Know what you are saying yes to.
Grasp reads the vendor's data processing agreement, privacy policy and terms, and sets out the facts that matter for each tool. A person decides, with every source in front of them.
The vendor's own documents.
Every assessment starts from what the vendor publishes, and keeps it one click away.
Data processing agreement
The processing terms, and whether an agreement is on file for your company.
Privacy policy and terms
What the vendor says it does with your data, and on what terms.
The facts that matter
Where data is hosted, whether it trains on your content, retention and deletion.
The research done. The decision yours.
An assessment supports a person's decision and keeps its evidence.
Read
The vendor's documents, read and kept with the assessment.
Checked
What they mean for your data: hosting, training, retention and deletion.
Recommended
What to do next, such as turning on the vendor's data controls.
Decided
A named person signs off, and the sign-off stays on record.
What it means for your data.
A short briefing per tool: what it reaches, where the vendor processes it, and what to do about it.
Common questions
Which documents does Grasp read?
What the vendor publishes: its data processing agreement, privacy policy and terms.
Is the assessment automated?
Where the vendor publishes what is needed. Where it does not, the gap is shown, such as a data processing agreement that is not on file.
Who makes the decision?
A named person, usually in IT, security or procurement. Grasp prepares the evidence; the sign-off is theirs and stays on record.
Is vendor assessment part of the sprint?
It comes with Grasp Govern, the add-on to Grasp Work.