We build Agents. You build the Future.
● B2B offer — Fund management activitiesThird-party cyber risk — Fund management activities: suppliers registered, evidence checked
Sorègue Gestion keeps a provider register that lists contracts but not the functions they support, so nobody knows which ones would stop valuation. The agent reads the supplier register, the contract vault and the valuation calendar: it qualifies function by function, traces the real sub-processors and prepares exit plans in order of criticality. The operational risk officer decides; the managing director signs acceptances. You arbitrate on dated facts: every file arrives with its factors, its counted unknowns and the document that will lift them — and the signature stays yours, handed back in minutes rather than in committee.
Updated on
Fictional simulation — not a client result
Each file carries its unknowns and the date of its most recent evidence.
⛓ Sourced · supplier register, contract vault, access register
The request pack is ready — statement of applicability and scope annex — and goes out as soon as you approve it.
✎ Framework · a certification covers its scope and its period
For an organisation established outside the European Union, the law of its own country applies; at its request, we put equivalent safeguards in place (human review before any action, a log of the criteria, information for the people concerned).
A Blue Lemon Agent third-party cyber risk agent registers the supplier relationship, derives criticality from the functions supported, checks evidence against its scope and period, unfolds the subcontracting chain, measures concentration across the aggregate of services and prepares treatment and exit plans. It runs on local inference or is hosted in France, with an architecture designed to reduce exposure to extraterritorial laws, location alone not guaranteeing immunity.
Reference points describing our offer, not results measured at a client. The gain on your supplier portfolio is confirmed by a pilot, on your own files.
Indicative estimate, to be confirmed by a pilot on your real files (general terms of sale, article 4).
One plan, one agent
A third-party cyber risk agent — eleven modules included — installed and operated for you. Prices excluding VAT, annual subscription. The twenty sector variants share this price: they change the content, never the engine or the price.
Setup + controlled subscription
- Installation, configuration and training for your teams
- Operation, human oversight, updates and support
- Hosting in France, a dedicated and isolated resource
All inclusive, no setup fee
- Setup included (installation, configuration, training)
- Operation, human oversight, updates and support
- Hosting in France, managed end to end
On site, you own it
- Hardware installed on your premises (you own it)
- French / European AI models run locally
- Secure remote maintenance (Pro support included)
What does the agent actually do?
Eleven modules included in the core, plus sovereign AI; a single state machine, with links to neighbouring agents. The agent carries out by itself what you authorise it to do; the decision stays with your authorised managers, who set what it does on its own and what it submits to them.
Third-party and service register
Records the supplier, group, service, contract, sub-processors, countries, data, access, owners, dates and relationship status.
Business criticality and data
Links the service to the functions it supports, target recovery times, volumes, data categories, privileges and substitutability.
Boundary: qualifies data to size the security risk and the dependency. Lawfulness of the processing, its legal basis and the record of processing activities belong to the DPO/GDPR support agent, billed separately.
Adaptive questionnaires
Selects questions by criticality and applicable framework, reuses answers still in date, asks for justification and tracks non-responses.
Evidence collection and checking
Checks period, scope, issuer, signature, qualifications, exceptions, corrective plans and the consistency of the attestations provided.
Boundary: checks SECURITY evidence — scope, period, issuer. Documents already held by the DPO/GDPR support agent are reused as they are: the same supplier is neither re-surveyed nor billed twice.
Exposure and authorised vulnerability review
Aggregates security advisories, public incidents and the expressly authorised surface, with no intrusive testing and no unproven attribution.
Risk scenarios
Structures feared events, sources, paths through the third party, existing measures, severity, likelihood and residual risk.
Explainable scoring
Computes separate dimensions with their factors, weights, unknowns and confidence; keeps the score before and after the supplier’s rebuttal.
Contracts and requirements
Compares clauses on security, notification, audit, location, subcontracting, continuity, reversibility and deletion.
Boundary: carries security, reversibility and notification requirements into the contract. Drafting the Article 28 clauses and the data processing agreement remains the work of the DPO/GDPR support agent.
Treatment plans
Turns each gap into a measure, with owner, deadline, expected evidence, any exception and a motivated temporary acceptance.
