We build Agents. You build the Future.
● B2B offer — Trusts, funds and similarThird-party cyber risk — Trusts, funds and similar: suppliers registered, evidence checked
Fonds Térial has no employees: everything is delegated, and the chain runs deeper than the agreements name. The agent reads the agreements, the administrator extranet and the tracking sheet: it unfolds the layers of delegation, names what can be named, records what stays unknown, and prepares the reversibility amendments. The supervisory board decides; the delegated director signs. You arbitrate on dated facts: every file arrives with its factors, its counted unknowns and the document that will lift them — and the signature stays yours, handed back in minutes rather than in committee.
Updated on
Fictional simulation — not a client result
Each file carries its unknowns and the date of its most recent evidence.
⛓ Sourced · supplier register, contract vault, access register
The request pack is ready — statement of applicability and scope annex — and goes out as soon as you approve it.
✎ Framework · a certification covers its scope and its period
For an organisation established outside the European Union, the law of its own country applies; at its request, we put equivalent safeguards in place (human review before any action, a log of the criteria, information for the people concerned).
A Blue Lemon Agent third-party cyber risk agent registers the supplier relationship, derives criticality from the functions supported, checks evidence against its scope and period, unfolds the subcontracting chain, measures concentration across the aggregate of services and prepares treatment and exit plans. It runs on local inference or is hosted in France, with an architecture designed to reduce exposure to extraterritorial laws, location alone not guaranteeing immunity.
Reference points describing our offer, not results measured at a client. The gain on your supplier portfolio is confirmed by a pilot, on your own files.
Indicative estimate, to be confirmed by a pilot on your real files (general terms of sale, article 4).
One plan, one agent
A third-party cyber risk agent — eleven modules included — installed and operated for you. Prices excluding VAT, annual subscription. The twenty sector variants share this price: they change the content, never the engine or the price.
Setup + controlled subscription
- Installation, configuration and training for your teams
- Operation, human oversight, updates and support
- Hosting in France, a dedicated and isolated resource
All inclusive, no setup fee
- Setup included (installation, configuration, training)
- Operation, human oversight, updates and support
- Hosting in France, managed end to end
On site, you own it
- Hardware installed on your premises (you own it)
- French / European AI models run locally
- Secure remote maintenance (Pro support included)
What does the agent actually do?
Eleven modules included in the core, plus sovereign AI; a single state machine, with links to neighbouring agents. The agent carries out by itself what you authorise it to do; the decision stays with your authorised managers, who set what it does on its own and what it submits to them.
Third-party and service register
Records the supplier, group, service, contract, sub-processors, countries, data, access, owners, dates and relationship status.
Business criticality and data
Links the service to the functions it supports, target recovery times, volumes, data categories, privileges and substitutability.
Boundary: qualifies data to size the security risk and the dependency. Lawfulness of the processing, its legal basis and the record of processing activities belong to the DPO/GDPR support agent, billed separately.
Adaptive questionnaires
Selects questions by criticality and applicable framework, reuses answers still in date, asks for justification and tracks non-responses.
Evidence collection and checking
Checks period, scope, issuer, signature, qualifications, exceptions, corrective plans and the consistency of the attestations provided.
Boundary: checks SECURITY evidence — scope, period, issuer. Documents already held by the DPO/GDPR support agent are reused as they are: the same supplier is neither re-surveyed nor billed twice.
Exposure and authorised vulnerability review
Aggregates security advisories, public incidents and the expressly authorised surface, with no intrusive testing and no unproven attribution.
Risk scenarios
Structures feared events, sources, paths through the third party, existing measures, severity, likelihood and residual risk.
Explainable scoring
Computes separate dimensions with their factors, weights, unknowns and confidence; keeps the score before and after the supplier’s rebuttal.
Contracts and requirements
Compares clauses on security, notification, audit, location, subcontracting, continuity, reversibility and deletion.
Boundary: carries security, reversibility and notification requirements into the contract. Drafting the Article 28 clauses and the data processing agreement remains the work of the DPO/GDPR support agent.
Treatment plans
Turns each gap into a measure, with owner, deadline, expected evidence, any exception and a motivated temporary acceptance.
