One record per vendor, holding everything you need before you pay them and everything you need at tax time.
Everything on file about one vendor on one page: contact, remit-to, tax status, open balance and aging, spend by year and by property, open bills, recent payments, and documents.
Where payments go somewhere other than the vendor's own address, the profile says so. That is ordinary for a lockbox, and it is also what a redirected-payment fraud looks like.
Certificates of insurance carry their expiration, and the profile says how long is left or how long ago it lapsed.
Whether a vendor is reportable, under which box, and whether their taxpayer ID is on file.
A vendor can submit new bank details through their portal, and those details stay inert until a staff member reviews and applies them. A compromised portal account cannot redirect a payment on its own.
Taxpayer IDs show their last four digits, and account numbers are not on the lists or the reports at all. The full values are shown one vendor at a time, where they are actually needed.
W-9s, certificates, contracts, uploaded by your team or by the vendor themselves.