Monitoring and incidents
Tracks changes, evidence deadlines, relevant vulnerabilities, declared incidents, service commitments and reassessments.
Exit, evidence and steering
Prepares alternatives, extraction, transition, revocation, deletion and tests; keeps decisions, versions and indicators.
Sovereign AI
The hosting and confidentiality foundation the agent runs on.
Compliance of the processing itself — lawfulness, record of processing activities, impact assessments — and the drafting of Article 28 clauses are NOT part of this core: they are carried by the DPO/GDPR support agent, billed separately. This core handles third-party security, dependency, concentration and exit; it unfolds the subcontracting chain to rank 1 for every relationship and to the declared rank 2 for critical ones. Unfolding “rank 3 and beyond” and preparing the DORA register of information submission file are options. The supplier’s identity and the evidence common to both agents are reused: they are not collected twice, and they are not billed twice.
Extend this agent's capabilities
These capabilities are layered onto the SAME agent, not another one. They are billed per grid tier, not at the price of an agent.
Extends the unfolding of the subcontracting chain beyond tier 2: mapping of tier 3 and further tiers, concentration measured across that whole chain, and exit plans that take it into account. Anything not named stays recorded as unknown, with the question asked and its date. Option chosen in the checkout, set-up then monthly.
+ 500 € excl. VAT set-up, then 35 € excl. VAT / month — chosen in the checkout Choose my add-ons →Need to go further?
These agents handle a different business process, with their own owner and their own price. They are added to this one.
End-to-end contracts
Carry into the contract the clauses the assessment calls for, then track renewals and notice periods.
End-to-end contract management agent from 362 € excl. VAT / month Discover the agent →Procurement and suppliers
Run the consultation and compare offers; the cyber opinion joins the file, it does not decide it.
Purchasing / supplier agent (quotes, follow-ups) from 259 € excl. VAT / month Discover the agent →Cybersecurity and logs
Correlate and qualify your INTERNAL alerts. This core assesses third parties: the scopes do not overlap.
Cybersecurity agent (log analysis) from 311 € excl. VAT / month Discover the agent →DPO / GDPR support
Lawfulness of the processing and Article 28 clauses. This core handles security, dependency, concentration and exit: the third party’s identity and the shared evidence are reused, never collected or billed twice.
DPO / GDPR support agent from 343 € excl. VAT / month Discover the agent →In 30 minutes we identify the most relevant agent — without oversizing the project.
See the agent at work
5 everyday situations, taken from those that come up most often. Pick one: the exchange unfolds as it would in your organisation.
A scripted demonstration. These exchanges show how the agent behaves — its sources, its refusals, what it leaves to your teams. Nothing is sent from this page, no model is queried here, and the matters named are fictional. That is precisely what we promise your data. The behaviours shown here — monitoring, automation rules, routing and reminders — are configured with you during deployment, from your tools, your rules and your thresholds. The architecture points named in these exchanges — location, local execution, isolation, encryption, role-based access, logging — are not a guarantee attached to the demonstration: they are those of the architecture set out in your quotation, and verified before commissioning.
The company in this demonstration
Fictional companySorègue Gestion — fictional asset manager, €4.1bn under management
- Sector
- Asset management company — €4.1bn under management, 38 funds
- Headcount
- 94 employees, 2 in internal control and 1 operational risk officer
- Who is served
- Institutional investors and distributors, 11 marketing countries
- Order of magnitude
- 38 funds, 190 net asset values per week, 61 registered ICT providers
- Tools in place
- Management tool, delegated valuation desk, contract vault, supplier register
- Who decides
- The operational risk officer arbitrates; the managing director approves any acceptance
- Improvement points
- 61 providers, 23 with no critical-function qualification; no exit plan tested to date
Sorègue Gestion keeps a provider register that lists contracts but not the functions they support, so nobody knows which ones would stop valuation. The agent reads the supplier register, the contract vault and the valuation calendar: it qualifies function by function, traces the real sub-processors and prepares exit plans in order of criticality. The operational risk officer decides; the managing director signs acceptances.
This company, its figures and the exchanges that follow were invented for the demonstration. They illustrate a common situation; they describe no real client.
