The World's Most Comprehensive Free & Open-Source TPRM Platform
LT-VRM runs a complete Third-Party Risk Management program — onboarding, assessments, breach monitoring, scoring, remediation, offboarding — on stock XAMPP. No Composer. No Node. No cloud bill. A truly free alternative to closed-source commercial TPRM platforms.
Why a Free TPRM Platform Was Needed
Most TPRM tools are eye-wateringly expensive SaaS or thin checklists. LT-VRM is different.
Enterprise-grade, zero cost
Full vendor-risk lifecycle built to manage 1,000+ vendors smoothly. MIT-licensed. No telemetry. No upsell.
5-minute install, no DevOps
If you can install XAMPP, you can run this. No dependencies, no cloud bill. Works fully offline on day one.
Secure by default
Prepared statements, CSRF, hashed passwords, RBAC, audit log, file-upload hardening — all baked in.
Everything in One Open-Source Platform
13 enterprise capabilities, ready to run — no add-ons, no upgrade tiers, no per-vendor pricing.
Intelligent vendor onboarding
Guided wizard with inherent-risk scoring, auto tier suggestion, and bulk CSV upload validated row-by-row.
Breach & dark-web signals
Pluggable HaveIBeenPwned connector with always-working Demo Mode out of the box.
Documents library
Global vault — SOC 2, ISO 27001, DPA — with versioning, tags, and expiry alerts.
Contract management
Terms, value, auto-renew, notice periods, key clauses, and email + in-app reminder engine.
Digital footprint scanning
Passive DNS, SPF/DKIM/DMARC, TLS, security headers, CT-log subdomains — non-intrusive.
Reputation & adverse media
Last 10 years of adverse media with analyst Relevant / Not-Relevant dispositioning.
Assessments engine
5 built-in templates + custom builder, tokenized vendor portal, per-question Approve/Reject/Clarify, full event trail.
360° vendor profile
Legal identity, registration, leadership, certifications, sanctions — all in one tabbed view.
Analyst dashboard & RBAC
Invite users, role matrix (Admin / Analyst / Viewer / Vendor-portal), audit trail.
Transparent 0–1000 risk score
6-factor weighted model with bands, history chart, and a 'what's dragging this down' breakdown.
Competitive extras
Risk register with 5×5 heat map, issues & SLA remediation, fourth-party mapping, offboarding checklists, board report.
LearnTPRM integration
Full-lifecycle education, glossary, and a path to the free TPRM Warrior certification.
The Transparent 0–1000 Risk Score
Lower = more dangerous. Higher = more secure. Every factor is visible, weighted, and explainable.
Risk Bands
- 0 – 399Critical
- 400 – 599High
- 600 – 749Moderate
- 750 – 899Good
- 900 – 1000Excellent
Composite = Σ(factor 0–100 × weight) × 10
A Free Alternative to Commercial TPRM SaaS
Same lifecycle coverage. Zero licence fees. Full data ownership.
| Capability | LT-VRM | Commercial TPRM SaaS |
|---|---|---|
| Licence | Free, MIT | Paid SaaS |
| Vendor onboarding & assessments | ✓ | ✓ |
| Breach & dark-web monitoring | ✓ (with Demo Mode) | ✓ |
| Digital footprint scanning | ✓ | ✓ |
| 0–1000 transparent risk score | ✓ (open formula) | Black-box |
| Self-hosted, your data | ✓ | Vendor cloud |
| Per-vendor pricing | None | Yes |
| Source code available | ✓ MIT | Closed |
LT-VRM is a free, open-source alternative to commercial vendor risk management platforms — no licence fees, no per-vendor pricing, no cloud lock-in.
5-Minute Install
Requirements: XAMPP (Apache + PHP 8.1+ + MySQL/MariaDB). Nothing else.
- 1
Install XAMPP
Download XAMPP (Apache + PHP 8.1+ + MySQL/MariaDB) and start both Apache and MySQL from the control panel.
