Governance Tool

AI Vendor Governance Auditor

Perform vendor risk management checks under NCUA Letters to Credit Unions and GLBA privacy requirements. Evaluate third-party SaaS contracts, compute compliance grades, and download board briefing sheets.

Vendor Company Name

Security+20 Points

Audit Credentials: Does the vendor hold a current, independent SOC 2 Type II compliance audit report?

Security+20 Points

Data Isolation: Does the agreement legally prohibit the vendor from using your inputs/prompts to train future model weights?

Fairness+20 Points

Bias Assessments: Has the vendor completed an independent algorithmic fairness/bias audit for credit discrimination?

Fairness+15 Points

Explainable Criteria: Does the model supply transparent credit scoring variables instead of opaque black-box recommendations?

Security+15 Points

Data Encryption: Are raw prompts and observation data encrypted both in transit (TLS 1.3) and at rest (AES-256)?

Resilience+10 Points

SLA Guarantees: Is there an SLA agreement guaranteeing at least 99.9% availability with monetary service credits for downtime?

Legal+15 Points

Data Extraction: Can the credit union extract 100% of its data and verify complete deletion upon contract termination?

Legal+20 Points

Copyright Indemnity: Does the contract fully indemnify the credit union against copyright, intellectual property, or accuracy lawsuits?

Fairness+15 Points

Training Lineage: Does the vendor document training sets and screen for toxic, copyrighted, or demographically imbalanced records?

Resilience+15 Points

Model Drift Audits: Does the vendor monitor model decay over time and supply quarterly performance validation audits?

Security+15 Points

Vulnerability Shielding: Does the architecture defend against prompt injections, data poisoning, and model extraction (OWASP LLM Top 10)?

Security+15 Points

PII Client Scrubbing: Does the system automatically scrub or mask SSNs, names, and account numbers *before* sending data to the cloud?

Resilience+10 Points

Model Redundancy: Is there an automated failover LLM to preserve branch continuity if the primary API provider suffers an outage?

Security+10 Points

Structured Logs: Does the vendor log system parameters (temperatures, prompt templates, instructions) to verify policy adherence?

Vendor Security Grade

Fiduciary compliance evaluation score.

F42% Compliance

Critical Rating

Fiduciary Compliance Note

Regulatory audits by the NCUA examine third-party SaaS technology platforms. Fiduciary duties prevent boards from signing contracts that grant vendor ownership of member database inputs or waive intellectual property lawsuit shields.