Vendor Management System

Part of the worlds-biggest-software-project initiative.

An AI-native, open-source vendor management system covering supplier onboarding, compliance, performance scoring, and contract management for organisations underserved by enterprise procurement suites.

Vendor Management System (VMS) is a candidate project to fill a clear gap in the market: there is no production-ready open-source VMS. It targets mid-market organisations (typically $50M–$2B revenue) managing 50–200 active vendors in spreadsheets, shared drives, and email — buyers who cannot justify $150K–$1M+/year platforms like SAP Ariba, Coupa, or Ivalua, but whose needs exceed what basic procurement tools (Precoro, Procurify) and ERP supplier records (Odoo, ERPNext) can deliver.

Why Vendor Management System?

No open-source alternative exists. Every leading VMS — SAP Ariba, Coupa, JAGGAER, Ivalua, Precoro, Graphite Connect, Ironclad, Hyperproof — is fully proprietary, with customer data and workflow logic locked in vendor-controlled clouds.
Enterprise platforms are priced out of reach. SAP Ariba and Coupa typically cost $200K–$1M+/year with implementation adding 50–100% on top; Ivalua-class platforms run $100K–$500K/year. Mid-market buyers have no equivalent option.
Mid-market tools are functionally thin. Precoro and Procurify cover PO workflows but lack supplier risk scoring, TPRM, and contract lifecycle depth. Graphite Connect handles onboarding but has no sourcing or spend analytics. Hyperproof handles compliance risk only. Ironclad handles contracts only.
Regulation is forcing adoption. EU DORA (2025) requires financial services firms to assess and continuously monitor third-party ICT risk; GDPR/CCPA require tracked DPAs; ISO 20400 and SMETA push ESG supply chain accountability. Compliance work is currently manual at most mid-market firms.
Onboarding and risk monitoring are still manual. Even at well-funded incumbents, vendor onboarding (W-9s, COIs, banking, certifications, sanctions screening) takes days to weeks, and risk is reassessed only annually — leaving long blind spots between reviews.

Key Features

Supplier Onboarding & Master Data

Self-service supplier portal for contact, banking, tax, insurance, and compliance document submission
Configurable intake forms and approval workflows per vendor category
Automated document collection: W-9s, insurance certificates, banking details, compliance certifications
Document expiry tracking and automated re-request workflows
Role-based access control across admin, procurement, AP, legal, and read-only users

Procurement Workflow

Purchase order creation with multi-level approval workflows
Email-based supplier PO acknowledgement
Three-way matching across PO, goods receipt, and vendor bill with configurable tolerance rules and exception queue
Spend analytics dashboard by supplier, category (UNSPSC), business unit, and time period with anomaly flagging

Risk, Compliance & TPRM

Sanctions screening against OFAC, EU, and UN watchlists at onboarding and on a scheduled refresh cadence
Continuous vendor risk monitoring from external news, financial, and cybersecurity data feeds with automated risk score updates
Multi-framework compliance mapping: SOC 2, ISO 27001, NIST CSF, GDPR
DORA-compliant ICT third-party risk reporting templates for financial services
ESG and sustainability questionnaire module supporting SMETA and UN Global Compact tracking

Contract Lifecycle Management

Contract repository with upload, metadata tagging, and full-text search
Renewal date alerting and obligation tracking
AI-powered extraction of renewal dates, SLAs, liability caps, and price escalation clauses from uploaded PDFs
Embedded eSignature for execution and amendment workflows

Performance & Supplier Engagement

Supplier performance scorecards covering on-time delivery, invoice accuracy, and NCR count
Both manual and automated data inputs to performance metrics
In-platform direct messaging between buyer and supplier
Audit trail of all supplier interactions, approvals, and document changes

AI-Native Advantage

Incumbent VMS platforms apply AI selectively as a paid add-on. This project treats AI as core: autonomous supplier onboarding orchestration that requests, extracts, validates, and cross-references documents against sanctions lists without human intervention; continuous real-time risk monitoring across news feeds, financial filings, breach databases, and geopolitical events that updates risk scores between formal reviews; NLP-based extraction of obligations from legacy contract archives with proactive renewal and SLA alerting; and performance scoring derived directly from operational data (deliveries, invoice accuracy, NCRs, support resolution times) rather than manually maintained scorecards.

Tech Stack & Deployment

The project targets self-hosted deployment under a permissive open-source licence (MIT or Apache 2.0), removing the vendor lock-in inherent to incumbent platforms where customers do not own their data model or workflow logic. Integration is REST API-first with a buyer-facing app and a separate supplier-facing portal, mirroring the buyer/supplier separation common to Ariba, Coupa, and Graphite Connect. Pre-built connectors to mid-market finance stacks (QuickBooks, Xero, NetSuite) and enterprise ERPs (SAP, Oracle) are in scope. Reference standards include ISO 27001, SOC 2 Type II, EU DORA, GDPR/CCPA, ISO 20400, ISO 31000, UNSPSC/eCl@ss, and UN Global Compact / Sedex SMETA — all open specifications without licence obligations on implementing software.

Market Context

The global vendor management software market was valued at $10.40B in 2025, projected to reach $18.76B by 2031 at 10.33% CAGR (Mordor Intelligence); a parallel forecast projects $25.13B by 2032 at 14.01% CAGR. Vendor onboarding and information management alone represented 31.98% of 2025 revenues. Pricing ranges from $3K–$12K/year for small business tools, $15K–$60K/year for mid-market, and $150K–$1M+/year for enterprise (with implementation multipliers of 1.5–4x in year one). Primary buyers are CPOs and Heads of Procurement at $200M–$2B firms, CISOs and VP Risk at financial services firms facing DORA, CFOs managing 50–200 active vendors, operations managers needing supplier portals, and ESG officers tracking supply chain ethics.

Project Status

This project is in the research and specification phase.
Contributions, feedback, and domain expertise are welcome.

Contributing

We welcome contributions from developers, domain experts, and potential users. See CONTRIBUTING.md for guidelines.

Important: All contributions must be your own original work or clearly attributed open-source material with a compatible licence. Copyright infringement and licence violations will not be tolerated and will result in immediate removal of the offending contribution. If you are unsure whether a piece of code, text, or other material is safe to contribute, open an issue and ask before submitting.

Licence

Licence to be determined. See discussion for context.