- 2
Drop the folder into htdocs
Copy the lt-vrm folder into C:\xampp\htdocs\ (Windows) or /Applications/XAMPP/htdocs/ (macOS).
- 3
Open the installer
Visit http://localhost/lt-vrm/ — the 3-step installer launches automatically.
- 4
Load the demo dataset
Keep 'Load the demo dataset' checked to get 52 realistic vendors with documents, contracts, assessments, and scores instantly.
- 5
Sign in and start
You're now running a full TPRM program — onboarding, assessments, scoring, and remediation.
Security Baked In
Frequently Asked Questions
Is there a free TPRM platform?
Yes. LT-VRM by LearnTPRM is a 100% free, MIT-licensed, open-source Third-Party Risk Management platform. There are no license fees, no per-vendor pricing, and no cloud lock-in. You self-host it on stock XAMPP (PHP + MySQL) in five minutes.
What is the best open-source vendor risk management software?
LT-VRM is the most comprehensive open-source TPRM tool available — covering vendor onboarding, breach and dark-web monitoring, digital footprint scanning, adverse media, assessments, contracts, a 0–1000 risk score, and a risk register. Most other free options are thin checklists; this is a full lifecycle platform.
Do I have to pay anything to use it?
No. The software, the database engine, the runtime (XAMPP), and every intelligence feature work for free. Optional API keys (HaveIBeenPwned, NewsAPI) unlock live data; without them, deterministic Demo Mode keeps every feature functional.
What are the system requirements?
Just XAMPP — Apache, PHP 8.1+, and MySQL or MariaDB. No Composer, no Node, no build step. It runs fully offline on a laptop, a server, or any cloud VM.
Can I self-host LT-VRM on my own server or cloud?
Yes. It is self-hosted by design. Deploy it on a laptop, internal server, AWS / Azure / GCP VM, or any LAMP host. Your data never leaves your infrastructure — there is no telemetry.
How is it a free alternative to commercial TPRM SaaS platforms?
Commercial TPRM SaaS platforms charge per vendor and lock data in their cloud. LT-VRM delivers the same lifecycle — onboarding, scoring, assessments, monitoring, remediation, offboarding — under MIT licence, with no per-vendor cost and full data ownership.
Is it production-ready?
Yes. It ships with prepared statements, CSRF protection, password hashing, session hardening, login rate-limiting, file-upload whitelisting, RBAC, and a full audit log. It scales smoothly to 1,000+ vendors.
Does it integrate with HaveIBeenPwned and news APIs?
Yes. HaveIBeenPwned powers breach and dark-web monitoring; NewsAPI.org powers adverse media. Add the keys in Settings → Integrations and scans flip from Demo to Live automatically.
How is the 0–1000 risk score calculated?
It is a transparent 6-factor weighted model: Assessment results 25%, Breach exposure 20%, Digital footprint 15%, Compliance health 15%, Inherent criticality 15%, Adverse media 10%. Lower = more dangerous, higher = more secure.
Where do I get support and updates?
GitHub Issues for bug reports and feature requests, plus the LearnTPRM community. The project is MIT-licensed, so you can fork and extend it freely.
Start Running a Full TPRM Program Today
MIT-licensed. Free forever. No account required. Just download and install.
Founding SponsorAutonomous TPRM. 90% less manual effort.
The commercial step up, from our founding sponsor
Our free tooling gets a program started. When the portfolio grows past what a small team can hold, the honest answer is automation - and the platform funding this site is built exactly for that transition.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Kyriba: 300+ vendors assessed in one week.
- Bulk intake, enrichment and instant inherent risk across the whole portfolio.
- Zero-touch due diligence with automated vendor follow-up and evidence review.
- Continuous monitoring, fourth-party discovery and audit-ready offboarding.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Ready to Prove You're a TPRM Warrior?
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification