// Proof&Trust — NIS2 Supply Chain Risk Assessment landing page // Dark navy/black theme, teal accent (from logo). Conversion-optimized. const { useState, useEffect, useRef } = React; // ---------- Primitives ---------- function Caption({ children, className = "", style }) { return {children}; } function Button({ children, variant = "primary", onDark = true, size = "md", style, ...rest }) { let cls = "sq-btn "; if (variant === "primary") cls += "sq-btn-primary"; else if (variant === "secondary") cls += "sq-btn-secondary-dark"; else if (variant === "tertiary") cls += "sq-btn-tertiary"; const sizeStyle = size === "lg" ? { padding: "16px 28px", fontSize: 16, fontWeight: 500, borderRadius: 999 } : { borderRadius: 999 }; return ; } function Chevron({ size = 12, color = "currentColor" }) { return ( ); } function ArrowRight({ size = 14, color = "currentColor" }) { return ( ); } function Check() { return ( ); } // Brand logo — white Proof&Trust wordmark (for dark backgrounds). function BrandMark({ size = 30 }) { return

; } // Icon-only mark (teal X) for use inside cards. function BrandGlyph({ size = 22 }) { return ; } function Reveal({ children, delay = 0, as: As = "div", style, className = "" }) { return {children}; } // ---------- Risk gauges (dark-surface) ---------- function riskTone(value) { if (value >= 75) return { color: "#E0533A", label: "CRITICAL" }; if (value >= 40) return { color: "#EC6A2B", label: "HIGH" }; return { color: "#5BC8A0", label: "LOW" }; } const TRACK = "rgba(255,255,255,0.10)"; function RiskGauge({ value }) { const cx = 140, cy = 130, r = 104; const total = Math.PI * r; const angle = -90 + (Math.max(0, Math.min(100, value)) / 100) * 180; const arcD = `M ${cx - r} ${cy} A ${r} ${r} 0 0 1 ${cx + r} ${cy}`; return (

{value}

Vendor risk index

); } function MiniGauge({ label, value }) { const { color } = riskTone(value); const cx = 36, cy = 36, r = 26; const total = Math.PI * r; const filled = (Math.max(0, Math.min(100, value)) / 100) * total; const arcD = `M ${cx - r} ${cy} A ${r} ${r} 0 0 1 ${cx + r} ${cy}`; return (

{value}

{label}

); } function DonutGauge({ value, size = 64, stroke = 6, color = "var(--pt-teal)", track = "rgba(255,255,255,0.16)", fg = "#fff" }) { const r = (size - stroke) / 2; const c = 2 * Math.PI * r; const filled = (Math.max(0, Math.min(100, value)) / 100) * c; return (

{value}

); } // ---------- Announcement bar ---------- function AnnouncementBar() { return (

NIS2 enforcement is live across the EU. · See your exposure in 30 minutes

); } // ---------- Header ---------- function Header({ ctaCopy }) { return (

); } // ---------- Hero ---------- function Hero({ ctaCopy }) { return (

NIS2 Article 21 · Supply-chain risk v3.0 just shipped

Score every vendor.
Tier every risk.
Prove it to your auditor.

Under NIS2, your suppliers are now your liability. Proof&Trust replaces static questionnaires with evidence-grade scoring — drop in your supplier evidence and get a defensible, Article 21-tiered portfolio in under 30 minutes, refreshed continuously.

30-min sample · no integration required · NDA on request · EU-hosted

Trusted by teams in {["Banking", "Energy", "Healthcare", "Telecom", "Public Sector"].map((s) => ( {s} ))}

); } function HeroMock() { return (

{/* Vendor dossier (dark UI) */}

Cross-border carrier

Direct supplier · 14 dependencies

TIER 2 · HIGH

NIS2 Article 21 mapping

{[ ["21(2)(a)", "Risk analysis & ISMS", "ok"], ["21(2)(d)", "Supply chain security", "flag"], ["21(2)(j)", "MFA & secure comms", "ok"], ].map(([id, label, status]) => (

{id} · {label}

))}

{/* Auto-scored toast */}

Auto-scored · 14s ago

ISO 27001 certificate ingested · Validity confirmed · Vendor moved to Tier 2.

