#1 Prewave

Vienna, Austria Founded 2017 Not published; demo and sales-led quote Demo on request; no free tier disclosed

Best for: Risk teams wanting resilience, ESG and sub-tier visibility together

• Operating company. Prewave
• Jurisdiction. EU (Austria)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Interos, RiskRecon, Sayari

Prewave is a Vienna-based AI supply chain intelligence platform, founded in 2017 by Harald Nitschinger and Lisa Smith.

It covers more ground than most tools in this category through three tracks on one platform: Resilience for operational disruption monitoring and predictive risk, Sustainability for ESG compliance and regulatory reporting, and Transparency for multi-tier supplier mapping beyond direct suppliers. The company says it processes roughly 4.5 million data points a day across more than 200 risk types, which is the scale a monitoring product needs to be useful.

It was named a Leader in the 2026 Gartner Magic Quadrant for Supplier Risk Management Solutions and an Innovator in the Verdantix Green Quadrant for Supply Chain Sustainability Software, which gives it recognition from both a general analyst firm and a sustainability-specific one.

For an organisation in scope of DORA or NIS2 that wants resilience, ESG and sub-tier supplier visibility from one vendor rather than three, it is the broadest single answer in this list, and the reason it sits at the top of the grid.

The cost of breadth is disclosure. Pricing is not published, no free tier is disclosed, and the pages we reviewed do not state security certifications or where customer data is hosted, so a compliance team has to ask in due diligence.

That is typical for the category rather than specific to Prewave, but it is still a gap. A company with a narrow single-regulation need may also find the breadth more than it requires and be better served by a narrower tool.

Standout feature. Three tracks, resilience, sustainability and transparency, on one platform, which is a broader single-vendor scope than most competitors offer.

#2 IntegrityNext

Munich, Germany Founded 2016 Not published; sales-led quote Demo on request; no free tier disclosed

Best for: Companies facing LkSG or CSDDD due diligence deadlines

• Operating company. IntegrityNext
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Supplier self-assessment spreadsheets, generic GRC platforms

IntegrityNext is a Munich supply chain sustainability platform founded in 2016 and built around the wave of EU due diligence law: the German Supply Chain Due Diligence Act (LkSG), the CSDDD, the CSRD, deforestation and forced-labour screening, and carbon tracking.

It automates the collection of supplier self-assessments and supporting evidence across a network the company puts at roughly one million companies. An AI Intelligence Layer flags which suppliers carry outsized risk, so a compliance team does not have to read every questionnaire by hand.

The company is backed by EQT Growth, part of the Swedish investor EQT, which keeps the ownership chain inside Europe even as the company expands internationally with a New York office.

It has been named a Verdantix Green Quadrant 2024 Leader and a Gartner Cool Vendor. For a firm whose main exposure is regulatory, an approaching LkSG filing or CSDDD scope, that narrower focus is an advantage over a more general platform that treats due diligence law as one module among many.

The caveats are practical. Pricing is not published and every buyer goes through a sales conversation. Certifications and hosting location are not stated on the pages we reviewed.

The 180% ROI figure the company cites comes from vendor-commissioned Verdantix research, so read it as marketing rather than independent measurement. And a buyer who wants operational disruption monitoring, such as factory fires or insolvencies several tiers down, will need a different tool next to it. Ask for a reference customer that matches your size and sector.

Standout feature. A platform built specifically around EU supply chain due diligence law, with an AI layer that prioritises which suppliers to read.

#3 Osapiens

Mannheim, Germany Not published; sales-led quote Demo on request; no free tier disclosed

Best for: Companies juggling several EU regulations at once

• Operating company. Osapiens
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Separate point tools for LkSG, CSRD and EUDR compliance

Osapiens is a Mannheim compliance and supplier-intelligence platform sold as the osapiens HUB. Its pitch is architectural rather than a feature list: seven solution suites, including Supplier Intelligence, Product Compliance, Carbon Management and Disclosures and Reporting, share one underlying data layer.

Evidence collected once, such as a supplier certificate or a carbon figure, can then be reused across EUDR, CSRD, LkSG, CSDDD, PPWR and Digital Product Passport requirements rather than being collected again for each regime, which is where most compliance teams lose their time.

The company reports more than 2,500 customers and over one million suppliers on the platform, with 550-plus employees across offices in Europe and the US and a customer list that includes Roche, Volkswagen and Lidl.

It has been recognised as a Leader in IDC MarketScape and Verdantix Green Quadrant reports for this niche, which independently supports its standing in compliance software for supply chains, though both are analyst reports of the kind vendors cite prominently in their own material. Ask which of its customers use the supplier-risk side specifically rather than product compliance.

The collect-once architecture matters most to a company already facing, or about to face, more than one of those regimes. A buyer with a single filing has less reason to pay for the breadth.