Fictional simulation — not a client result
Registering, here, means linking each supplier to the SERVICE it provides and to the FUNCTION that service supports. Without that link no criticality can be computed — and that link was missing everywhere.
The first file I put on the table: The valuation desk, a critical and hardly substitutable function.
· State opened: assessment in preparation, priority P2, on the fact “criticité et substituabilité visibles”.
· 10 of 12 controls are not compliant, and I tell you which and why, one by one.
· 0 unknown factor(s) — displayed confidence drops to 100%, and the score does not rise by a single point for it.
What I propose: I show you how this ranking recomputes from your own data, factor by factor, with no opaque score in between. parc-recense_relations-et-services.pdf4 business objects linked, each to its owner
⛓ Sourced · supplier register, contract vault, directory
For this file the fact retained is “criticité et substituabilité visibles”, and it comes from your inputs, not from an opinion: criticalFunction = yes, substitutability = low, evidenceFresh = yes.
The score is kept before AND after the supplier’s rebuttal. It never has the last word: it opens a review. The operational risk officer arbitrates; the managing director approves any acceptance.
And the next step, if you want it: I run the same reading across the whole portfolio and hand you the ordered list, each line with its factors and its date. fiche-relation_facteurs-visibles.pdf6 dimensions, their weights, their factors and the confidence
✎ Framework · the score opens a review, it decides nothing
· Third-party and service register — Records the supplier, group, service, contract, sub-processors, countries, data, access, owners, dates and relationship status.
· Business criticality and data — Links the service to the functions it supports, target recovery times, volumes, data categories, privileges and substitutability.
· Adaptive questionnaires — Selects questions by criticality and applicable framework, reuses answers still in date, asks for justification and tracks non-responses.
· Evidence collection and checking — Checks period, scope, issuer, signature, qualifications, exceptions, corrective plans and the consistency of the attestations provided.
· Exposure and authorised vulnerability review — Aggregates security advisories, public incidents and the expressly authorised surface, with no intrusive testing and no unproven attribution.
· Risk scenarios — Structures feared events, sources, paths through the third party, existing measures, severity, likelihood and residual risk.
· Explainable scoring — Computes separate dimensions with their factors, weights, unknowns and confidence; keeps the score before and after the supplier’s rebuttal.
· Contracts and requirements — Compares clauses on security, notification, audit, location, subcontracting, continuity, reversibility and deletion.
· Treatment plans — Turns each gap into a measure, with owner, deadline, expected evidence, any exception and a motivated temporary acceptance.
· Monitoring and incidents — Tracks changes, evidence deadlines, relevant vulnerabilities, declared incidents, service commitments and reassessments.
· Exit, evidence and steering — Prepares alternatives, extraction, transition, revocation, deletion and tests; keeps decisions, versions and indicators.
· Sovereign AI — the hosting and confidentiality foundation all of this rests on: local inference or an isolated resource hosted in France.
All eleven are included, at no extra cost: security, traceability, human validation and the demonstrators are never sold as options. modules-mobilises_onze-modules-du-socle.pdfthe eleven core modules and what each brings
✎ Framework · eleven modules included in the core, at no extra cost
Fictional simulation — not a client result
What I observed: critical = yes, bcpDocumented = yes, lastTest = declared empty.
What the rule concludes: test absent — state exit plan review, priority P2.
What I propose, already written out: the measure goes out with its owner, its deadline and THE EXPECTED DOCUMENT named in advance — that document, and only it, will close the measure. Remediation closed on a promise stays open in my file. ecart_valeurs-observees-et-regle.pdfobserved values, rule applied, rule version
⛓ Sourced · documents received, contract in force, internal policy
If the supplier is right, the measure closes on their document — dated, signed, with its scope. If they bring nothing, the gap stays in the file with the date of the request: silence closes nothing.
Either way you gain the same thing: The operational risk officer arbitrates; the managing director approves any acceptance — and you arbitrate on dated facts instead of an impression. plan-traitement_mesure-proprietaire-echeance.pdfmeasure, owner, deadline, expected evidence
✎ Framework · the rebuttal is kept, it erases nothing
Fictional simulation — not a client result
State opened: contradictory review open, priority P2, fact retained “chaîne incomplète”.
