Discovery queue open Typical turnaround: one working day The register Method Talk to a reviewer
subprocessor.org
Have us do it →

discovery

Find your sub-processorssix sources, read for youRead your own listsCSV, DPA or procurementDecide the scopewhat touches customer data

publish

Your register pagecurrent to the dayEmbed on your siteor in your trust centreCustomer noticessent in your name

prove

Evidence packsdated and exportableDecision logaccepted, objected, escalatedLedger verificationhash-chained record
and later
Watch your vendors too

Every vendor found in your discovery, monitored daily.

See monitoring →
Six sources. One reviewed list. Re-checked daily.See how the work flows →

by role

In-house privacyyou signed the DPAsGRC & securityyou answer the auditorDPO firmsyou carry it for clients

by situation

Selling into the EUyour first Article 28 annexFinancial servicesDORA subcontracting chains100+ SaaS vendorstoo many to watch by hand

by stage

First DPA annexget it right first timeScaling privacy teamretire the spreadsheetMulti-client practiceone workspace each
for dpo firms
One workspace per client

Cross-client rollups, white-labelled exports, reseller terms.

Compare tiers →
Same engine, different job to be done.Compare the tiers →

european union

GDPR Article 28notice and objection windowsEDPB Opinion 22/2024what “current” now meansDORAregister of informationNIS2supply-chain duties

transfers & elsewhere

SCCs & transferswhere each entity processesUK GDPRsame duty, own regulatorCCPA / CPRAservice provider duties

what we publish

Our methodhow detection worksFalse-positive policywhy we stay quietCoverage and gapswhat we cannot reach yet
annual cycle
The DORA register window

Subcontracting chains, produced as a by-product of discovery.

Talk about DORA →
We publish observations and dated records, never legal conclusions.Read the method →

browse, free

All businesses1,284 with a dated historyLive changesevery list that movedSub-processor indexwho is named, by whom

go deeper

By countrywhere processing happensFourth-party chainsyour suppliers’ suppliersCoverage and gapswhat we cannot reach yet

if you are listed

Claim your pageverify and take it overSuggest a correctionwe log every onePublishing guidehow to keep it right
free to read
No account needed

The register stays open whether or not you buy anything.

Open the register →
Free to read. No account.Open the register →
dpo-as-a-service

The same work,
multiplied by every client.

You are billing hours for something that should be a process. One workspace per client, one view across all of them, and exports that go out under your name rather than ours.

See the Agency tier → Talk about reseller terms

Across your clients

14 workspaces
Northwind Ltd214 vendors · 3 open
Halden Group96 vendors · 0 open
Ardent Health147 vendors · 1 open

One screen for the Monday review, instead of fourteen logins and a spreadsheet that reconciles them.

the economics

Vendor-list upkeep is the least leveraged work you do.

It is necessary, it is billable, and it is the first thing a client questions when they compare your invoice to their budget.

per client, per quarter

Hours you cannot mark up

Chasing lists, re-reading the same vendor pages, and rebuilding a picture you already built last quarter.

across clients

No shared view

The same vendor appears for nine of your clients. Reading their page nine times is nine times the work for one answer.

at renewal

“What did we pay for?”

Judgement is hard to invoice. A dated record with your name on it is not.

what you get

Built for a book of clients, not one company.

  • A workspace per client, isolated

    Separate lists, queues, contracts and evidence. Nothing bleeds between clients, and access is scoped per person on your team.

  • One rollup across all of them

    Open windows, overdue checks and pending decisions in a single view, so the Monday review is one screen rather than fourteen.

  • Exports in your name

    White-labelled packs and customer notices. The client sees your firm, not a tool they could have bought themselves.

  • Read once, applied everywhere

    When a vendor nine of your clients use changes their list, we read it once and it lands in nine queues with the right contract window against each.

  • It transfers if they leave

    A client taking it in-house gets their workspace with the full history. No hostage-taking — it makes you easier to hire, not harder to leave.

“One workspace per client, one export each, white-labelled.” the whole requirement, as it was put to us
the commercial shape

Priced so the margin is yours.

Unlimited client workspaces on one flat fee, because per-client pricing would just tax your growth.

  • Flat, not per client

    Add the fifteenth client at no additional cost. What you charge them is between you and them.

  • Reseller terms available

    If you would rather it appear on your invoice than ours, that is a conversation we are happy to have.

  • Client-scoped API tokens

    Wire a client’s workspace into their own systems without giving them the keys to your practice.

See the Agency tier → Try it on one client first