Monitoring and incidents
Tracks changes, evidence deadlines, relevant vulnerabilities, declared incidents, service commitments and reassessments.
Exit, evidence and steering
Prepares alternatives, extraction, transition, revocation, deletion and tests; keeps decisions, versions and indicators.
Sovereign AI
The hosting and confidentiality foundation the agent runs on.
Compliance of the processing itself — lawfulness, record of processing activities, impact assessments — and the drafting of Article 28 clauses are NOT part of this core: they are carried by the DPO/GDPR support agent, billed separately. This core handles third-party security, dependency, concentration and exit; it unfolds the subcontracting chain to rank 1 for every relationship and to the declared rank 2 for critical ones. Unfolding “rank 3 and beyond” and preparing the DORA register of information submission file are options. The supplier’s identity and the evidence common to both agents are reused: they are not collected twice, and they are not billed twice.
Extend this agent's capabilities
These capabilities are layered onto the SAME agent, not another one. They are billed per grid tier, not at the price of an agent.
Extends the unfolding of the subcontracting chain beyond tier 2: mapping of tier 3 and further tiers, concentration measured across that whole chain, and exit plans that take it into account. Anything not named stays recorded as unknown, with the question asked and its date. Option chosen in the checkout, set-up then monthly.
+ 500 € excl. VAT set-up, then 35 € excl. VAT / month — chosen in the checkout Choose my add-ons →Need to go further?
These agents handle a different business process, with their own owner and their own price. They are added to this one.
End-to-end contracts
Carry into the contract the clauses the assessment calls for, then track renewals and notice periods.
End-to-end contract management agent from 362 € excl. VAT / month Discover the agent →Procurement and suppliers
Run the consultation and compare offers; the cyber opinion joins the file, it does not decide it.
Purchasing / supplier agent (quotes, follow-ups) from 259 € excl. VAT / month Discover the agent →Cybersecurity and logs
Correlate and qualify your INTERNAL alerts. This core assesses third parties: the scopes do not overlap.
Cybersecurity agent (log analysis) from 311 € excl. VAT / month Discover the agent →DPO / GDPR support
Lawfulness of the processing and Article 28 clauses. This core handles security, dependency, concentration and exit: the third party’s identity and the shared evidence are reused, never collected or billed twice.
DPO / GDPR support agent from 343 € excl. VAT / month Discover the agent →In 30 minutes we identify the most relevant agent — without oversizing the project.
See the agent at work
5 everyday situations, taken from those that come up most often. Pick one: the exchange unfolds as it would in your organisation.
A scripted demonstration. These exchanges show how the agent behaves — its sources, its refusals, what it leaves to your teams. Nothing is sent from this page, no model is queried here, and the matters named are fictional. That is precisely what we promise your data. The behaviours shown here — monitoring, automation rules, routing and reminders — are configured with you during deployment, from your tools, your rules and your thresholds. The architecture points named in these exchanges — location, local execution, isolation, encryption, role-based access, logging — are not a guarantee attached to the demonstration: they are those of the architecture set out in your quotation, and verified before commissioning.
The company in this demonstration
Fictional companyFonds Térial — fictional investment vehicle, fully delegated structure
- Sector
- Investment vehicle — management, administration and registry keeping fully delegated
- Headcount
- No employees of its own; 3 directors and a 5-member supervisory board
- Who is served
- 820 unit holders, 40 of them institutional
- Order of magnitude
- 4 vehicles, 260 subscriptions per month, 3 observed layers of delegation
- Tools in place
- Administrator extranet, document vault, agreement tracking sheet
- Who decides
- The supervisory board arbitrates; the delegated director signs the agreements
- Improvement points
- 3 layers of delegation, the third named nowhere; 4 agreements without a reversibility clause
Fonds Térial has no employees: everything is delegated, and the chain runs deeper than the agreements name. The agent reads the agreements, the administrator extranet and the tracking sheet: it unfolds the layers of delegation, names what can be named, records what stays unknown, and prepares the reversibility amendments. The supervisory board decides; the delegated director signs.