Pricing and founding year are not published on the pages reviewed, and neither are certifications or hosting location. It is also a compliance platform first rather than a pure vendor risk questionnaire tool, so test how deep the supplier-assessment workflow goes for your use case before committing.

Standout feature. Collect supplier evidence once and report to every framework from the same data layer.

#4 EcoVadis

Paris, France Founded 2007 Not published; buyer and supplier plans quoted separately Not stated by the vendor

Best for: Suppliers and buyers needing the sustainability scorecard customers ask for

• Operating company. EcoVadis
• Jurisdiction. EU (France)
• Where the data sits. Not stated on the pages reviewed
• Independent checks. Methodology built on GRI, UN Global Compact and ISO 26000
• Source code. Closed source
• Replaces. Manual supplier sustainability questionnaires, one-off CSR audits

EcoVadis, founded in Paris in 2007, is less a software platform in the usual sense than a ratings agency for supplier sustainability.

Its methodology scores a company on 21 indicators across four themes, Environment, Labor and Human Rights, Ethics and Sustainable Procurement, built on the GRI, the UN Global Compact and ISO 26000 and adjusted by industry, country and company size. Assessments are performed by its own analysts rather than taken purely from self-reported data, which is what gives the resulting score weight with a procurement team.

Scale is its clearest advantage: more than 150,000 rated companies across 185-plus countries and 250-plus spend categories. Because many large buyers already require an EcoVadis score from their suppliers by contract, a supplier is often rated whether it chose the platform or not, which turns the decision from whether to adopt it into how to perform well on it. For a company under pressure from a customer to produce a medal, it is the tool that answers exactly that request.

The limits are scope and cadence. It scores ESG and sustainability, not cyber risk or operational disruption, and it is a ratings-agency model with periodic assessment cycles rather than continuous monitoring, so a score reflects a point in time.

Pricing is not published for buyers or suppliers, and certifications and hosting location are not stated on the pages we reviewed. If no customer is asking you for a score, a due diligence platform may cover more regulatory ground for the money.

Standout feature. The closest thing this category has to a universal supplier sustainability passport that customers already recognise.

#5 CyberVadis

Paris, France Founded 2018 Not published; sales-led quote Not stated by the vendor

Best for: Security teams wanting analyst-validated third-party cyber assessments

• Operating company. CyberVadis
• Jurisdiction. EU (France)
• Where the data sits. Not stated on the pages reviewed
• Independent checks. "Cybersecurity Made in Europe" label; assessments mapped to NIST, ISO 27001 and GDPR
• Source code. Closed source
• Replaces. Manual vendor security questionnaires, BitSight, SecurityScorecard

CyberVadis, founded in Paris in 2018, is the tool in this category built specifically around third-party cybersecurity risk rather than supply chain or ESG risk.

Instead of passive outside-in ratings scraped from internet signals, it runs AI-drafted questionnaires validated by an in-house team of security analysts, tailored to each vendor’s business and technology profile and benchmarked against NIST, ISO 27001 and GDPR. That makes it the closest European counterpart to BitSight or SecurityScorecard, though its assessment model differs from theirs in a way buyers should understand.

The company is active in more than 110 countries from eight offices, employs more than 100 people and holds the Cybersecurity Made in Europe label, alongside membership in the European cybersecurity bodies ECSO, Hexatrust and CESIN.

Those are European-specific credentials that the larger US ratings vendors cannot claim, and they give a buyer something concrete to cite in a supplier-selection record, in addition to the analyst-validated assessment reports that the platform produces for each vendor it evaluates. Ask which of your own vendors already hold a CyberVadis assessment, since a reusable one saves the most time.

The trade-off is the flip side of the human validation. An analyst-checked questionnaire model is more labour-intensive to scale across a very large vendor list than an automated rating, and a buyer who wants an instant score across thousands of suppliers may find a passive ratings model faster to deploy.

Pricing is not published, the scope is cyber only, with no supply chain disruption or human-rights due diligence, and hosting location is not stated on the pages reviewed. A pilot on a sample of vendors will show the real turnaround time for validated assessments.

Standout feature. Human-validated cyber assessments with a European-made label, in place of a purely automated outside-in score.

#6 Kodiak Hub

Stockholm, Sweden Not published; demo-based quote Demo on request; no free tier disclosed

Best for: Procurement teams that want risk inside supplier management

• Operating company. Kodiak Hub
• Jurisdiction. EU (Sweden)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Spreadsheet supplier scorecards, separate SRM and risk tools

Kodiak Hub is a Stockholm-headquartered, AI-powered supplier relationship management platform founded and led by CEO Malin Schmidt, with additional EU offices in Gdansk, Poland and Munich, Germany, and a London office.

