Keep application security evidence together.
Make vendor reviews easier to follow.
Vexia IQ keeps each application’s assessments, findings, evidence and fixes in one record. Vendor Attest helps teams send vendor questionnaires, collect supporting documents and review responses. A vendor using both can share its Vexia IQ assessment as evidence in a Vendor Attest response.
Application security + Vendor reviews + Evidence & remediation = Qcramai Security
Built around the standards you're asked about
- SOC 2
- ISO 27001
- GDPR
- HIPAA
- PCI DSS
- NIST CSF
- OWASP Top 10
One audit, both sides covered.
The client audits its vendors in Vendor Attest. The vendor gets its application assessed in Vexia IQ first, so every answer comes with proof.
- Client · Vendor Attest Sends the vendor questionnaire SOC 2, ISO 27001, GDPR or custom questions, through one link.
- Vendor · Vexia IQ Assesses its application Security testing, compliance controls checked, findings fixed and retested.
- Vendor · Vexia IQ → Vendor Attest Answers with evidence Answers through the Vendor Attest link, attaching the Vexia IQ report and score as evidence.
- Client · Vendor Attest Reviews and decides Sees the score and the evidence behind it, then approves or asks for more.
Your applications, and your vendors.
Vexia IQ covers the applications you build and run. Vendor Attest covers the companies you buy from. Same idea behind both: every claim backed by evidence.
"Are our applications secure and compliant?"
Vexia IQ
Application Compliance & Security
For security, engineering and compliance teams, and vendors preparing for a customer audit.
- One security record per application
- Security assessments, compliance audits and code reviews in one place
- Findings tracked from discovery to fix to retest
- Live security and compliance score per app
- AI-drafted reports and ranked fixes
- Secure portal to share results with auditors
From $250/mo · 14-day free trial
"Are our vendors compliant?"
Vendor Attest
Vendor Compliance & Auditing
For procurement, risk and compliance teams assessing their suppliers.
- One compliance and audit record per vendor
- SOC 2, GDPR, ISO 27001, HIPAA, PCI DSS templates
- Vendors answer through one link, no account
- Evidence uploaded against each question
- Compliance report and score per vendor
- Pre-onboarding checks and annual reviews
From $190/mo · 14-day free trial
Vexia IQ · Application Compliance & Security
Track each app’s security evidence, findings, and fixes.
Security assessments, code reviews and audits all land on the application's record, so the history is there when a customer or auditor asks.
-
Findings tracked to closureSeverity, proof, owner, fix and retest result for every issue.
-
Audit trail built inRequirement, evidence, finding, fix and verification, all linked.
-
AI does the write-upDraft reports and a ranked list of what to fix first.
Vendor Attest · Vendor Compliance & Auditing
Know which vendors you can trust, with the evidence to show why.
Send one link, collect answers and documents against each question, and get a score you can compare across every vendor.
-
One link per vendorNo account setup, so vendors actually finish.
-
Evidence next to each answerPolicies, certificates and screenshots where they belong.
-
A score, then a decisionApprove, ask for more, or escalate. Annual reviews run on schedule.
Free security checks. No sign-up.
Check any website you're authorized to test, yours or a vendor's, for TLS, header, DNS and email problems. Or use one of our 30 single-purpose tools.
Passive checks only.
Browse all 30 free tools →Want experts to do the testing?
Our team runs hands-on web app and API security testing aligned to the OWASP Testing Guide. Every finding is confirmed by hand, and results can land straight in Vexia IQ.
Scope & authorize
Target, test accounts and rules of engagement agreed in writing before any traffic.
Map the attack surface
Subdomains, live endpoints, tech stack and WAF behaviour, found before testing starts.
Test every layer
Injection, access control, login and sessions, TLS, secrets and dependencies.
Report & retest
Findings ranked by business risk with steps to reproduce. We retest once fixes ship.
Questions
Something else? Ask us.
What is the difference between Vexia IQ and Vendor Attest?
Vexia IQ is for application compliance and security: it keeps each application's security assessments, compliance audits, findings, evidence and fixes in one record. Vendor Attest is for vendor compliance and auditing: it sends questionnaires to the companies you buy from, collects their evidence, and scores them. Use either one, or both.
Can a vendor use Vexia IQ before answering a customer's questionnaire?
Yes. A vendor can assess its application in Vexia IQ, fix and retest the findings, and then attach the Vexia IQ report and score as evidence when it answers a security or compliance questionnaire, whether that comes through Vendor Attest or another process.
What does Vexia IQ track for each application?
The application's profile, every security assessment, penetration test, code or architecture review and audit, each finding with its severity, proof, fix and retest result, the supporting evidence and documents, and a live security and compliance score.
Which frameworks does Vendor Attest support?
SOC 2, GDPR, ISO 27001, ISO 27701, HIPAA, PCI DSS, NIST CSF, CIS Controls, business continuity, data processing and sub-processors, plus your own custom questions.
Do vendors or auditors need a paid account?
No. Vendors answer through a unique link and auditors use a secure portal. External access is unlimited on every plan, including the trial. You only pay for internal seats.
How much does it cost?
Vexia IQ starts at $250 per month and Vendor Attest at $190 per month, billed annually. Both have a 14-day free trial with no credit card, and running both saves 20%. Full pricing.
Can you do the security testing for us?
Yes. Our testers run web app and API security tests aligned to the OWASP Testing Guide, confirm every finding by hand, and retest after you fix. Results can be delivered straight into Vexia IQ.