A Protecht vendor response needs artifact-level provenance

Workspace completion is an intake state

Protecht's current page connects vendor engagement, document collection, questionnaires, assessments, monitoring, findings, actions, renewals, and offboarding. The workspace can make outstanding requests and interactions visible, while automated collection can bring public records, trust-center material, and uploaded artifacts into the review. That is a useful operating layer, but the arrival of a file or answer establishes only that a response was received through a named channel.

The assurance question begins after intake. A questionnaire answer may be a vendor assertion, an assurance report may cover only one legal entity or service, a certificate may have a narrow scope, and a policy may be expired or unauthorised for external reliance. The record should not silently convert vendor participation, a complete task, or an AI-readable attachment into proof that the represented control exists, operated for the required period, or applies to the buyer's service.

Give every artifact its own identity

Each uploaded or collected item should retain the supplying party, original location, retrieval method, filename or source identifier, content hash, document type, issuer, covered legal entity, product or service, facility, geography, control scope, observation period, issue and expiry dates, version, signer or attestor, confidentiality limits, and the relationship record that requested it. Derived text, extracted fields, summaries, mappings, and ratings should point back to that immutable source object.

Questionnaire responses need similar treatment. Preserve the exact question and framework version, conditional logic, respondent identity and role, answer, comments, supporting attachments, submission time, later corrections, and any reuse from an earlier assessment. If one response is copied across services or business units, the system should expose that propagation instead of making repeated fields appear independently confirmed.

Separate machine review from accountable validation

Protecht states that AI-assisted assessments can review evidence, map control coverage, create summaries, and produce explainable risk views while humans retain validation and final decisions. A governed implementation should therefore retain the model or service version, prompt or extraction configuration where available, rules and framework versions, input artifacts, output, confidence or exception flags, reviewer changes, and reasons for accepting, rejecting, or narrowing a machine-generated conclusion.

The final assessment record should name the risk object, service and dependency scope, evidence cut-off, unresolved gaps, compensating controls, findings, affected requirements, residual-risk conclusion, conditions, decision owner, authority, effective period, and monitoring triggers. A corrected artifact or overturned extraction should create a superseding assessment path and identify affected decisions rather than rewriting the earlier record.

Test provenance with conflicting submissions

A representative evaluation should invite two vendor contacts to answer the same control question, upload an expired certificate, submit an assurance report for the wrong subsidiary, replace a policy after assessment, and provide a trust-center artifact that changes at its source. Reviewers should identify every mismatch, preserve both versions, prevent unsupported scope inheritance, route clarification, and show which evidence and reviewer action produced the final conclusion.

Protecht's official page supports the described vendor-workspace, evidence-collection, AI-assisted assessment, control-mapping, monitoring, and human-validation positioning. This review did not test a buyer tenant, vendor identity, artifact, questionnaire, trust-center connection, model, mapping, rating, workflow, integration, decision, or outcome. Buyers retain responsibility for evidence sufficiency, risk interpretation, approval authority, privacy, security, resilience, procurement, compliance, and legal judgment.

What we will watch next

Third Party Current will watch for later primary-source evidence that changes the maintained company, capability, or standards record. The next useful evidence may include implementation documentation, release details, regulator findings, corrected methods, product packaging, customer-observable workflow, or a subsequent company statement. Until then, the dated source and its stated boundary remain attached to this analysis.