StillVerified tracks every third-party attestation you rely on: the report period, the bridge letter holding the gap, the review you wrote, and the date it all goes stale. Then it emails you 60 days out, while the vendor still has time to answer.
No card. Magic-link sign in, so there is no password to manage.
Sixty, thirty and seven days before coverage ends. One digest per morning, not one email per vendor. Lapses get their own notice and keep getting it.
Your review, your conditions, your risk decision, stored against the report it judges. A year from now someone will ask why this vendor was approved. The answer will be there.
Export the whole thing as CSV with coverage status and decisions included. Useful when an auditor asks for your third-party list and wants it today.
A date tracker tells you when a report goes stale. The harder question is whether the report was worth much to begin with. StillVerified flags the places where "yes, we have SOC 2" turns out to mean less than you assumed.
Vanta and Drata are built for the company preparing for its own audit, and priced for it. This is for the other side of the table: the two-person security team, the small MSP, the county or city IT department, the SaaS company that just finished its first audit and now has to review forty vendors of its own. If you are doing this in a spreadsheet with a calendar reminder you keep snoozing, that is the job this replaces.
That is the only question this answers, and it answers it every morning.