Regulation (EU) 2022/2554 · applies since 17 January 2025
Banks, insurers and fintechs must run due diligence on the ICT providers they use — before signing, then on a monitoring cycle. VendorDORA is the first draft of your side of it: the Article 30 clause sets, the register data your customer needs from you, and the evidence index behind both. Written once, reused with every customer.
The problem
ART. 28–30
EU financial entities must assess every ICT provider before signing and keep monitoring it afterwards. If you sell software to banks, insurers or fintechs, that assessment reaches you whether or not you had heard of DORA.
200+ QUESTIONS
Each institution sends its own format — Excel portals, PDF forms, procurement platforms. Your team rewrites the same security answers from scratch, every single time.
DEAL RISK
Procurement won't close until your answers are in. Weeks of back-and-forth kill momentum — and sometimes the deal itself.
Scope first
Half the anxiety in this market comes from selling every vendor the heavy version. The regulation itself is proportionate, so the toolkit is too.
BASELINE · ART. 30(2)
CRITICAL OR IMPORTANT FUNCTION · ART. 30(3)
What's inside
01
Drafted answers for the questions financial customers ask, mapped to Articles 28–30 and to the acts that actually bind a provider: RTS 2024/1773 on ICT services supporting critical or important functions, and RTS 2025/532 on subcontracting.
02
The Art. 30(2) clauses belong in every contract, including a small SaaS selling a non-critical tool. The heavier set in Art. 30(3) — full SLAs, on-site audit rights, exit strategy, TLPT participation, subcontractor disclosure — applies only where your service supports a critical or important function. The toolkit keeps them apart so you don't concede CIF terms you don't owe.
03
The register is your customer's filing obligation (Art. 28(3)), on the templates set by the ITS, Reg. (EU) 2024/2956 — forms B_01 to B_07. What a vendor can supply is the data behind those forms: legal name and LEI, country, service type, criticality, subcontractors. This is the one sheet you hand over instead of a call.
04
Exactly which certificates, policies and test reports to attach — ISO 27001, penetration tests, continuity test results — where each one lives, and how to present a gap honestly instead of hiding it.
05
Your ICT subcontractors, their function, their country and your concentration risk, laid out the way RTS 2025/532 frames subcontracting for services supporting critical functions.
06
For 12 months, a plain-English note whenever the ESAs publish guidance or an act changes something that affects your answers — with the specific lines to edit.
Free resource
The nine areas a due-diligence questionnaire covers, what to prepare for each and which evidence closes the answer.
Free sample
The question as it arrives, the answer you send, the evidence that closes it — register data, subcontractors, incidents, exit.
Early access
The toolkit launches once enough vendors are on the list. Join now and lock the price below — no charge today, no obligation.
Self-serve, for one product team
€249€399
One-time · includes 12 months of updates
Founding price locked for the waitlist. Final price at launch: €399.
We adapt it to your stack, together
€1,490€1,900
One-time · 3 working sessions, 12 months of updates
The answers you send remain your own statements about your own systems. The toolkit prepares the drafts and the evidence; it is not legal advice and it is not a compliance certification.
Full pricing, market comparison and contact →Evidence, not testimonials
This product is in validation and has no customers yet, so there are no case studies or testimonials on this page — inventing them would be the fastest way to lose a compliance buyer. What can be shown is the source material the toolkit is built on.
The regulation itself. Article 28 sets the general principles for ICT third-party risk, Article 30 lists the contractual provisions your customer must obtain from you. Applies since 17 January 2025.
Read the official text →The technical standard on the policy for ICT services supporting critical or important functions — the source of the heavier requirements you may be asked to accept.
Read the official text →The technical standard on subcontracting ICT services that support critical or important functions — behind every question about your own suppliers.
Read the official text →The register of information templates (forms B_01–B_07) your financial customers file with their authorities. The data in those forms is what they come to you for.
Read the official text →The European Supervisory Authorities publish the register templates, guidance and reporting arrangements the toolkit tracks.
Read the official text →ILLUSTRATIVE EXAMPLE · NOT A CUSTOMER
A 12-person SaaS sells a reporting tool to an EU insurer. Renewal time, procurement sends a due-diligence pack: describe the service and where data is processed, confirm the Article 30(2) clauses, state whether the service supports a critical or important function, list ICT subcontractors with countries, supply the register data (legal name, LEI, service type), attach ISO 27001 and the latest penetration test, and commit to incident notification timelines. The answers exist inside the company — scattered across a security policy, a DPA and two engineers' heads. Writing them once, in the customer's language, is the work the toolkit removes.
Composite example built from the public requirements above, not a real client engagement.
When the first vendors have used it, their words go here — named, with what changed for them. Until then this space stays honest and empty.
Questions
You can, and it is entirely doable — it just costs several days of senior time reading Regulation 2022/2554, the RTS on ICT services supporting critical functions, the subcontracting RTS and the register ITS, then a second pass turning them into text a procurement reviewer accepts. The toolkit is that first draft, already structured, so your senior time goes to reviewing rather than starting from a blank page.
No — and anything that promises that is a different product, an automation platform. What you get is the drafted answers, the clause sets and the evidence index; pasting them into each customer's own format stays with you. The saving is that you write the substance once instead of once per customer.
PHABDEV — Fabrizio Ferrante, a full-stack software engineer in Turin, Italy, with 14+ years building software products. The material is written from the public regulatory texts: the regulation itself, the delegated and implementing acts, and the ESAs' published templates. Nothing in it comes from any client's confidential questionnaire.
No. It is documentation work: source texts read closely and turned into templates you adapt to your own service. Your legal counsel reviews the contractual commitments before you sign them, and the answers stay your statements about your own systems.
That is exactly the case the baseline track is for. If your tool doesn't support a critical or important function, you owe the Art. 30(2) clauses and a clear description of the service — not the full audit-and-exit apparatus. Knowing which side of that line you're on is half the value.
DORA is an EU regulation binding on your customers, so it reaches any ICT provider selling into EU financial entities — wherever your own company is incorporated.
One email when the toolkit is ready, with the price below reserved for the list. Nothing is charged today, and if there isn't enough interest to justify building it, I'll tell you that too and delete the list.