0 unknown factor(s) in the file, and here is what they do — and what they do not: displayed confidence moves to 100%, the score does not move a point. An unknown is neither an automatic failure nor an implicit pass.
The protocol is already drafted: the exact question, the recipient, the expected document and the follow-up date. It goes out as soon as you approve it. inconnue_protocole-de-levee.pdfquestion asked, recipient, expected document, follow-up date
⛓ Sourced · questionnaire, register, observed flows
What I bring you meanwhile, depending on nobody: what your own records already say — the contract, the observed flows, the access history. The file advances on what is verifiable, while waiting for what is not yet.
And a comparison that clarifies: a relationship reviewed with two named unknowns can be decided; a relationship showing no unknowns at all does not prove there are none — it proves nobody looked for them. journal_questions-posees-et-dates.pdflog of questions, follow-ups and non-responses, with their dates
✎ Framework · a non-response is a dated fact, not a blank
Fictional simulation — not a client result
State opened: decision reserved for the manager, priority P1, fact retained “preuve d’un autre client inaccessible”.
What the file already contains: the observed values, the rule applied and its version, the 12 non-compliant controls with their justification, the score and its factors, the 0 unknown(s), and the measured effect on the services supported.
Who signs, and why that is an advantage: The operational risk officer arbitrates; the managing director approves any acceptance. The decision is yours — and I hand it back to you in minutes: a complete, quantified, reasoned file. You decide on dated facts instead of convening a committee to gather the papers. dossier-de-decision_complet-chiffre-motive.pdfvalues, rule, controls, score, unknowns, effect on services
✎ Framework · the act commits the organisation, the file is ready
A plan never tested remains a hypothesis — so I propose the exercise that makes it credible, with its date, its scope and the gap measured against the recovery time you target.
What you end up with: exit plans tested rather than declared. Approve the exercise and it is scheduled this week. plan-de-sortie_alternatives-et-exercice.pdfalternatives, extraction, transition, revocation, deletion, success criterion
⛓ Sourced · documented alternatives, extraction format, reversibility exercise
Fictional simulation — not a client result
What I establish: two separate lines in your register — the valuer and the depositary — a single entity behind them at the second rank, and 190 net asset values a week passing through that point.
This case had not yet been taken into account in your configuration: your register separates the direct provider from its own subcontractor, and that distinction holds here in full; what it does not say is what to do when two independent lines meet on the same entity one rank down. So I settled nothing on my own, and the review carries on with what is already verifiable.
Three ways of doing it. Keep both lines as they are, each with its own contract: the register stays an exact mirror of your signed agreements, but the real dependency on that entity appears nowhere, and that is exactly what your rule sets out to measure. Merge the two lines into one, under the name of the second-rank entity: the dependency is visible at a glance, with no matching to do, but the register stops matching your agreements, and contractual traceability is lost in it. Keep both lines and open a shared-dependency entry carrying its compensating measure: the contract stays readable and the concentration gets measured, but one more entry to maintain, and it has to be reconciled at every review.
I recommend the third. it is the only one that keeps your register faithful to the signed agreements while making visible what your rule asks you to measure, and your valuer exit plan assumes an alternative that this convergence puts in doubt.
You can also define another one — for instance: keep both lines and record the shared dependency in the concentration file alone, without entering it in the register.
Shall I remember it for the next cases of this kind? Of your 61 registered ICT providers, 5 pairs of lines converge on the same second-rank entity, and 2 of those pairs touch the net asset value calculation. If you approve, I will flag the next convergence as soon as a subcontractor list arrives.
⛓ Sourced · register of contractual arrangements, depositary agreement, the valuer’s subcontractor list
The rule, in one sentence: two register lines converging on the same second-rank entity stay two lines, and a shared-dependency entry is opened with its compensating measure; it is named after the critical function concerned, never after the entity — your correction — and it is re-examined whenever the subcontractor list is updated.
What I found while reviewing this file, and it is worth more than the rule: of your 61 providers, 23 carry no critical-or-important qualification, and I looked at what they feed: 9 of the 23 supply data that enters a net asset value calculation — prices, security reference data or market calendars.
