Free · Open Source · Python · CLI

Your vendors are hoping you don't read the fine print.

Point it at a vendor. Bandit finds the privacy policy, reads the DPA, checks the SOC 2, and scores everything across 8 GDPR/CCPA dimensions — calibrated to your industry, your tech stack, and what that vendor actually does for you.

Get Started on GitHub Read the Rubric
YOU ALREADY KNOW THIS PART

GRC finds the risk. Legal doesn't hear about it. IT doesn't know what to provision.

📋 REVIEWS GO NOWHERE

GRC scores the policy. Legal negotiates without the findings. IT provisions without knowing what data flows where. No team gets what they need to act on the same assessment.

🕳️ HIDDEN RISK

AI training clauses buried in DPAs. Breach timelines absent from contracts. Sub-processors unlisted in annexes. Buried in plain sight in documents nobody has time to read.

📄 NO VENDOR CONTEXT

A healthcare vendor and a marketing tool get the same generic assessment. What the vendor actually does for you — which systems they access, what data flows — changes everything about the risk picture.

🗃️ NOTHING ACCUMULATES

One assessment, one spreadsheet, forgotten. No history. No trend. No record of what changed between reviews. Every reassessment starts from scratch as if the last one never happened.

WHAT MAKES IT DIFFERENT

Context built once. Used everywhere.

Most vendor risk tools treat every assessment the same way. Bandit builds context before it looks — and that context flows forward into every decision.

01 — CONFIGURE
Your org profile

Industry, locations, regulatory frameworks, and your actual internal tools. Set once. Informs every assessment after.

→ shapes weights + regulatory context
02 — INTAKE
Vendor profile

12 questions per vendor. What data they access, which of your systems they touch, whether they use AI, how critical they are. Stored permanently.

→ personalises every future assessment
03 — ASSESS
Agents run in sequence

Privacy Bandit, Legal Bandit, and the rubric engine each know what to look for because context from steps 1 and 2 is already loaded before they start.

→ context-aware extraction + scoring
04 — ACCUMULATE
History builds

Every result writes to the vendor's permanent record. Risk tiers, open findings, renewal dates. The tool gets more useful the more you run it.

→ portfolio intelligence over time
Core Principle

AI extracts. Bandit scores.

The LLM extracts evidence signals — present or absent. The rubric converts them to scores using fixed, published rules. Same policy, same score, regardless of which model you use.

Core Principle

Vendor function over industry.

What matters isn't just your sector — it's what the vendor does for you. A tech company using NetSuite for finance needs different scrutiny than one using it for CRM. Bandit knows the difference.

Core Principle

The rubric is published.

Every dimension, every scoring threshold, every enforcement precedent is documented in RUBRIC.md and versioned independently of the application. Changes are attributable. Scores are auditable. Nothing is proprietary.


MEET THE CREW

Each Bandit is a specialised AI agent.

Modular agents. Each one knows its domain, picks its own tools, and adapts to what it finds. Use one or run the whole crew.

P

Privacy Bandit

Policy Scout. Privacy policy scoring across 8 GDPR/CCPA dimensions with evidence extraction and contract redlines.

LIVE
L

Legal Bandit

Contract Cracker. GDPR Art. 28(3) DPA checklist, verbatim clause extraction, policy/contract conflict detection, redline briefs.

LIVE
A

AI Bandit

Model Mole. AI training risk, model usage terms, EU AI Act compliance, training data opt-out assessment.

COMING SOON
S

Audit Bandit

SOC Stalker. SOC 2 Type II gap analysis, ISO 27001/27701 certification review, attestation completeness check.

COMING SOON
D

Data Bandit

Flow Tracer. Data flow mapping, transfer analysis, sub-processor chain tracing.

COMING SOON

WHAT YOU GET

One command. A complete picture.

Every bandit assess run saves an HTML report alongside the terminal output.

01

Evidence & Gaps

Each dimension shows what was confirmed and what's missing — with the specific signal that would close the gap.

02

Red Flags

Enforcement-backed phrases that cap the score. Shown with matched text so you can verify them directly.

