discovery
Find your sub-processorssix sources, read for youRead your own listsCSV, DPA or procurementDecide the scopewhat touches customer datapublish
Your register pagecurrent to the dayEmbed on your siteor in your trust centreCustomer noticessent in your nameprove
Evidence packsdated and exportableDecision logaccepted, objected, escalatedLedger verificationhash-chained recordEvery vendor found in your discovery, monitored daily.
See monitoring →by role
In-house privacyyou signed the DPAsGRC & securityyou answer the auditorDPO firmsyou carry it for clientsby situation
Selling into the EUyour first Article 28 annexFinancial servicesDORA subcontracting chains100+ SaaS vendorstoo many to watch by handby stage
First DPA annexget it right first timeScaling privacy teamretire the spreadsheetMulti-client practiceone workspace eachCross-client rollups, white-labelled exports, reseller terms.
Compare tiers →european union
GDPR Article 28notice and objection windowsEDPB Opinion 22/2024what “current” now meansDORAregister of informationNIS2supply-chain dutiestransfers & elsewhere
SCCs & transferswhere each entity processesUK GDPRsame duty, own regulatorCCPA / CPRAservice provider dutieswhat we publish
Our methodhow detection worksFalse-positive policywhy we stay quietCoverage and gapswhat we cannot reach yetSubcontracting chains, produced as a by-product of discovery.
Talk about DORA →browse, free
All businesses36 with a dated historyLive changesevery list that movedSub-processor indexwho is named, by whomgo deeper
By countrywhere processing happensFourth-party chainsyour suppliers’ suppliersCoverage and gapswhat we cannot reach yetif you are listed
Claim your pageverify and take it overSuggest a correctionwe log every onePublishing guidehow to keep it rightThe register stays open whether or not you buy anything.
Open the register →Sub-processor index › Heroku
Named on 1 published list. This is a record of who names them, not a statement about the company itself.