The vendor review should not be a group project.

Urengi is 38 people in Lyon and Berlin building the review workflow we wanted when we ran security programs ourselves.

Founded 2021 · 380 companies · Lyon & Berlin · SOC 2 Type II

Companies running reviews: 380
Vendors monitored: 41,000
People across two offices: 38
Evidence collected without a chase: 82%

Why we built it

Two security programs, the same six weeks of email, twice.

The problem

We ran vendor security at a payments company and a hospital group. Both times the review was a spreadsheet, forty questions and six weeks of email. The vendor was never the bottleneck — the chase was.

The bet

So we inverted it. Urengi goes to the vendor directly, reads the public trust page before asking a human for anything, and escalates only what it could not find. Your colleagues stop being the middle layer.

Where we are

Four years in, 380 companies run their reviews on Urengi and 82% of evidence arrives without anyone sending a reminder. The four of us who started it still answer support tickets on Fridays.

Three things we will not trade away

They have survived every roadmap argument since 2021.

The vendor is not the enemy

Every screen a vendor sees is one we would be willing to fill in ourselves. No login, no 200-row spreadsheet, no account to create before uploading a SOC 2.

A score you can defend

If an auditor asks why a vendor landed at Standard, the answer is on the screen. Rules are visible, editable and versioned — never a black-box rating.

Ship where the work is

Security teams live in Slack and a ticket queue. We meet them there instead of asking for one more tab to keep open all day.

How we got here

2021
Two founders, one spreadsheet
Marc and Inès leave a payments security team and spend six months running vendor reviews by hand for four design partners.
2023
The chase goes away
Trust-page crawling ships. Evidence starts arriving before anyone sends a reminder, and the first 100 companies sign on.
2024
Slack-native intake
The /vendor-review command lands. Deployment drops from a quarter to an afternoon, and Berlin opens with six people.
2026
380 companies
41,000 vendors monitored, SOC 2 Type II renewed, and the roadmap still gets written from support tickets.