For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Most vendor programs have more vendors than review capacity. The usual result is that the long tail goes unassessed, and nobody knows which of those vendors deserved attention.
A Zero Touch Assessment is a triage run for that tail. It evaluates a vendor against a fixed set of controls using open-source research, produces a single 0 to 100 score, and never contacts the vendor. Run it across a whole portfolio and rank what comes back.
What it is, mechanically
It is an ordinary assessment on the ordinary pipeline, with the same controls, issues and evidence as any other run. Three things differ. The control scope is fixed per organization. Six templates ship with the product, a comprehensive default plus lighter and industry-specific variants, and your organization runs one at a time, so every run evaluates the same questions and the results stay comparable. Each run records which template it used. There is no outreach. No document request, no questionnaire, no portal. The evidence is web research, public registers, the vendor’s own infrastructure, and any documents already on file. Nothing is assigned. A run needs no reviewer, no follow-up and no vendor reply, so a batch can be launched and left to finish.It answers “what is this vendor?” first
The common case is knowing a vendor is in use without knowing what it does. Every run opens with the company itself: what it sells, its industry, what it would typically be used for, its services and headquarters, all researched from public sources rather than asked. Alongside it sits a risk tier: a triage read of how much exposure the vendor typically creates, from critical to minimal, with the reasoning behind it. The tier is its own scale, not your organization’s risk levels, because those are calibrated against a completed questionnaire and this is judged from the outside. It leaves your vendor risk scores alone unless you explicitly turn that on. Identity confidence and risk-tier confidence are reported separately. A run can be certain which company it profiled and still be unsure how exposed that company makes you.It gathers the reputational picture into one section
The evidence a reputational read needs arrives from three unrelated places: adverse media on the vendor’s leadership, open watchlist matches where an organization screens, and the reputation controls the run evaluates itself. Every run pulls all three into a Reputational risk section and files what they found under five dimensions: media and customer sentiment, litigation exposure, regulatory and enforcement, executive conduct and stability, and sanctions and association. Each dimension reports its own standing, and the section reports the standing of the worst of them. Findings are ordered material first, so the row that matters is at the top. A matter the subject was cleared of is still listed, because it is part of the record of what the run read, but it is not counted as material and it does not deduct.Not screened is never reported as clear
A dimension nothing searched reads not screened, never clear. The two look similar on a page and mean opposite things, so the section names every unscreened dimension rather than leaving a short findings list to imply a clean vendor. A dimension goes unscreened when the template carries no control for it, the vendor has no leadership dossier yet, or the organization does not screen the relevant watchlist feed. The section is second in the app and in both exports, straight after the vendor identity, and the spreadsheet repeats its read on the summary sheet under the score.The score
The composite combines up to five independently sourced components.
Each is scored 0 to 100 on its own, then weighted into one number carried on your organization’s own risk scale.
A missing component is excluded, never zeroed
This is the rule that governs everything else. A vendor with no filed financials has not failed the financial component. It has no financial component. The weights renormalise across whatever did resolve, so the composite never manufactures a low score out of an absent input. The same principle governs the people component. When adverse-media screening did not run, nothing is deducted, because a screening that never happened cannot establish a clean record.What you can do with a result
Approve it, escalate it to a full assessment, or correct what the run was built on. That last one exists because open-source research binds the wrong website or a similarly named company often enough to need a first-class fix. You describe the correction in plain language, the run is re-scored against the corrected inputs, and your words plus the resulting field changes are written to an append-only audit trail.The trail cannot be edited or deleted, by anyone. A Zero Touch score can be written onto a vendor’s real risk score, so the record of who changed the inputs behind it has to be one nobody can rewrite.
Where the score goes
By default it stays on the run. You can configure it to write onto the vendor’s inherent or residual risk score, or onto each service the run covered. Only the axis you choose is written, so a Zero Touch run can never overwrite an inherent score your team set deliberately from an intake questionnaire.What it is not
It is not assurance. A run has never spoken to the vendor, so it cannot confirm a control is operating. It can only tell you whether public evidence supports it. Anything you need to show an auditor needs a full assessment. Zero Touch tells you which vendors those are.Related
Zero Touch Assessment guide
The screen-by-screen walkthrough.
Zero Touch API
Launch, rank, re-score and read the audit trail.