This company, its figures and the exchanges that follow were invented for the demonstration. They illustrate a common situation; they describe no real client.
Fictional simulation — not a client result
Registering, here, means linking each supplier to the SERVICE it provides and to the FUNCTION that service supports. Without that link no criticality can be computed — and that link was missing everywhere.
The first file I put on the table: The administration agreement, at the first layer of delegation.
· State opened: assessment in preparation, priority P2, on the fact “criticité et substituabilité visibles”.
· 10 of 12 controls are not compliant, and I tell you which and why, one by one.
· 0 unknown factor(s) — displayed confidence drops to 100%, and the score does not rise by a single point for it.
What I propose: I show you how this ranking recomputes from your own data, factor by factor, with no opaque score in between. parc-recense_relations-et-services.pdf4 business objects linked, each to its owner
⛓ Sourced · supplier register, contract vault, directory
For this file the fact retained is “criticité et substituabilité visibles”, and it comes from your inputs, not from an opinion: criticalFunction = yes, substitutability = low, evidenceFresh = yes.
The score is kept before AND after the supplier’s rebuttal. It never has the last word: it opens a review. The supervisory board arbitrates; the delegated director signs the agreements.
And the next step, if you want it: I run the same reading across the whole portfolio and hand you the ordered list, each line with its factors and its date. fiche-relation_facteurs-visibles.pdf6 dimensions, their weights, their factors and the confidence
✎ Framework · the score opens a review, it decides nothing
· Third-party and service register — Records the supplier, group, service, contract, sub-processors, countries, data, access, owners, dates and relationship status.
· Business criticality and data — Links the service to the functions it supports, target recovery times, volumes, data categories, privileges and substitutability.
· Adaptive questionnaires — Selects questions by criticality and applicable framework, reuses answers still in date, asks for justification and tracks non-responses.
· Evidence collection and checking — Checks period, scope, issuer, signature, qualifications, exceptions, corrective plans and the consistency of the attestations provided.
· Exposure and authorised vulnerability review — Aggregates security advisories, public incidents and the expressly authorised surface, with no intrusive testing and no unproven attribution.
· Risk scenarios — Structures feared events, sources, paths through the third party, existing measures, severity, likelihood and residual risk.
· Explainable scoring — Computes separate dimensions with their factors, weights, unknowns and confidence; keeps the score before and after the supplier’s rebuttal.
· Contracts and requirements — Compares clauses on security, notification, audit, location, subcontracting, continuity, reversibility and deletion.
· Treatment plans — Turns each gap into a measure, with owner, deadline, expected evidence, any exception and a motivated temporary acceptance.
· Monitoring and incidents — Tracks changes, evidence deadlines, relevant vulnerabilities, declared incidents, service commitments and reassessments.
· Exit, evidence and steering — Prepares alternatives, extraction, transition, revocation, deletion and tests; keeps decisions, versions and indicators.
· Sovereign AI — the hosting and confidentiality foundation all of this rests on: local inference or an isolated resource hosted in France.
All eleven are included, at no extra cost: security, traceability, human validation and the demonstrators are never sold as options. modules-mobilises_onze-modules-du-socle.pdfthe eleven core modules and what each brings
✎ Framework · eleven modules included in the core, at no extra cost
Fictional simulation — not a client result
What I observed: fourthPartyDeclared = no, dataProcessing = yes.
What the rule concludes: chaîne incomplète — state contradictory review open, priority P2.
What I propose, already written out: the measure goes out with its owner, its deadline and THE EXPECTED DOCUMENT named in advance — that document, and only it, will close the measure. Remediation closed on a promise stays open in my file. ecart_valeurs-observees-et-regle.pdfobserved values, rule applied, rule version
⛓ Sourced · documents received, contract in force, internal policy
If the supplier is right, the measure closes on their document — dated, signed, with its scope. If they bring nothing, the gap stays in the file with the date of the request: silence closes nothing.
Either way you gain the same thing: The supervisory board arbitrates; the delegated director signs the agreements — and you arbitrate on dated facts instead of an impression. plan-traitement_mesure-proprietaire-echeance.pdfmeasure, owner, deadline, expected evidence
✎ Framework · the rebuttal is kept, it erases nothing
Fictional simulation — not a client result
State opened: contradictory review open, priority P2, fact retained “inconnues non masquées”.
