Help

In order: create your sites (not needed if you only track suppliers), add the third parties (tenants, suppliers, insurers) with the contact who receives the requests, activate types from the library, then create the requirements with an assignment rule. The requests then go out by email, followed by the reminders. The “Setting up Vigilo” block on the dashboard tracks these steps, with a link to each one.

1. The account owner accepts their invitation, then invites their team in Settings › Members, with each person's role and scope (or through the Team sheet of the complete file). 2. Compliance types › Browse the library: activate the types to follow (insurance, certificates, inspections…). 3. Import › Complete file: download the template, empty or with an example. One sheet per kind of data, in import order: portfolios, sites, units, third parties, equipment, requirements, team. Fill in the sheets you need. 4. Import the file: each error is shown with its sheet, row and column; nothing is created while one remains. 5. Assignment rules: check the rules, they create the requirements of sites and third parties. 6. Reminders: leave them on, third parties receive their first request. The Vigilo team can do these steps with you during setup.

Open Import (the “Import” button of the site, third-party or equipment lists, or the “Import from Excel or CSV” link of the “Setting up Vigilo” block). To start a base, download the complete file (one sheet per type of data, with an example and the lists of values), fill it in and choose it: every error is listed with its sheet, row and column, and nothing is saved while one remains. To add one type of data, use its tab: drop an Excel or CSV file, map the columns and check the preview. If active rules create requirements, the report says how many third parties will get a first request. An “Employer” column links each worker to their company.

A rule states which third parties owe which document, for which sites. Each match creates a requirement. Use the preview to see the result before activating. A national type starts with its country; for a third party, that is the country where it works (its sites). Some types only cover third parties established in their country (social security certificates) or outside it (posting declarations). The preview names the items it leaves out and why. It also says how many third parties will receive a first request, and when; tick “Don't write to third parties for now” to create the requirements without sending anything.

Third parties receive an email with a secure link before and after the due date. The schedule is set on the Reminders page, for documents and for periodic checks. Sending can be paused per requirement. With the assisted service, calls to third parties who do not answer and document review are done, type by type, by Vigilo or by your team (“Calls and review”); a requirement may differ from its type.

Open “To review”, check the file and the dates entered, then approve, or reject with a reason. The third party is notified of a rejection and can submit again. With double approval, another member approves after you. Each approval and its comment appear in the requirement history. One document covering several requirements (same type, same third party): check them under “Same document for” before approving, or use “Apply to other requirements” on the requirement page. Vigilo also reads the dates and numbers of the document (PDF, photo); when a required field stays unreadable, an AI reads it (“read by AI”, can be switched off in Settings › Statuses and steps). “The document says …” flags a difference with what was entered, “Use this value” takes the value read. The decision stays yours.

The document is still valid but its end of validity falls within the N days set by the type (30 by default). It becomes “expired” after its end date and the type's grace period, if any. Reminders follow their own calendar (Reminders page).

A simple page opened from their email, with no account: the documents requested, an upload form that works on a phone, and the status of each request. A document already sent for another request of the same type can be sent again in one tap.

Open Settings, then Members, and “Invite”: address, role, scope (the whole organization or some portfolios and sites) and, for an external viewer such as an auditor, an end date of access. The link stays valid 7 days, never past the end of the access; “Resend” sends a new link. The invitation of an admin who left the organization is no longer accepted: resend it. Suspended organization: you can still remove a member and revoke an invitation or an API key. Two-factor authentication can be required for everyone.

The “Access denied” page, or a message saying you do not have permission, means your role does not allow this action. An administrator of your organization can change your access: Settings, then Members, Actions menu, “Change access”; they extend an access past its end date the same way. What each role allows: a viewer reads without changing anything; a manager works within their scope (portfolios and sites), and an item outside it reads as not found; settings, members and invitations are kept for administrators and the owner; approving a document needs the review role set by its compliance type, and the second approval someone other than the first.

A finding is an issue noted during a check, with its severity, the person who fixes it and a date. Depending on the type's “Open findings” setting, a critical finding (or any open finding) can prevent compliance until it is resolved; by default, findings are tracked without changing the status. The proof is attached when marking it resolved; someone else verifies it.

You undo almost any action yourself, without asking the support, and the history stays. A document sent by mistake and not decided yet: on the document's review screen, “Withdraw” (the third party withdraws its own from its portal). A document rejected by mistake: “Review again”, while no newer document was sent. An approval given by mistake: “Revoke approval” (owner or admin), then “Review again”. A finding verified or accepted without correction: “Reopen”, with a reason. A requirement excluded, or closed with the third party's last relationship: “Reinstate”, on its page or in bulk. A waiver: “Lift waiver”. A site, unit, equipment, third party, contact or relationship archived: “Show archived”, then “Restore”; what was archived with it comes back and its requirements reopen. A wrong file imported: Import, “Recent imports”, “Undo this import” (30 days, owner or admin). A date, an owner or a field: change it again, the previous value stays in the history. Not undone: the erasure of personal data, the merge of two third parties, the revocation of an API key, an email already sent (pause the next reminders) and the deletion of a note, a saved view, a scheduled send or a webhook (with its delivery history). Who did what: “History” on the record or the requirement, and Settings › “Journal” for the whole organization. Most of these ways back also exist through the API (see the API documentation).

Yes. Open Settings, then Custom fields, and choose Requirement. The fields appear on the requirement page, in the list (Columns menu), in filters, in exports and in the API. A field created with the wrong type (text instead of a date, for example) is converted from its Edit window › Change type: a preview shows the values converted and those that cannot be; each item keeps its former value in its history.

On the requirements list, save the current filters as a view, for yourself or shared with the whole organization, and choose a default one. The Columns menu shows, hides and reorders columns; columns and the default view stay specific to your account.

The bell lists events that concern you. On the Notifications page, choose which types also reach you by email (grouped, without content) and turn the weekly digest on or off; its weekday is chosen by an administrator in Settings. Away for a few days? “Absence” card: your dates and a deputy (an owner, admin or manager whose access covers yours). Meanwhile your notifications also reach them, preceded by “For” and your name, and so do the internal reminders of the documents you provide; your responsibilities do not change.

Yes. Settings, then API keys, creates read or write keys and signed webhooks for your events. “IP addresses” limits a key to the addresses of your servers. The Developers guide gives examples to copy and the OpenAPI file.

Settings › Data retention sets when former third parties are proposed for anonymisation; nothing is erased without an owner's confirmation. For a dispute, an inspection or an inquiry, open the third party or the requirement, menu …, Place a retention hold: while it is active, nothing it covers can be erased, anonymised or purged. Give a reason and a review date; holds are listed in Settings and shown in Account health once their review date has passed. If someone asks for their data to be erased during a hold: menu …, Erase personal data, then record the request and copy the reply, to send them within one month. To take out a third party's whole file (documents, reminders, history): menu …, Evidence dossier. “Export all the organization's data” (Settings) holds all your data, including the activity log.