Check a new vendor's security
Get a first pass on a vendor's security docs before you sign.
IT and admin · When you ask · Updated
Works with
- Slack
- Box
- Dropbox
- Notion
- Microsoft 365
Slack
Box
Dropbox
Notion
Microsoft 365How do you check a new vendor's security?
To check a new vendor's security, give Maito the vendor's name, trust page and security documents plus your requirements. It reads the SOC 2 summary, DPA and policies, compares each requirement, and lists what matches, what is missing and any exceptions. Your team sees the gaps before signing.
How it's done today
Vendor reviews pile up.
What Maito does
- Read their security page and reports
- Check against your requirements
- List gaps
Example
@Maito check Hooli Vault's security against our vendor requirements. Their SOC 2 summary is in the Vendors folder in Drive.
From their trust page, the SOC 2 summary (Type II, Jul 2025 to Jun 2026) and their DPA, against our requirements: • SOC 2 Type II: yes. • SSO: Enterprise plan only. We'd be on Business, so no SSO. • Data location: EU, Frankfurt. • Encryption: AES-256 at rest, TLS 1.2 or higher. • Breach notice: no period in the DPA. We require 72 hours. This is the gap. Catch: the SOC 2 summary lists 2 exceptions in user access reviews. The report says they were fixed in Q2. You make the call. Want questions for their security contact on the 72 hours and the exceptions?
Ben (3:00 PM):
check Hooli Vault's security against our vendor requirements. Their SOC 2 summary is in the Vendors folder in Drive.
Maito (3:04 PM):
From their trust page, the SOC 2 summary (Type II, Jul 2025 to Jun 2026) and their DPA, against our requirements:
• SOC 2 Type II: yes.
• SSO: Enterprise plan only. We'd be on Business, so no SSO.
• Data location: EU, Frankfurt.
• Encryption: AES-256 at rest, TLS 1.2 or higher.
• Breach notice: no period in the DPA. We require 72 hours. This is the gap.
Catch: the SOC 2 summary lists 2 exceptions in user access reviews. The report says they were fixed in Q2.
You make the call. Want questions for their security contact on the 72 hours and the exceptions?
How to set it up
- Set up
Nothing to set up. Ask in Slack or by email whenever you need it.
- Connect files
- Google Drive
- Box
- Dropbox
- Notion
- Microsoft 365
Not connected yet? Your agent sends you a link to sign in.
What it won't do
It only reads what the vendor has published or you provide, and can't verify the controls are actually in place. It's a first pass, not a full audit.
Questions
The vendor's public trust page and any documents you attach or store in your file tool, such as a SOC 2 report or DPA.
No. It gives a first pass with gaps and exceptions. Security or IT makes the decision.
Yes, if you tell it which plan you'd buy. It flags features like SSO that only come on higher plans.
