Your web host, your accounting firm, your payment or e-mail provider: their weaknesses can become yours. NIS2 asks you to look after the security of your supply chain (Article 21(2)(d)). The Suppliers page follows their domains every week, with the public checks only, and tells you when something gets worse.

Add a supplier

Open Suppliers and go to Add a supplier.
Enter the supplier’s domain (acme-hosting.com) and, if you like, a name.
Press Add. The first check takes a few minutes.

Only owners and admins can add or remove suppliers. Each plan includes a number of them: 3 on Free, 10 on Solo, 50 on Agency, 200 on Agency Plus. Up to twenty new suppliers can be added a day.

Services found in your DNS

Below the list, Services you use shows the companies the audits of your proved domains reveal: who runs your mailboxes (MX records) and your DNS (name servers), who may send mail in your name (the include: of your SPF record), where your subdomains point (CNAME), which tools you verified your domain with (TXT verification records) and which third-party scripts your home page loads. Press Follow as a supplier to add one in a click. The list is updated by each audit; nothing else is fetched.

What is checked

A supplier gets the same public checks as the free check: e-mail authentication, DNS, certificates, mail servers and websites, what anyone on the internet can read. Nothing that needs their consent: no look-alike search, no probing of sensitive files, no archive or breach data, as for any domain whose owner has not proved it. Findings whose details could help an attacker are named by family only.

Each supplier is checked once a week. The table shows its score (and how it moved since the previous check), its most serious findings and the date of the last check.

Beyond your plan

If your workspace moves to a plan that includes fewer suppliers (for example from Solo to Free), the suppliers you added first keep being checked, up to the number of the new plan. The others stay in the table with their last score, marked Not updated with the date of their last check: that score no longer moves and no alert is sent for them. A notice at the top of the page counts them and links to the plans. Remove some suppliers, or move to a larger plan, and they are checked again within the week.

Alerts

You are alerted when a supplier’s score drops by 10 points or more, or when a critical problem appears that was not there before. The alert goes to the channels of the Alerts page that are not limited to a client.

Tell your supplier

Each supplier has an Invite them link to send them: it opens the free check of their domain. Once they create an account and prove the domain is theirs, they see every finding and how to fix it. You never see more than the public checks.

Send a security questionnaire

From the Solo plan, open a supplier (click its name in the table) and go to Send a security questionnaire:

Enter the name and e-mail address of your contact at the supplier, the language of the questionnaire (English, French or German) and the due date, 3 to 90 days away. The address must be on the supplier’s own domain or one of its subdomains: the questionnaire goes to the supplier only. A supplier followed under a free e-mail service (gmail.com, outlook.com, orange.fr…) cannot receive one: add it under its company’s own domain.
If you like, add a short personal message: 300 characters and 5 lines at most, plain text, without any web address, domain name, e-mail address or phone number. It is quoted in the e-mail, and in the reminders, as a message from your workspace.
Press Send the questionnaire. Your contact receives an e-mail in that language, from your workspace’s name through Perimetry, with a personal link. If they reply to the e-mail, the reply comes to you (or, once you have left the workspace, to nobody). They need no account. A workspace or supplier name that looks like a web address or a domain name is refused: rename it first.

About twenty short questions cover governance, access and multi-factor authentication, backups, encryption, e-mail security, vulnerability management, incidents (a warning within 24 hours, a notification within 72 hours), subcontractors, data location, the GDPR and the data processing agreement, certifications and continuity. Answers are yes, partly or no, a text or a date, each with an optional comment, and a file where it helps (a certificate, the list of subcontractors, a DPA): PDF, PNG or JPEG, 1.5 MB at most.

Pre-filled with what we see. Where Perimetry can see the answer from outside (valid HTTPS, redirect and HSTS, old TLS versions, security headers, security.txt, SPF and DMARC), your supplier sees what was observed next to the question and the answer is pre-filled from it: they confirm it or correct it. Multi-factor authentication cannot be seen from outside, so that answer is left empty.

The page saves the answers as your supplier types. The link works until the due date and 7 days more; once the answers are sent, they are locked. Reminders go by themselves 7 days after sending and 2 days before the due date, two at most for a questionnaire, new links included. On the supplier’s page, Cancel stops a questionnaire’s link at once, and Send a new link sends it again (to the same or another address, with a new due date if needed): the previous link stops working and what was entered is kept.

Solo includes 5 questionnaires a month, Agency 30 and Agency Plus 100. With the Agency plans, See or change the questions lets you turn default questions off and add your own; otherwise the default questions are sent.

Read the answers

When a supplier sends its answers, the person who sent the questionnaire receives an e-mail, and the channels of the Alerts page that are not limited to a client get a message. The answers page shows:

the answer score: each yes/no question gives 1 point for Yes, ½ for Partly, 0 for No or no answer; when what Perimetry observes contradicts an answer, what is observed counts. Text and date answers count only in the completeness. 80 or more is strong, 50 to 79 is to discuss, under 50 is weak. It measures what the supplier declares, not a certification;
the gaps: answers contradicted by what Perimetry observes (for example “encryption in transit: yes” while the site has no valid HTTPS), and a current certification whose expiry date has passed;
each question with Declared by the supplier and Observed by Perimetry side by side, with the comments and the attachments.

Export the answers as PDF or CSV. The questionnaires are in the export of your workspace’s data and are deleted with the supplier or with the workspace. Attachments are kept 12 months after the answers are sent; a link never answered loses its draft and your contact’s address 30 days after it ended.

To stop following a supplier, press Remove: its questionnaires and their answers are deleted with it.