5 unknown factor(s) in the file, and here is what they do — and what they do not: displayed confidence moves to 50%, the score does not move a point. An unknown is neither an automatic failure nor an implicit pass.
The protocol is already drafted: the exact question, the recipient, the expected document and the follow-up date. It goes out as soon as you approve it. inconnue_protocole-de-levee.pdfquestion asked, recipient, expected document, follow-up date
⛓ Sourced · questionnaire, register, observed flows
What I bring you meanwhile, depending on nobody: what your own records already say — the contract, the observed flows, the access history. The file advances on what is verifiable, while waiting for what is not yet.
And a comparison that clarifies: a relationship reviewed with two named unknowns can be decided; a relationship showing no unknowns at all does not prove there are none — it proves nobody looked for them. journal_questions-posees-et-dates.pdflog of questions, follow-ups and non-responses, with their dates
✎ Framework · a non-response is a dated fact, not a blank
Fictional simulation — not a client result
State opened: decision reserved for the manager, priority P1, fact retained “preuve d’un autre client inaccessible”.
What the file already contains: the observed values, the rule applied and its version, the 12 non-compliant controls with their justification, the score and its factors, the 0 unknown(s), and the measured effect on the services supported.
Who signs, and why that is an advantage: The supervisory board arbitrates; the delegated director signs the agreements. The decision is yours — and I hand it back to you in minutes: a complete, quantified, reasoned file. You decide on dated facts instead of convening a committee to gather the papers. dossier-de-decision_complet-chiffre-motive.pdfvalues, rule, controls, score, unknowns, effect on services
✎ Framework · the act commits the organisation, the file is ready
A plan never tested remains a hypothesis — so I propose the exercise that makes it credible, with its date, its scope and the gap measured against the recovery time you target.
What you end up with: exit plans tested rather than declared. Approve the exercise and it is scheduled this week. plan-de-sortie_alternatives-et-exercice.pdfalternatives, extraction, transition, revocation, deletion, success criterion
⛓ Sourced · documented alternatives, extraction format, reversibility exercise
Fictional simulation — not a client result
What I establish: 3 delegation levels observed, 4 signed agreements, 260 subscriptions a month, and at rank 3 an entity that hands registry keeping to the rank-1 delegate.
This case had not yet been taken into account in your configuration: your rule says the provider’s provider is a fourth party, and that it is either named or declared unknown; it assumes a chain that goes down, and this one comes back up. So I settled nothing on my own, and the review carries on with what is already verifiable.
Three ways of doing it. Stop unfolding at rank 3 and describe the loop in a comment: the register stays short and the chain is described, but the circular dependency has neither owner nor review date, and nothing reopens it. Merge the ranks concerned into a single entity line: the dependency shows plainly, at first glance, but your 4 agreements disappear from the register, and the supervisory board no longer sees who signed what. Keep all three ranks and open a circular-dependency line, with its owner and its review date: the cascade stays readable and the loop becomes a tracked object, but one more line, which no rank declaration will produce on its own.
I recommend the third. your structure employs no staff: what is not entered in the register exists nowhere else, and an unrecorded loop will be seen by nobody at the next review.
You can also define another one — for instance: keep the three ranks and carry the loop in the supervisory board report alone, with no register line.
Shall I remember it for the next cases of this kind? Across your 4 vehicles, 2 cascades return to a rank already named, and one of them runs through registry keeping. If you approve, I will flag the next loop as soon as a new rank is declared.
⛓ Sourced · delegation agreements, register of essential providers, rank declarations
The rule, in one sentence: a delegation cascade that returns to a rank already named keeps every rank in the register, and a circular-dependency line is opened with its owner; its review date is the renewal date of the agreement at the rank concerned — your correction — and the line closes the day the loop disappears.
What I found while reviewing this file, and it is worth more than the rule: your 4 agreements carry no reversibility clause, and I looked at what stands in for one: 3 of them point to a termination notice period, which says when you leave without saying what you take with you.