{/* Portfolio donut tile */}

Portfolio · live

Aggregate risk

247 vendors scored
▲ 4 pts last 7 days

{[ ["T1", 8, "#E0533A"], ["T2", 21, "#EC6A2B"], ["T3", 44, "#5BC8A0"], ["T4", 27, "rgba(255,255,255,0.4)"], ].map(([l, w, c]) => (

{l} · {w}%

))}

); } // ---------- Outcomes ---------- function Outcomes() { const stats = [ ["1,200+", "Vendors typically tiered in the first 6 weeks"], ["94%", "Reduction in manual questionnaire cycles"], ["10/10", "Article 21(2) measures covered"], ["< 30 min", "From upload to fully scored portfolio"], ]; return (

{stats.map(([v, l], i) => (

{v}

{l}

))}

); } // ---------- Stakes / why now ---------- function Stakes() { const cards = [ { big: "€10M", unit: "or 2% of global turnover", label: "Maximum NIS2 fines", body: "Essential entities face the higher of €10M or 2% of total worldwide annual turnover for non-compliance.", }, { big: "Personal", unit: "management liability", label: "It reaches the boardroom", body: "Management bodies must approve and oversee cybersecurity risk measures — and can be held personally accountable.", }, { big: "Live", unit: "since Oct 2024", label: "The deadline has passed", body: "NIS2 has applied across the EU since 17 October 2024. Enforcement and audits are ramping now — not later.", }, ]; return (

Why now

Under NIS2, your supply chain is no longer someone else's problem.

Article 21(2)(d) makes the security of your direct suppliers your obligation. A spreadsheet of expired questionnaires won't survive an audit — and the penalties land on the people who signed off.

{cards.map((c) => (

{c.big} {c.unit}

{c.label}

{c.body}

))}

Proof&Trust turns that exposure into defensible, audit-ready proof.

); } // ---------- How it works ---------- function HowItWorks() { const steps = [ { n: "01", title: "Ingest every piece of evidence", body: "Connect contracts, vendor masters, and document stores. We pull in certificates, attestations, SBOMs, pen-test reports, and policies — and verify authenticity, validity, and scope automatically.", icon: ( ), }, { n: "02", title: "Score each artifact, score the vendor", body: "Every artifact gets an evidence-grade score: completeness, recency, source trust, and control coverage. Scores roll up into a continuously recalculated vendor risk index, mapped to NIS2 Article 21(2).", icon: ( ), }, { n: "03", title: "Tier and re-tier continuously", body: "Vendors auto-classify into four NIS2 tiers — Critical, High, Standard, Limited — based on dependency, concentration, and evidence quality. Tiers update the moment new evidence lands or a signal degrades.", icon: ( ), }, ]; return (

How it works

From static questionnaires to scored evidence — in three moves.

No more chasing PDFs across SharePoint. Proof&Trust ingests, validates, and scores — so your team can spend their time deciding, not collecting.

{steps.map((s) => (

{s.n}

{s.icon}

{s.title}

{s.body}

))}

); } // ---------- Risk tiers (NIS2-aligned: High / Medium / Low) ---------- function RiskTiers() { const tiers = [ { key: "High", label: "High", role: "Critical supplier", nis2: "Essential-grade scrutiny", range: "75–100", color: "#E0533A", summary: "Underpins an essential service or touches your most sensitive data. A failure here puts your own NIS2 obligations at risk.", points: [ "High data criticality + high risk exposure", "Supports an Annex I high-criticality function", "Full, documented Article 21(2) evidence required", ], action: "Continuous monitoring · remediate now", }, { key: "Medium", label: "Medium", role: "Important supplier", nis2: "Important-grade scrutiny", range: "40–74", color: "#EC6A2B", summary: "Material to service delivery or handles important — but not the most sensitive — data. Proportionate measures with gaps to close.", points: [ "Moderate data criticality or risk exposure", "Annex II / other-critical-sector relevance", "Article 21(2) measures, pragmatic evidence", ], action: "Quarterly review · close the gaps", }, { key: "Low", label: "Low", role: "Baseline supplier", nis2: "Baseline scrutiny", range: "0–39", color: "#5BC8A0", summary: "Limited data access and low operational dependency. Monitored, not a critical dependency — auto-escalates if exposure rises.", points: [ "Low data criticality + low risk exposure", "Not a critical dependency under NIS2", "Baseline controls + attestation evidence", ], action: "Annual re-attestation · monitor signals", }, ]; return (

NIS2-aligned tiering

Tiered the way NIS2 expects — by criticality and exposure.

