ firmName }} · Lighthouse · Privacy notice
This page sets no cookies, stores nothing on your device, and sends no analytics or tracking data anywhere. All client, vendor, finding and rating data shown is fabricated for demonstration. Two exceptions: the typefaces (IBM Plex Sans and IBM Plex Mono) are served by Google Fonts, and the React library by cdnjs (Cloudflare), so your browser requests fonts.googleapis.com, fonts.gstatic.com and cdnjs.cloudflare.com, each of which receives your IP address and user-agent as part of that request.
{{ at.id }} · {{ at.severity }} · {{ at.vendorName }}
Attest closure
{{ at.title }}
{{ at.effect }}
Basis for closure
A closure with no artifact is an opinion. Name the scan, ticket or letter.
Critical findings need a second named approver before the rating moves.
{{ at.hint }}