03

Contract Redlines

For scores ≤ 3, specific DPA and MSA language to request from the vendor — ready for Legal to paste into negotiations.

04

Legal Brief

A standalone redline brief for your legal team. Current contract language verbatim, gaps identified, replacement clauses provided.

05

Document Intelligence

Upload DPAs, MSAs, SOC 2 reports from a local folder or Google Drive. Bandit auto-detects document types and merges findings across all sources.

06

Vendor Profile

Run bandit vendor add once per vendor. Assessment history, risk trends, renewal dates, and IT notification queue — all stored permanently.

07

Vendor Email

A consolidated follow-up email with all gap questions, formatted and ready to send to the vendor's privacy or legal team.


THE BANDIT RUBRIC

Consistent scores regardless of which AI you use.

The AI extracts evidence. Bandit scores it. A published, enforcement-grounded rubric — built from GDPR enforcement actions, FTC settlements, and EDPB guidelines — means GPT-4o and Claude produce the same score from the same policy.

D1
Data minimization
GDPR Art. 5(1)(c) · CPPA Apr 2024
D2
Sub-processor management
GDPR Art. 28(2),(4) · CRITEO €40M
D3
Data subject rights
GDPR Arts. 12–23 · CCPA/CPRA
D4
Transfer mechanisms
GDPR Arts. 44–50 · SCCs 2021
D5
Breach notification
GDPR Art. 33 · Meta €251M Dec 2024
D6 ×1.5
AI/ML data usage
EU AI Act 2024 · FTC · Everalbum
D7
Retention & deletion
GDPR Art. 5(1)(e) · Netflix €4.75M Dec 2024
D8 ×1.5
DPA completeness
GDPR Art. 28(3)(a)–(h) · EDPB Guidelines 7/2020
Read the Full Rubric →
PROVIDER-AGNOSTIC

Your API key. Your infrastructure. Your choice.

Claude
claude-opus-4-6

Best overall quality for nuanced policy analysis

API key required
GPT-4o
gpt-4o

Excellent quality, widely used in enterprise environments

API key required
Gemini
gemini-1.5-pro

Strong quality at lower cost per assessment

API key required
Ollama
llama3.1 · mistral

Fully local. No API key. Data never leaves your machine.

Fully local Free
Mistral
mistral-large-latest

Good quality, European-hosted option for data residency

API key required

Every vendor has something to hide.

Bandit finds it first. Free, open source, forever.

Get Started on GitHub
GET STARTED IN 60 SECONDS

Clone, install, assess.

1 — Clone
git clone \ https://github.com/conorrusso/bandit.git cd bandit
2 — Install
pip install -e . # With Google Drive support: pip install -e ".[drive]"
3 — Setup & Assess
bandit setup && bandit assess "Salesforce" # With Drive documents: bandit setup --drive && bandit assess "Salesforce" --drive
View on GitHub ↗
THE ROADMAP

Built for the full vendor lifecycle.

Privacy Bandit is live today. The rest of the crew ships as each agent is ready.

v1.0
Privacy Bandit
  • 8-dimension policy scoring
  • Setup profiles & weights
  • HTML reports with redlines
  • Provider-agnostic
LIVE
v1.1
Document Sources
  • Local folder + Google Drive
  • DPA, MSA, SOC 2, BAA, AI policies
  • Full D8 scoring from DPA
  • 47 document types
LIVE
v1.2
Legal Bandit
  • GDPR Art. 28 DPA checklist
  • Verbatim contract extraction
  • Policy/contract conflicts
  • Redline brief output
LIVE
v1.3
Vendor Intelligence
  • 12-question intake wizard
  • Tech stack integration context
  • Assessment history
  • Drive profile sync
LIVE
v1.4
Dashboard + Scheduling
  • Portfolio risk dashboard
  • Reassessment scheduling
  • Slack notifications
  • TPRM register export
PLANNED

Every vendor has something to hide.

Bandit finds it first. Free, open source, forever.

Get Started on GitHub ↗