Article 21(2)(d) makes you responsible for supplier security — applied proportionately to risk. We tier every vendor on the two dimensions the Directive cares about, then set oversight to match.

{/* Two selection axes → tier */}

How vendors are selected Criticality of data & service × Risk exposure Vendor tier & oversight depth

{/* Risk spectrum bar */}

0 · Lower risk Vendor risk index Higher risk · 100

{tiers.map((t) => (

{t.label} · {t.role}

{t.nis2}

Score {t.range}

{t.summary}

{t.action}

))}

NIS2 doesn't prescribe supplier tiers directly — it requires (Art. 21(2)(d)) that supply-chain and supplier security measures be proportionate to risk. These tiers mirror the Directive's own essential / important / baseline logic so oversight scales with criticality and exposure.

); } // ---------- Comparison ---------- function Comparison() { const rows = [ ["Time to a scored portfolio", "6–12 weeks", "Under 30 minutes"], ["Evidence freshness", "Annual snapshot", "Continuous, event-driven"], ["Article 21(2) coverage", "Manual mapping", "10 / 10 measures, automated"], ["Auditor defensibility", "Spreadsheet trail", "Cited evidence per score"], ["When a CVE drops", "You email vendors", "Tiers re-calculate in minutes"], ]; return (

Questionnaires vs. Proof&Trust

Stop renting compliance theatre.

Questionnaire-led

Proof&Trust

{rows.map(([label, a, b], i) => (

{label}

{a}

{b}

))}

); } // ---------- Tier visualization ---------- function DarkUseCases() { const tiers = [ { name: "High · Critical supplier", nis2: "Essential-grade scrutiny", pct: "12%", note: "of suppliers · loss would put your own NIS2 essential-service obligations at risk.", body: "High data criticality and exposure. Weekly evidence refresh, continuous breach monitoring, full Article 21(2) coverage, and direct CISO notifications on any score change.", bar: 92, color: "#E0533A" }, { name: "Medium · Important supplier", nis2: "Important-grade scrutiny", pct: "33%", note: "of suppliers · material to service delivery, but not your most sensitive data.", body: "Moderate dependency or exposure. Quarterly re-assessment, automated CVE matching, and pragmatic Article 21(2) evidence with gaps tracked to closure.", bar: 58, color: "#EC6A2B" }, { name: "Low · Baseline supplier", nis2: "Baseline scrutiny", pct: "55%", note: "of suppliers · low dependency and low data exposure.", body: "Baseline controls with attestation-based evidence and annual refresh. Event-driven re-checks on CVE, sanctions, or breach signals — auto-escalates the moment exposure crosses threshold.", bar: 28, color: "#5BC8A0" }, ]; return (

Vendor tiering

Three defensible tiers, recalculated every time evidence arrives.

Every tier change is timestamped, traceable to its evidence, and exportable as audit-ready proof.

{tiers.map((t) => (

{t.name} {t.nis2}

{t.pct} {t.note}

{t.body}

))}

); } // ---------- Testimonial ---------- function Testimonial() { return (

“

We tiered 312 vendors in six weeks. The Article 21 mapping alone replaced about 40% of the work my team used to do by hand — and the auditors stopped arguing.

Elin Marquand

CISO · Tier-1 European bank (NDA)

{[ ["Vendors tiered", "312"], ["Time to first portfolio", "41 days"], ["Manual cycles removed", "94%"], ].map(([l, v]) => (

{v}

{l}

))}

); } // ---------- Recognition ---------- function Recognition() { return (

Standards & coverage

Built to the standards your auditors cite.

{[ ["10/10", "Article 21(2) measures"], ["24h", "Early-warning draft"], ["ISO 27001", "Aligned controls"], ["EU", "Hosted & sovereign"], ].map(([v, l]) => (