What it is worth: adding the clause at renewal rather than by a standalone amendment costs one negotiation already open instead of four to open, and your 4 agreements fall due over 14 months: the register goes from 0 to 4 reversible agreements without reopening a single live contract.
The decision is yours: it is your agreement calendar, and the delegated director signs them. I give you the 4 due dates and what the clause must name to be testable: extraction format, deadline and recipient. I change nothing before you have written it, and the rule is withdrawn in one line.
✎ Rule approved · written under its name, with its date and the file that gave rise to it — reversible in one line
Your case is not here? That is exactly what a 30-minute conversation is for. Discuss your project →
The stages of your AI agent project
Audit & scoping
30 minutes to target the use case with the best return.
Quote or direct sign-up
A catalogue offer is bought online; a specific need gets a costed quote.
Design
We design the agent and its guardrails.
Integration & testing
We connect your tools to the agent, which is itself hosted in France.
Rollout
Going live and training your team.
Operation
Continuous supervision and improvement.
What does an AI agent bring to supplier assessment?
A relationship that is registered, quantified and dated is arbitrated in minutes; a file scattered between a contract, an attestation and three emails has to be rebuilt from scratch.
! The stake
Assessing a supplier means gathering what can be verified and naming what cannot. That reconciliation work is systematic and lends itself to automation; deciding to accept a risk commits the organisation.
✓ Our answer
Your managers arbitrate across the whole portfolio rather than the suppliers someone remembers to check — and each file arrives already registered, quantified and dated. Every score keeps its factors, before and after the supplier’s rebuttal: your conclusion holds up in front of them, and it corrects itself when they produce the document. Data hosted in France on an isolated resource; the AI model is called at its publisher, except with the Sovereign model option. With the 100% Sovereign package, your audit reports and dependency maps do not leave the organisation.
Audit reports, contracts and dependency maps: sovereignty & separation
The evidence your suppliers entrust to you describes their weaknesses as much as your dependencies: its confidentiality is a security matter in itself.
Local inference
With the 100% Sovereign package, the agent runs on a machine in your organisation: no audit report, contract or dependency map leaves the network.
Hosted in France
Otherwise, with the Agility and Serenity packages, a dedicated, isolated resource hosted in France, under French law: data hosted in France; the AI model is called at its publisher, except with the Sovereign model option.
Strict tenant separation
A report filed by one client is never readable by another, whoever issued the document. Sharing across tenants requires written, traceable permission.
Reduced extraterritorial exposure
For your audit reports and dependency maps, the architecture aims to reduce exposure to extraterritorial laws; location alone does not by itself guarantee immunity.
Named human gates
Accepting a risk, starting an exit, escalating an incident: three states only an authorised manager can open, with reason and timestamp.
Tamper-evident log
Every transition carries its evidence, actor and timestamp; refusals are logged just as passages are.
What depends on the architecture chosen These points are not general guarantees: they are settled deployment by deployment, in the quotation.
- The applicable location is that of the architecture set out in the quotation and verified before commissioning.
- Local execution is announced only for the configuration explicitly described and accepted in the quotation.
- The applicable isolation depends on the deployment mode set out in the quotation; no dedicated isolation is presumed.
- The events logged, their content, their retention period and who may access them are defined for the deployment chosen.
How many relationships can a team review?
By taking on registration, evidence reconciliation and file assembly, the effort moves to arbitration. The size of the gain depends on your portfolio and remains to be confirmed by a pilot.
Four guarantees that matter here
Related resources
Your questions, our answers
Which regulatory framework governs the assessment of your ICT providers?
Does the agent certify that a supplier is safe?
How does it check a certification or audit report?
Can it scan a supplier without their agreement?
How does it handle fourth-party suppliers?
How does it compute criticality and concentration?
Can the score automatically block a purchase?
How does it track remediation and its evidence?
How does it prepare an exit plan that can actually be tested?
What drives the price of keeping the register, and how far is the chain unfolded?
Other agents for security and procurement
Let us size the potential on your supplier portfolio
30 minutes to scope your services, evidence and managers — hosted in France, supervised, no commitment.