How to use the Vendor security review template

Start a board from it
Use this template opens a new Freero board with the Vendor security review template on it (sign up free first). On a board you already have, open Templates in the toolbar and search for “Vendor security review”.
Follow the instruction on the board
“Match the depth of the review to what they will touch. A tool with no customer data needs five minutes; one with health data needs evidence.”
Fill in each part
- What they will access Which data and systems, and how much of it?
- Risk level Low, medium or high, and why.
- Certifications and reports What they can show, and how recent.
- How they protect it Encryption, access, logging, where data lives.
- Incidents and notice Past breaches, and how fast they would tell us.
- Their suppliers Who else will touch our data?
- Contract must include Terms to add before signing.
- Decision Approve, approve with conditions, or reject.
Bring your team and your agents
Invite people to the board or share a link, and work on it together live. The timer is in the top bar, private mode and voting in the board menu, and Claude or ChatGPT can join through Freero’s MCP server.

Work on it with an AI agent

Connect an assistant once and it works on the board with you, with your permissions: by default it reads and proposes, and people decide.

You ask: “Fill in the Vendor security review board from these notes.”
What happens It reads the board, then proposes sticky notes for it. Nothing changes until someone on the board accepts them.
You ask: “Group what we wrote into themes and list the actions.”
What happens It proposes clusters with a title each and task cards for the actions, labelled with its name and yours.

Records of processing
Keep a record of each activity that uses personal data: what data, why, on what basis, who it is shared with and how long it is kept.
Privacy impact assessment
Before a new project uses personal data, think through what it collects, the risks to the people involved and how to reduce them.
Data retention schedule
Decide how long each kind of record is kept, why, where it lives and what happens to it at the end, then check that it happens.
Contract review checklist
Read a commercial contract with the same questions every time: who, what, money, liability, exit and data, with red flags marked.
Compliance obligations register
List the laws, licences and standards you must meet, what each requires, who owns it and the evidence that you comply.
Policy drafting canvas
Draft a workplace policy people can follow: why it exists, who it covers, the rules, the exceptions and how it will be kept up.