))}

); } // ---------- Pricing ---------- function Pricing({ ctaCopy }) { const plans = [ { name: "Basic", price: "€1,999", cadence: "/ year", tagline: "For teams formalising their first NIS2 vendor programme.", vendors: "Up to 20 vendor assessments / year", cta: "Start with Basic", featured: false, features: [ "Pre-screening questionnaire (5 questions)", "Low / Medium / High NIS2 questionnaires", "Standard PDF report — score, answers, evidence status", "Evidence upload + vendor invite link", "Basic CSV export", "Email support", ], }, { name: "Professional", price: "€4,900", cadence: "/ year", tagline: "For active programmes that need automation and depth.", vendors: "Up to 100 vendor assessments / year", cta: "Choose Professional", featured: true, features: [ "Expanded question sets for all 3 risk levels", "Enhanced PDF report — NIS2 summary + risk blocks", "Automated vendor reminders", "Recommended Actions section", "Vendor answer export (filtered CSV)", "Priority email support", ], }, { name: "Enterprise", price: "€9,900+", cadence: "/ year", tagline: "For large portfolios with audit and integration needs.", vendors: "Up to 300 vendor assessments / year", cta: "Talk to sales", featured: false, features: [ "Full question sets for all 3 risk levels", "Advanced PDF report — risk tables, summary insights", "Custom branding (your logo)", "Read-only auditor account", "Simple API export endpoint", "SLA (24h response) + onboarding session", ], }, ]; return (

Pricing

Three clear tiers. One NIS2 standard.

Every plan delivers full NIS2-compliant vendor classification and the 3-tier questionnaire system. You scale on volume and depth — not on compliance.

{plans.map((p) => (

{p.featured && ( Most popular )}

{p.name}

{p.tagline}

{p.price} {p.cadence}

{p.vendors}

))}

All plans include full NIS2 compliance for vendor risk classification and the 3-tier questionnaire system. Annual billing, ex. VAT. Larger portfolios and private/on-prem deployments are quoted on the Enterprise tier — book a call for a tailored scope.

); } // ---------- FAQ ---------- function FAQ() { const [open, setOpen] = useState(0); const items = [ { q: "How does pricing work, and what counts as a vendor assessment?", a: "Plans are billed annually and scale on assessment volume: Basic (€1,999 / up to 20 assessments), Professional (€4,900 / up to 100), and Enterprise (€9,900+ / up to 300, plus custom branding, an auditor account, API export, and a 24h SLA). One assessment is one vendor taken through the NIS2 questionnaire and scored; re-running an existing vendor within the term doesn't consume a new slot. Every tier includes full NIS2-compliant classification and the 3-tier questionnaire system — you only scale on volume and depth. Larger portfolios and private/on-prem deployments are quoted on Enterprise.", }, { q: "What does NIS2 actually require for supply-chain risk?", a: "NIS2 Article 21(2)(d) requires essential and important entities to manage cybersecurity risk in their supply chains, including the security of relationships with direct suppliers and service providers. Entities must assess each supplier's overall security practices, the quality of their products, and their secure-development practices. Proof&Trust automates this assessment end-to-end and produces the evidence regulators expect.", }, { q: "How does evidence-grade scoring actually work?", a: "Every artifact a vendor provides — ISO certificates, SOC 2 reports, SBOMs, pen-test attestations, policies, contractual clauses — is parsed, validated against its issuer, scored on completeness, recency, scope, and control coverage, then weighted by the criticality of the NIS2 measure it addresses. Scores aggregate into a single, defensible vendor risk index.", }, { q: "How are vendors assigned to tiers?", a: "Tiers are computed from three signals: dependency (how essential the vendor is to your service), concentration (single-source exposure and substitutability), and evidence quality (the aggregate score above). The model is deterministic and explainable — every tier change links back to the specific evidence event that triggered it.", }, { q: "Can the platform be deployed entirely on-premise or in our private cloud?", a: "Yes. Proof&Trust ships as a multi-tenant EU-hosted SaaS, a single-tenant dedicated environment, or a private deployment in your VPC (AWS, Azure, GCP, or OVH). All deployments share the same evidence model and scoring engine.", }, { q: "How is the assessment evidence structured for our auditors?", a: "Every score, tier, and recommendation ships with citations to the underlying artifacts and the specific NIS2 article it satisfies. The audit workspace exports a portable evidence pack (PDF + machine-readable JSON) that mirrors what auditors see in the live console.", }, { q: "Does Proof&Trust generate the Article 23 incident-notification draft as well?", a: "Yes. When a qualifying incident is logged, the platform pre-fills the Article 23 early-warning notification (24h), incident notification (72h), and final report (1 month) with timestamped facts, affected vendors, and impact estimates — ready for your CSIRT to review and submit.", }, ]; return (

FAQ

Questions, answered.

