Vendor tracker

A preview of how this template lays out — the boards, their custom workflow states, and where the sample issues land. WIP caps show a badge.

• Annual security review — analytics vendor

  P23pt

• Renewal: error-monitoring contract (Q3)

  P12pt

• Evaluate a replacement for the legacy CRM

  P38pt

These rules aren't created when you apply the template — they're recipes you can wire up in Settings → Automations once your board exists.

• When

  60 days before a renewal date

  Then

  Move the vendor to 'Up for renewal' and notify the owner

• When

  Vendor moves to 'Reviewing'

  Then

  Create a security-review checklist sub-issue tree

Up for renewal is a column, sixty days wide, and that offset is the entire design. Almost every SaaS contract auto-renews unless you give notice, and the notice period — usually thirty or sixty days before the renewal date — is the real deadline. A board that surfaces vendors on the renewal date is surfacing them after the decision has already been made for you. Reviewing sitting between renewal and the outcome is the second opinion: a renewal is the only moment you have leverage, and it is wasted if nobody checks what you are actually using.

1. 1.Record the notice period, not just the renewal date

   The date that goes on the card is the last day you can give notice, with the renewal date noted alongside it. Getting this backwards is how a team decides in week one of a two-week window and discovers the window closed a month ago. Read the termination clause when you sign, not when you want out.

2. 2.Give every vendor a named internal owner

   Not a team, a person, and preferably the person who uses it rather than the person who pays for it. Unowned tools are how a company ends up with three overlapping products and a line item nobody can explain. The owner's job is small — answer the renewal question — but it must belong to somebody with an opinion about the tool.

3. 3.Run Evaluating as a bake-off with criteria written first

   Decide what you are assessing before you take the first demo, or you will assess against whatever the first vendor's sales engineer chose to show you. Four or five criteria with weights, scored per vendor on the card. This is also the record that answers 'why did we pick this' two years later, when the person who chose it has left.

4. 4.Make Reviewing cover usage as well as security

   The security review is what the checklist prompts for, but the more commonly valuable question is how many of the seats you are paying for are actually active. Pull the number before the renewal conversation. Seat-count drift is the most reliable source of recoverable spend in a software stack, and it is invisible unless someone looks on a schedule.

5. 5.Actually finish Offboarded

   Cancelling the subscription is the first of several steps. Revoke the integrations and API keys, export what you need to keep, confirm data deletion in writing where it matters, and remove the SSO app. A vendor you stopped paying but never disconnected is still an access path into your systems, and it is one nobody is monitoring.

This board encodes one opinion about how the work should run. Here is where that opinion is wrong and something else fits better.

• You have a procurement or spend-management platform. Tools that sit on the card or the invoice feed see spend directly, catch shadow-IT subscriptions nobody told you about, and can enforce an approval flow before a purchase happens. A board only knows about vendors somebody remembered to add.
• You run formal third-party risk management. Regulated industries with vendor due-diligence obligations, questionnaire workflows, subprocessor tracking and continuous monitoring need a purpose-built TPRM system. A security-review sub-issue tree is not an assessment record an auditor will accept.
• You have under ten vendors. Calendar reminders and a shared note will do this perfectly well, and maintaining a board for eight rows is ceremony. The board earns its place when nobody can hold the whole stack in their head.
• You need real spend data. This board holds dates and owners, not amounts, currencies or usage-based charges that vary monthly. Budget questions belong in the finance system where the invoices actually land.

Honest comparisons, including where the other tool wins. Planoda is pre-launch, so nothing below is a benchmark — it is a description of how each product approaches this job.

• A spreadsheet

  The honest incumbent, and for many companies a perfectly good one: a row per vendor, columns for owner, cost, renewal date and notice period, sorted by date. What it does not do is remind anybody. The sheet is only as good as the recurring calendar entry that makes someone open it.

  Where A spreadsheet is better: A sheet is faster to set up, easier to hand to finance, and trivial to sort and total. If your only requirement is a list of renewal dates and someone reliably reviews it monthly, it is genuinely competitive with this board.

• Vanta and Drata

  Compliance platforms include vendor risk modules that collect security documentation, track subprocessors, and tie each vendor to the controls it touches — which is exactly what a SOC 2 auditor asks about. That is a different job from renewal management, and they do it properly.

  Where Vanta and Drata is better: For vendor security review as an audit artifact — questionnaires, risk ratings, evidence tied to controls — a compliance platform produces something defensible. This board produces a checklist that a human filled in.

• Ramp and Zip

  Spend-management and procurement-orchestration tools see the transaction, so they know about the subscription somebody expensed without telling anyone, and they can put an approval step in front of new spend. They start from the money rather than from a list somebody maintains.

  Where Ramp and Zip is better: Discovering shadow IT from the card feed is something no manually-maintained board can do, and it is usually where the surprising costs are. Approval workflows before purchase also prevent the problem rather than cataloguing it.