Representatives

A representative is a person attached to an entity — typically an employee of the vendor — who matters to you: the contact for a contract question, the security lead who answers the questionnaire, the person who signs off an assessment. Representatives turn “we asked the vendor” into “we asked a named person on a date”, which is the difference between a relationship and an audit trail.

Where to find it

Third parties → Representatives in the sidebar, or the Representatives tab on an entity’s own page. The list shows Email, Entity and Role, and filters by entity.

What a representative holds

Field	Notes
Email	Required, and unique across the platform — it is the identifier
Entity	The organisation they speak for. Required
First name, Last name	Their name, used in listings and in questionnaire invitations
Phone	An alternative channel when a questionnaire goes quiet
Role	What they are responsible for — security contact, account manager, DPO
Description	Free text for anything the fields do not cover
Reference ID	Your own identifier for the person, if you keep one
Labels	Free-form tags for grouping and filtering

Role is the field that does the real work. In an incident or a contract renegotiation, the register is only useful if it says who to call for what — “Security contact” and “Commercial contact” on the same entity save a round of guessing.

Giving a representative access

Tick Create user on the form and the platform creates, or links, a third-party user account based on the email address. That account is what lets the person log in and answer a questionnaire assigned to them.

Their access is deliberately narrow. A third-party user lands in the auditee experience and sees only the entity assessments attached to their own entity — never your workspace, never other vendors, never the domain the assessment sits under. See Auditee mode and portals for what that surface looks like and what it takes to enable it.

Caution

The email address is the account identity, so a shared mailbox becomes a shared login and every answer is attributed to the mailbox rather than to a person. Register individuals, and add a second representative rather than passing one account around.

If you do not need the vendor in your instance at all — because policy forbids it, or because they refuse to log into a supplier’s platform — leave Create user unticked. The representative still exists as a contact record, and the questionnaire can be exchanged as a spreadsheet instead.

Keeping the register current

People change jobs faster than vendors change. A representative who has left is the most common reason a questionnaire stalls, and the symptom shows up on the third-party dashboard as an assessment that has not moved. When a contact changes, add the new person before removing the old one so the assessment always has a live recipient.

Related

• Entities — the organisations representatives belong to.
• Entity assessments — where representatives are assigned and invited.
• Auditee mode and portals — the surface a third-party user logs into.