Can't find what you need? Talk to a specialist

{items.map((it, i) => ( ))}

); } // ---------- Final CTA ---------- function FinalCTA({ ctaCopy }) { const [submitted, setSubmitted] = useState(false); const [sending, setSending] = useState(false); const [error, setError] = useState(""); const cfg = (typeof window !== "undefined" && window.PT_FORM) || {}; const calendlyUrl = cfg.calendlyUrl || "https://calendly.com/proof_trust"; async function handleSubmit(e) { e.preventDefault(); setError(""); const formEl = e.target; const fd = new FormData(formEl); fd.append("_subject", "New Proof&Trust demo request"); const endpoint = cfg.formEndpoint && cfg.formEndpoint.indexOf("YOUR_") === -1 ? cfg.formEndpoint : ""; // No real endpoint configured yet → fall back to opening the visitor's mail client. if (!endpoint) { if (cfg.notifyEmail) { const get = (k) => (fd.get(k) || "").toString(); const body = [ `Name: ${get("firstName")} ${get("lastName")}`.trim(), `Work email: ${get("email")}`, `Company: ${get("company")}`, `Vendor portfolio size: ${get("portfolioSize")}`, ].join("\n"); window.location.href = `mailto:${cfg.notifyEmail}?subject=${encodeURIComponent("Proof&Trust demo request")}&body=${encodeURIComponent(body)}`; } setSubmitted(true); return; } try { setSending(true); const res = await fetch(endpoint, { method: "POST", headers: { Accept: "application/json" }, body: fd, }); if (!res.ok) throw new Error("Request failed"); setSubmitted(true); } catch (err) { setError("Something went wrong sending your request. Please email us directly or try again."); } finally { setSending(false); } } return (

Get started

See your NIS2 exposure in 30 minutes.

Drop in a sample of your vendor evidence — we'll return a fully scored, NIS2-tiered portfolio. No questionnaires. No integration. NDA on request.

{submitted ? (

Request received

Skip the wait — pick a time that suits you and we'll walk you through your scored portfolio.

Or we'll reach out within one business day.

) : ( )}

); } // ---------- Footer ---------- function Footer({ ctaCopy = "Book a demo" }) { const nav = [ ["How it works", "#how"], ["Vendor tiering", "#tiers"], ["Standards & coverage", "#standards"], ["FAQ", "#faq"], ]; return ( ); } function Logos() { return null; } // ---------- Cookie / tracking consent banner ---------- function CookieConsent() { const [open, setOpen] = useState(false); useEffect(() => { let stored = null; try { stored = localStorage.getItem("pt-consent"); } catch (e) {} if (!stored) setOpen(true); const reopen = () => setOpen(true); window.addEventListener("pt:open-consent", reopen); return () => window.removeEventListener("pt:open-consent", reopen); }, []); function choose(decision) { try { localStorage.setItem("pt-consent", decision); } catch (e) {} if (decision === "granted" && typeof window.ptLoadTrackers === "function") { window.ptLoadTrackers(); } setOpen(false); } if (!open) return null; return ( ); } Object.assign(window, { Caption, Button, Chevron, ArrowRight, Check, Reveal, BrandMark, BrandGlyph, RiskGauge, MiniGauge, DonutGauge, riskTone, AnnouncementBar, Header, Hero, HeroMock, Logos, Outcomes, Stakes, HowItWorks, Comparison, DarkUseCases, Testimonial, Recognition, FAQ, FinalCTA, Footer, CookieConsent, });

Score every vendor.
Tier every risk.
Prove it to your auditor.

Under NIS2, your supply chain is no longer someone else's problem.

From static questionnaires to scored evidence — in three moves.

{s.title}

Tiered the way NIS2 expects — by criticality and exposure.

Stop renting compliance theatre.

Three defensible tiers, recalculated every time evidence arrives.

Built to the standards your auditors cite.

Three clear tiers. One NIS2 standard.

{p.name}

Questions, answered.

{it.q}

See your NIS2 exposure in 30 minutes.

Request received

{ctaCopy}

Score every vendor. Tier every risk. Prove it to your auditor.

Under NIS2, your supply chain is no longer someone else's problem.

From static questionnaires to scored evidence — in three moves.

{s.title}

Tiered the way NIS2 expects — by criticality and exposure.

Stop renting compliance theatre.

Three defensible tiers, recalculated every time evidence arrives.

Built to the standards your auditors cite.

Three clear tiers. One NIS2 standard.

{p.name}

Questions, answered.

{it.q}

See your NIS2 exposure in 30 minutes.

Request received

{ctaCopy}

Score every vendor.
Tier every risk.
Prove it to your auditor.