What it is worth: qualifying those 9 before the other 14 covers your week’s 190 net asset values with 9 files instead of 23, and brings to zero the number of critical functions without a documented alternative among those touching valuation; the remaining 14 follow next quarter, on the same pattern.
The decision is yours: it is your control plan, and the managing director signs the acceptances. I give you the 9 providers, the data each of them feeds and the point of the calculation where it enters. I change nothing before you have written it, and the rule is withdrawn in one line.
✎ Rule approved · written under its name, with its date and the file that gave rise to it — reversible in one line
Your case is not here? That is exactly what a 30-minute conversation is for. Discuss your project →
The stages of your AI agent project
Audit & scoping
30 minutes to target the use case with the best return.
Quote or direct sign-up
A catalogue offer is bought online; a specific need gets a costed quote.
Design
We design the agent and its guardrails.
Integration & testing
We connect your tools to the agent, which is itself hosted in France.
Rollout
Going live and training your team.
Operation
Continuous supervision and improvement.
What does an AI agent bring to supplier assessment?
A relationship that is registered, quantified and dated is arbitrated in minutes; a file scattered between a contract, an attestation and three emails has to be rebuilt from scratch.
! The stake
Assessing a supplier means gathering what can be verified and naming what cannot. That reconciliation work is systematic and lends itself to automation; deciding to accept a risk commits the organisation.
✓ Our answer
Your managers arbitrate across the whole portfolio rather than the suppliers someone remembers to check — and each file arrives already registered, quantified and dated. Every score keeps its factors, before and after the supplier’s rebuttal: your conclusion holds up in front of them, and it corrects itself when they produce the document. Data hosted in France on an isolated resource; the AI model is called at its publisher, except with the Sovereign model option. With the 100% Sovereign package, your audit reports and dependency maps do not leave the organisation.
Audit reports, contracts and dependency maps: sovereignty & separation
The evidence your suppliers entrust to you describes their weaknesses as much as your dependencies: its confidentiality is a security matter in itself.
Local inference
With the 100% Sovereign package, the agent runs on a machine in your organisation: no audit report, contract or dependency map leaves the network.
Hosted in France
Otherwise, with the Agility and Serenity packages, a dedicated, isolated resource hosted in France, under French law: data hosted in France; the AI model is called at its publisher, except with the Sovereign model option.
Strict tenant separation
A report filed by one client is never readable by another, whoever issued the document. Sharing across tenants requires written, traceable permission.
Reduced extraterritorial exposure
For your audit reports and dependency maps, the architecture aims to reduce exposure to extraterritorial laws; location alone does not by itself guarantee immunity.
Named human gates
Accepting a risk, starting an exit, escalating an incident: three states only an authorised manager can open, with reason and timestamp.
Tamper-evident log
Every transition carries its evidence, actor and timestamp; refusals are logged just as passages are.
What depends on the architecture chosen These points are not general guarantees: they are settled deployment by deployment, in the quotation.
- The applicable location is that of the architecture set out in the quotation and verified before commissioning.
- Local execution is announced only for the configuration explicitly described and accepted in the quotation.
- The applicable isolation depends on the deployment mode set out in the quotation; no dedicated isolation is presumed.
- The events logged, their content, their retention period and who may access them are defined for the deployment chosen.
How many relationships can a team review?
By taking on registration, evidence reconciliation and file assembly, the effort moves to arbitration. The size of the gain depends on your portfolio and remains to be confirmed by a pilot.
Four guarantees that matter here
Related resources
Your questions, our answers
Which regulatory framework governs the assessment of your ICT providers?
Does the agent certify that a supplier is safe?
How does it check a certification or audit report?
Can it scan a supplier without their agreement?
How does it handle fourth-party suppliers?
How does it compute criticality and concentration?
Can the score automatically block a purchase?
How does it track remediation and its evidence?
How does it prepare an exit plan that can actually be tested?
What drives the price of keeping the register, and how far is the chain unfolded?
Other agents for security and procurement
Let us size the potential on your supplier portfolio
30 minutes to scope your services, evidence and managers — hosted in France, supervised, no commitment.