Find the vendor
Search by name, category, or parent company. The category menu above the list narrows it to one type of vendor.
Independent, evidence-based security research on the vendors RIAs rely on. Find a provider, review what's sourced and what's still open, and leave with a documented, citable due-diligence record for your compliance file.
Search by name, category, or parent company. The category menu above the list narrows it to one type of vendor.
Open a vendor for the plain-language assessment, then every sourced answer with its citation and capture date. Unknown means no public source yet, not a failed control. A SOC 2 held under NDA is noted as listed, not obtained.
Click Save on each vendor in your stack to build My Vendors. It remembers your list, flags records that changed since you last reviewed them, and Select all for export picks the whole list at once. The list is kept in this browser only; download a backup to keep a copy.
Export builds a Word decision pack on MTradecraft letterhead: one executive page across every vendor, one decision sheet per vendor, and clickable source links, plus an Excel workbook of the same evidence. Your CCO records each decision and signs. MTradecraft does not approve or reject vendors.
Three ways to add one. Email vdd@mtradecraft.com with the vendor name and we research it and tell you when the record is live. Forward the vendor our self-report form and their answers come to us for review. Or send us their SOC 2 report or ISO certificate and we build the record from it. Every record answers the same Vendor Due Diligence Questionnaire (free sign-in to download).
Screen the full catalog or focus on the records that need attention.
Try a broader search or another category.
An independent, evidence-based reference on the cybersecurity and compliance posture of the vendors that financial firms — RIAs, broker-dealers, and funds — entrust with sensitive data. For each vendor we work through a fixed due-diligence questionnaire and publish what can be confirmed from public sources, with a link and capture date; anything we can't yet confirm is marked Unknown. Nothing is inferred, and every item is anchored to the regulation behind it — Reg S-P, Rule 206(4)-7, Rule 204-2, Reg S-ID. Vendors whose products embed AI get a supplemental review of how customer data is handled.
Want a hard copy? Download the Vendor Due Diligence Questionnaire (free BrainTrust sign-in required). Vendor missing? We research it on request — email vdd@mtradecraft.com and we tell you when the record is live. Have a vendor complete it themselves: forward the self-report form and their answers come back to us for review.