Take a new supplier from first request to an approved onboarding review, without leaving its record.

RolesViewerEditorAdminRoute/vendors/registerShown toSupplier risk organizations

What it is

Onboarding is how a supplier enters your supplier risk register. You say what you buy and what data it touches. Noru looks up who the supplier legally is, suggests a tier, reads the supplier's documents and contract, and drafts a verdict per criterion. A person then approves the onboarding review, and the supplier becomes Active.

Every step happens on the supplier's own record. Its Setup bar shows the step that is next, and the button at the top right does that step.

Where to find it

SuppliersNew supplier

Members who cannot edit use Request a supplier in the ⋯ menu instead. The request takes the same path, and someone with edit access picks it up.

Before you start

Add your business functions first, under RegistersFunctions. A function such as payments or lending can be critical or important. Each service a supplier provides links to one, and that link drives the tier Noru suggests. You can add functions later, but tiers are more accurate with them.

Key actions

1. Add the supplier

Click New supplier.

Enter the supplier name, its website, and what it will do, for example payroll for the Swedish entity.

Optionally pick the Business function it supports, how sensitive Our data is, and the Owner. Under Start and cost, add the start date and expected annual cost.

Click Create supplier. The supplier opens at Onboarding with its onboarding review open. The confirmation says which tier Noru suggests.

What you described becomes a planned service on the supplier. If the supplier is already in your register, Noru opens the existing record instead of creating a duplicate.

2. Confirm the legal identity

If the next step is Legal identity, click Look up LEI at the top right.

Matches wait under Needs attention on the Overview tab. Check the entity and country, then click Approve or Reject. With Apply exact GLEIF matches automatically on in SettingsGeneral, a single exact match is applied without asking.

The DORA register identifies companies by their LEI, so this step is done only when the supplier has one.

3. Pick the tier

Click Pick tiers. The service opens at its tier.

Answer the three questions: does it support a critical or important function, does it store personal or sensitive data, and is it hard to substitute.

Noru shows Noru suggests with a tier. Accept it, or choose another under Picked tier. The reason is recorded with the tier.

4. Add documents

Click Add evidence. The upload opens on the Evidence tab.

Drop the file. Leave Type on Let Noru tell, or pick it (for example a SOC 2 report).

The row shows Reading… until Noru has read the document, then the facts it found and how long the document is valid.

If the supplier has a public trust center, Noru checks it when the supplier is added and stores the documents it can read.

5. Add the contract

Click Add contract. Enter the reference and click Add contract in the dialog. The contract opens.

Click Upload contract, or Fill from document, and drop the signed contract. Click Upload and read.

The dates, notice periods and governing law Noru read appear under To confirm at the top of the contract, each with the passage it came from. Click Approve or Reject on each.

Click Check clauses to check the contract against DORA, GDPR and the other rules it falls under.

The contract file is kept with the supplier's documents, so the review can cite it too.

6. Rate the risk

When Noru has proposed a rating, the button reads Review proposed rating. It opens Noru's proposal to approve or reject. Otherwise click Rate risk and pick a cell on the grid on the Risk tab.

7. Review and approve

Open the Reviews tab and click Draft verdicts. Noru gives one verdict per criterion for the supplier's tier, each citing the page it rests on.

Click Confirm on each verdict you agree with, or Override with a reason.

A verdict with no supporting document says which document would settle it. Click Upload document next to it. Noru reads the file and drafts the verdicts again; confirmed verdicts stay as they are.

For what the documents do not show, click Prepare follow-up questions, then Send to the supplier. If the supplier has no contact yet, Add a contact first adds one right there.

When the supplier answers, you get a notification. If the answers came after the verdicts were drafted, the tab offers Draft again.

Click Send for review. A colleague with edit access closes the review with Close review… and an outcome. Approving it moves the supplier to Active.

Statuses and fields

Status	Meaning	Set by
Discovered`discovered`	Found through a connected data source, an expense import or another supplier's sub-processor list. Not in the register yet.	Noru
Onboarding`onboarding`	Being checked. The onboarding review is open.	New supplier, Request a supplier, or Accept on a discovered supplier
Active`active`	In the register and in use.	Approving the onboarding review, or a register import
Exiting`exiting`	Being offboarded. The record shows what stands in the way of the exit.	You, with Start exit
Exited`exited`	No longer used. Kept for the register's history.	You
Dismissed`dismissed`	Set aside: not a supplier you report.	You

Tips and gotchas

The Setup bar and the top-right button follow the same order for every supplier: Services, Legal identity, Tiers, Evidence, Contract, Risk rated, and Approval. Click any segment to do that step out of order.

Four eyes: the person who prepared a review cannot close it. If you are your organization's only admin or editor, you can close it yourself, and the activity log records that you did.

Changes Noru reads from documents and registries are proposals. They are shown where they apply, such as under Needs attention or To confirm, and in the Inbox. Nothing is written until a person approves it.

What Noru does not do

Noru does not approve suppliers. A person confirms each verdict and closes the review.
Noru does not change a supplier's legal identity, contract terms or risk rating on its own. It proposes them with their source.
Noru does not decide a supplier's tier. It suggests one from your answers, and a person picks it.
A document Noru cannot read, such as a scanned PDF without text, is stored but gives no facts. Upload a version with text, or confirm the verdict yourself.

Onboard a supplier