Risk assessment is one module in a broader supplier lifecycle workspace that also covers onboarding, performance monitoring, compliance and audit management, rather than a stand-alone product. The company cites average cost savings of 7 to 10 percent and 80 percent faster supplier onboarding against legacy tools. Ask for a reference customer of similar size, since the cited figures are averages across its base and not a promise for any single buyer.

Those efficiency figures are company-reported, and the pitch is procurement efficiency, with risk and compliance as one part of the business case rather than the whole of it.

The company reports more than 300,000 suppliers managed across 20-plus industries and 176 countries, which is substantial but more concentrated than the networks of EcoVadis or IntegrityNext, and it is worth asking how many of your own suppliers are already in it. Confirm which entity you would contract with, since the company has offices in several countries.

For a procurement function that wants supplier risk handled in the same system as performance and onboarding, it is the only entry in this list built that way from the ground up.

For a team that wants a dedicated, risk-first tool and nothing else, the supplier relationship management feature set may be more than it needs and will still be paid for. Pricing is demo-based and not published, founding year and certifications are not stated, and hosting location is not named on the pages reviewed.

Standout feature. Risk assessment built into a full supplier relationship lifecycle workspace rather than sold as a separate point tool.

#7 Risk Ledger

London, United Kingdom Founded 2018 Four quoted plans (Essentials, Standard, Pro, Enterprise) by supplier limit, capped at 30, 80, 200 or 750 suppliers; free for suppliers Free for suppliers; buyer demo on request

Best for: Security teams that want suppliers to answer once, and for free

• Operating company. Risk Ledger Ltd
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. OneTrust Vendorpedia, Prevalent, spreadsheet questionnaires

Risk Ledger Ltd in London, incorporated in 2018, runs a third-party security risk network where suppliers complete their assessment once and every customer sees the result.

Buyers get supplier risk workflows with continuous monitoring and an nth-party network visualisation, so they can see who their suppliers in turn rely on. Suppliers use the platform free of charge, which removes the usual objection to joining and is the main reason a buyer can expect suppliers to take part without a long negotiation.

The pricing structure is unusually legible for the category. There are four plans, Essentials, Standard, Pro and Enterprise, capped at 30, 80, 200 or 750 suppliers, with an open API on all plans. Add-ons cover external attack-surface monitoring and ESG, financial and government risk domains.

The prices themselves are quoted, but the supplier limits are public, which lets a buyer place itself on a plan before the sales call and judge whether the network is sized for its programme. Confirm which add-ons you need before comparing plans, since they change the total.

Two points count against it for an EU buyer. It is a UK company, so it is outside the EU and the EEA and relies on an adequacy decision. And the value of a network depends on how many of your own suppliers are already on it, which you should ask before signing. The pages we reviewed do not state data-hosting location or a security certificate, and the attack-surface monitoring is an add-on rather than part of the base plans.

Standout feature. A network where suppliers answer once and pay nothing, with published supplier limits per plan.

#8 Hellios

Oxford, United Kingdom Buyer pricing not published; demo on request Demo on request

Best for: Financial services, defence and energy buyers using pooled assurance

• Operating company. Hellios Information Limited
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Bilateral supplier questionnaires, OneTrust, Prevalent

Hellios Information Limited in Oxford operates supplier-data community platforms. Buyers in a sector pool their supplier questionnaires and audits so that a supplier is assured once and many buyers rely on the result.

Its communities include FSQS for financial services, JOSCAR for defence and aerospace, and ESSCAR for energy, and it also offers third-party risk workflows aimed at DORA plus sustainability and carbon data collection, so the same supplier relationship can feed both risk and reporting processes. It is worth asking for a walk-through of how a supplier’s answers are shared between buyers.

That community model is the point. If you are a bank, a defence prime or an energy company in one of those sectors, your suppliers are likely to be in the community already, and joining it can reduce the number of duplicated questionnaires a supplier has to answer.

It is closer to an industry utility than a software product, and it is built around the questions that a sector shares, which is also why it is less flexible than a bespoke questionnaire platform where you write the questions yourself.

The limits follow from the model. Hellios is a UK company, so it sits outside the EU and the EEA under an adequacy decision. Buyer pricing is not published and a demo is the entry point.

A company outside those three sectors may find the pooled model has less to offer, because the value of the community depends on peers who share your suppliers. The pages reviewed do not state hosting location or security certificates, so ask for both. Ask which of your own suppliers are already members of the community you would join.

Standout feature. Sector communities where a supplier is assured once and many competing buyers rely on the same audit.

