Six weeks of email, or two days: how Fold Systems rebuilt vendor review around evidence

The problem: six weeks of follow-up

Fold Systems sells payroll infrastructure, so every vendor that touches employee data goes through a security review. In 2025 that meant 240 reviews handled by three people in IT Operations, tracked in a shared inbox and a spreadsheet with 41 columns.

The reviews were not slow because scoring was hard. They were slow because a reviewer sent a questionnaire, waited, sent a reminder, waited again, then re-sent the same request to a new contact when the first one left the company. The median review took 41 working days. Four of those days involved anyone reading anything.

What changed

Intake moved to a /vendor-review Slack command, so requests arrive from the engineer who wants the tool instead of through a form nobody could find. Urengi reads the vendor’s public trust page first, asks only for what is genuinely missing, and chases on a schedule without anyone in IT Operations sending an email.

“The first week, three vendors uploaded their SOC 2 without anyone from my team sending an email. That was the moment.”

The numbers, six months in

Between July 2025 and January 2026, Fold Systems ran 118 reviews through Urengi. Median time from request to decision fell from 41 working days to two. Evidence arrived without a human chasing it in 82% of cases; the remaining 18% were vendors with no public trust page — which is now the first thing procurement asks for.

• Four risk tiers from a rules engine Fold Systems owns and edits, so every score can be defended line by line in an audit.
• Evidence collected once and reused at renewal, instead of re-requested from the vendor every twelve months.
• Reviews reopen themselves when a certificate expires or a sub-processor changes, with no annual calendar reminder involved.

BEFORE
  Day 0    Request arrives by email
  Day 3    Questionnaire sent to the vendor
  Day 12   First reminder
  Day 26   Second reminder, new contact
  Day 41   Decision recorded

AFTER
  Day 0    /vendor-review filed in Slack
  Day 0    Trust page crawled — 3 of 5 documents found
  Day 1    Vendor uploads the remaining two
  Day 2    Tier assigned, decision recorded

What’s next

Fold Systems is extending the same tiering to sub-processors, and to the 60 vendors that arrived with last year’s acquisition. Renewals for 2026 are already scheduled against evidence that is in the vault. The review team is still three people.