Vendor Management
Overview
Section titled “Overview”Vendor Management gives you a centralized view of every software vendor your organization relies on. By tracking which vendors are in use—and how they were discovered—you can assess third-party risk, maintain an accurate software inventory, and connect vendor records to Fencer integrations for deeper visibility.
Prerequisites
Section titled “Prerequisites”- The Vendor Catalog lives in the Admin section of the navigation, which is shown to the
Administrator role. Tracking vendors, setting owners and risk, and importing require the
vendors:editability, which only Administrators hold by default.
How it works
Section titled “How it works”Fencer maintains a global vendor catalog—a curated list of well-known software vendors (GitHub, Slack, AWS, etc.) with metadata such as category, website domain, and icon. Your organization tracks vendors by marking them In Use, which links a catalog entry to your organization. Each tracked vendor records its source — Manual, GRC (Vanta), GRC (Drata), GRC (SecureFrame), or Integration — and has an owner (the person responsible for it, used by User Access Reviews) and a risk rating (Critical, High, Medium, Low, or Unrated).
When you connect a Fencer integration (e.g., GitHub, Slack), its vendor is tracked automatically as an integrated vendor, and it is untracked again when you disconnect the integration. You can also create custom vendors that are not in the global catalog—these are scoped to your organization and require a name and website URL.
Usage / Configuration
Section titled “Usage / Configuration”Browsing the vendor catalog
Section titled “Browsing the vendor catalog”- Go to Admin > Vendor Catalog.
- Use Search vendors… to filter vendors by name, slug, or alias.
- Use Filter to show All Vendors or narrow results to one of the Categories (e.g., Engineering, Security, Cloud Infrastructure, Communication).
- Switch between the All, In Use, and Available tabs to see which vendors your organization is already tracking versus those available to add.
- Use Display to switch the layout between Cards and List. The list view adds the columns Category, Status, Source, Risk, and Owner, with filters for status, source, and risk.
Adding a vendor from the catalog
Section titled “Adding a vendor from the catalog”- Locate the vendor you want to track.
- Click its card. Fencer tracks the vendor with source Manual and sets you as its owner.
- The vendor now appears on the In Use tab.
Setting a vendor’s owner and risk
Section titled “Setting a vendor’s owner and risk”In the List layout, set a tracked vendor’s Owner (any member of your organization) and Risk directly in its row. To give several vendors the same owner, select them and click Assign Owner. Risk ratings on vendors imported from a GRC platform or linked to an integration come from that source and can’t be changed here.
Adding a custom vendor
Section titled “Adding a custom vendor”If a vendor is not in the global catalog, click Add Vendor to create a custom vendor with a name and website URL. Custom vendors are scoped to your organization. For full details on custom vendor creation, validation, and deduplication logic, see GRC Import and Vendor Tracking.
Removing a vendor
Section titled “Removing a vendor”Click a tracked vendor’s card again to untrack it. Removing a custom vendor deletes it.
Importing vendors from a GRC platform or CSV
Section titled “Importing vendors from a GRC platform or CSV”If you have a Vanta, Drata, or SecureFrame integration connected, you can bulk-import your vendor list from the Import menu in the page header, which also offers CSV file for a vendor list in a spreadsheet. For a full walkthrough of the import flow, preview categories, and source tracking, see GRC Import and Vendor Tracking.
Vendor identities
Section titled “Vendor identities”To record which of your users have accounts at a vendor that isn’t connected through an integration, add or import its accounts on the Vendor Identities tab of Posture > Identities. See Vendor Identities and Syncing.
Vendor categories
Section titled “Vendor categories”Vendors are organized into categories including Productivity, Engineering, Security, Cloud Infrastructure, Communication, Compliance, and more. For the full category list with examples, see GRC Import and Vendor Tracking.
Examples
Section titled “Examples”Tracking a known vendor from the catalog:
You search for “Slack” in the vendor catalog, find the global entry, and click its card to start tracking it. The vendor appears on the In Use tab with source Manual, and you are its owner.
Importing vendors from Vanta:
Connect your Vanta integration, go to Admin > Vendor Catalog, and choose Import > Vanta. Fencer fetches your vendor list and presents a preview of new matches, already tracked, and unmatched entries. After reviewing, click Confirm import. For a detailed walkthrough, see GRC Import and Vendor Tracking.
Troubleshooting
Section titled “Troubleshooting”- “Cannot untrack a vendor that was imported from a GRC platform or linked to an integration.” — This vendor is managed by a GRC import or an active integration. Disconnect the integration from Admin > Integrations, or archive the vendor in your GRC platform and re-run the import.
- The Import menu doesn’t list your GRC platform — only connected Vanta, Drata, and SecureFrame integrations appear. Connect the integration first.
- Custom vendor creation rejected — A vendor with the same name or website domain already exists in the catalog or your inventory. Search for and track the existing entry instead.