Orchestra TPRM (Third Party Risk Management)

Third-party risk review is slow and expensive: vendor onboarding takes 3–6 weeks and $15-50K; M&A due diligence runs 6–12 weeks and $200K–$2M. Existing GRC (Governance, Risk, and Compliance) tools are built for compliance officers, not for the deal-time question of whether to proceed. Orchestra compresses that work into under 90 seconds. It's a Python multi-agent orchestration framework — typed state with reducer functions, compile-time graph validation, parallel asyncio fan-out, a scripted-LLM test harness — and an enterprise risk-review application built on it. The entire stack runs on Google Cloud: Gemini 2.5 Flash via the Google AI Studio API powers every agent call; Google Cloud Run hosts the FastAPI backend and React 19 dashboard; the Gemini Files API uploads PDFs to the model; Google Drive sources packets; Google Sheets receives vendor verdicts, Google Docs receives M&A deal memos; BigQuery stores findings; Cloud Trace captures OpenTelemetry spans. Seven specialists review packets in parallel: Legal (contract clauses), Security (SOC 2 controls), Code (license + supply chain risk), External (news + sanctions), Financial (M&A), ESG (E/S/G disclosures), and SaaSMetrics (M&A — ARR, NRR, Rule-of-40). A Risk Scoring agent produces a deterministic 0-100 score with traffic-light verdict and three explained drivers. A Policy agent applies a YAML rule pack and emits an IC memo. A Remediation agent generates a P0/P1/P2 action plan with contract leverage ("vendor must do X" / "buyer negotiates Y via SPA reps, indemnity, escrow"). The dashboard streams events over Server-Sent Events. Apache 2.0 licensed.