#9 Sedex

London, United Kingdom Supplier plans from £224 per site per year (Plus £374); buyer pricing on request Not stated by the vendor

Best for: Buyers needing social audit data from many global suppliers

• Operating company. Sedex Information Exchange Limited
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Not stated on the pages reviewed
• Independent checks. Home of the SMETA social audit methodology
• Source code. Closed source
• Replaces. EcoVadis, bilateral supplier ethical audits, spreadsheet questionnaires

Sedex Information Exchange Limited in London runs a supply chain sustainability platform and is the home of the SMETA social audit methodology. Its risk scoring combines country, sector and site data with verified SMETA audits, and it offers shared supplier profiles and self-assessment questionnaires across a network of more than 100,000 members. It also supports corrective-action tracking and reporting for due diligence legislation such as the CSDDD, so audit findings can be followed through to closure in the same system.

Pricing is public on the supplier side: plans from £224 per site per year, with a Plus tier at £374, while buyer pricing is on request.

That is rare in this category and it makes the supplier cost visible, which matters because the supplier fee decides whether suppliers join. SMETA is widely used well beyond the UK, which makes Sedex data easier to reuse across customers than a bespoke questionnaire that each buyer has to ask for separately and each supplier has to answer again.

Where it is narrower is in cyber and operational risk, since the product is about social and environmental conditions at sites, not security assessments or disruption monitoring. It is a UK company and so outside the EU and the EEA, covered by an adequacy decision.

A buyer that wants a single risk platform covering cyber, financial and operational signals will need to pair it with another tool, and the pages reviewed do not state hosting location or certificates. Ask how many of your suppliers already hold a Sedex profile with a recent SMETA audit.

Standout feature. Public supplier pricing and the SMETA methodology behind a network of more than 100,000 members.

#10 SupplyOn

Hallbergmoos, Germany Founded 2000 Quote on request; demo offered Demo on request

Best for: Manufacturers already working through the SupplyOn network

• Operating company. SupplyOn GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Resilinc, Interos, bilateral supplier portals

SupplyOn GmbH in Hallbergmoos, near Munich, has run a supply chain collaboration platform for manufacturers since 2000. Its supply chain risk management module links risk signals to affected suppliers, materials and deliveries, and its operational incident management collects supplier impact feedback when something goes wrong.

Bosch, Schaeffler and ZF are among its shareholders, and it reports more than 140,000 companies on its network, which is a very large base of suppliers that already know the platform. A programme expected to run for years benefits from a vendor that has been operating since 2000.

That ownership and network make it a natural fit for automotive and industrial manufacturers.

If your suppliers already use SupplyOn for orders, quality or logistics, risk information arrives in the same place as the operational data, which is a practical advantage over a stand-alone tool that has to be integrated and that suppliers have to be asked to join. It is a collaboration platform first, with risk as one of the things that collaboration produces. Ask how many of your tier-one suppliers are already connected before you assume a quick roll-out.

The focus is operational supply chain risk, so it is not a cyber questionnaire tool and not a due diligence platform for the human-rights laws.

Pricing is by quote with a demo offered, and the pages reviewed do not state certifications or hosting location. For buyers outside manufacturing the network has much less to offer, because the value comes from the suppliers already on it, and a company without that supplier base would be paying for a community it cannot use.

Standout feature. Risk signals tied directly to the suppliers, materials and deliveries of a manufacturing network that is already in daily use.

#11 Orbiq

Hamburg, Germany Trust Center plans Free, Team €85/month, Business from €190/month; Vendor Assurance by demo Free Trust Center plan; Vendor Assurance by demo

Best for: SaaS companies and small teams handling security questionnaires

• Operating company. Orbiq GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Not stated on the pages reviewed
• Source code. Closed source
• Replaces. Vanta Trust Center, Whistic, SafeBase, spreadsheet questionnaires

Orbiq GmbH in Hamburg sells a trust center platform with a vendor assurance module. The trust center is the page a supplier shows its customers, with an NDA flow, built around the NIS2, DORA and ISO 27001 requests that buyers now send.

The vendor assurance side offers AI-supported vendor questionnaires, automated scoring evaluations and continuous monitoring of vendor security over time, so a small team can run both sides of the questionnaire exchange, answering its own customers and assessing its own suppliers, from one tool.

With Sedex it is one of only two entries here that publish prices, and it is inexpensive: Trust Center plans are Free, Team at €85 a month and Business from €190 a month, with Vendor Assurance sold by demo.

That makes it approachable for a small team that has to answer security questionnaires and also assess a modest number of its own suppliers, which is a situation most enterprise platforms in this list are not priced for and not designed to serve.

The caveats are scale and depth. The pages we reviewed give no founding year, customer count or hosting location.

Its strength is the supplier-facing trust center, so it is a lighter vendor-assessment tool than IntegrityNext or Prewave, and it does not cover supply chain due diligence law or operational disruption. Treat it as a security assurance tool, not as a full third-party risk programme, and note that the vendor assurance module is quoted by demo rather than priced publicly. Request a reference from a company of your size before moving beyond the free plan.

Standout feature. A trust center with a public price list, with a vendor assurance module that works for teams too small for an enterprise platform.