For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
Most vendor programs have more vendors than review capacity. The usual result is that the long tail goes unassessed, and nobody knows which of those vendors deserved attention.
A Zero Touch Assessment is a triage run for that tail. It evaluates a vendor against a fixed set of controls using open-source research, produces a single 0 to 100 score, and never contacts the vendor. Run it across a whole portfolio and rank what comes back.
What it is, mechanically
It is an ordinary assessment on the ordinary pipeline, with the same controls, issues and evidence as any other run. Three things differ. The control scope is fixed per organization. Six templates ship with the product, a comprehensive default plus lighter and industry-specific variants, and your organization runs one at a time, so every run evaluates the same questions and the results stay comparable. Each run records which template it used. There is no outreach. No document request, no questionnaire, no portal. The evidence is web research, public registers, the vendor’s own infrastructure, and any documents already on file. Nothing is assigned. A run needs no reviewer, no follow-up and no vendor reply, so a batch can be launched and left to finish.It answers “what is this vendor?” first
The common case is knowing a vendor is in use without knowing what it does. Every run opens with the company itself: what it sells, its industry, what it would typically be used for, its services and headquarters, all researched from public sources rather than asked. Alongside it sits a risk tier: a triage read of how much exposure the vendor typically creates, from critical to minimal, with the reasoning behind it. The tier is its own scale, not your organization’s risk levels, because those are calibrated against a completed questionnaire and this is judged from the outside. It leaves your vendor risk scores alone unless you explicitly turn that on. Identity confidence and risk-tier confidence are reported separately. A run can be certain which company it profiled and still be unsure how exposed that company makes you.The score
The composite combines up to five independently sourced components.
Each is scored 0 to 100 on its own, then weighted into one number carried on your organization’s own risk scale.
A missing component is excluded, never zeroed
This is the rule that governs everything else. A vendor with no filed financials has not failed the financial component. It has no financial component. The weights renormalise across whatever did resolve, so the composite never manufactures a low score out of an absent input. The same principle governs the people component. When adverse-media screening did not run, nothing is deducted, because a screening that never happened cannot establish a clean record.What you can do with a result
Approve it, escalate it to a full assessment, or correct what the run was built on. That last one exists because open-source research binds the wrong website or a similarly named company often enough to need a first-class fix. You describe the correction in plain language, the run is re-scored against the corrected inputs, and your words plus the resulting field changes are written to an append-only audit trail.The trail cannot be edited or deleted, by anyone. A Zero Touch score can be written onto a vendor’s real risk score, so the record of who changed the inputs behind it has to be one nobody can rewrite.
Where the score goes
By default it stays on the run. You can configure it to write onto the vendor’s inherent or residual risk score, or onto each service the run covered. Only the axis you choose is written, so a Zero Touch run can never overwrite an inherent score your team set deliberately from an intake questionnaire.What it is not
It is not assurance. A run has never spoken to the vendor, so it cannot confirm a control is operating. It can only tell you whether public evidence supports it. Anything you need to show an auditor needs a full assessment. Zero Touch tells you which vendors those are.Related
Zero Touch Assessment guide
The screen-by-screen walkthrough.
Zero Touch API
Launch, rank, re-score and read the audit trail.