Discovery queue open Typical turnaround: one working day The register Method Talk to a reviewer
subprocessor.org
Have us do it →

discovery

Find your sub-processorssix sources, read for youRead your own listsCSV, DPA or procurementDecide the scopewhat touches customer data

publish

Your register pagecurrent to the dayEmbed on your siteor in your trust centreCustomer noticessent in your name

prove

Evidence packsdated and exportableDecision logaccepted, objected, escalatedLedger verificationhash-chained record
and later
Watch your vendors too

Every vendor found in your discovery, monitored daily.

See monitoring →
Six sources. One reviewed list. Re-checked daily.See how the work flows →

by role

In-house privacyyou signed the DPAsGRC & securityyou answer the auditorDPO firmsyou carry it for clients

by situation

Selling into the EUyour first Article 28 annexFinancial servicesDORA subcontracting chains100+ SaaS vendorstoo many to watch by hand

by stage

First DPA annexget it right first timeScaling privacy teamretire the spreadsheetMulti-client practiceone workspace each
for dpo firms
One workspace per client

Cross-client rollups, white-labelled exports, reseller terms.

Compare tiers →
Same engine, different job to be done.Compare the tiers →

european union

GDPR Article 28notice and objection windowsEDPB Opinion 22/2024what “current” now meansDORAregister of informationNIS2supply-chain duties

transfers & elsewhere

SCCs & transferswhere each entity processesUK GDPRsame duty, own regulatorCCPA / CPRAservice provider duties

what we publish

Our methodhow detection worksFalse-positive policywhy we stay quietCoverage and gapswhat we cannot reach yet
annual cycle
The DORA register window

Subcontracting chains, produced as a by-product of discovery.

Talk about DORA →
We publish observations and dated records, never legal conclusions.Read the method →

browse, free

All businesses1,284 with a dated historyLive changesevery list that movedSub-processor indexwho is named, by whom

go deeper

By countrywhere processing happensFourth-party chainsyour suppliers’ suppliersCoverage and gapswhat we cannot reach yet

if you are listed

Claim your pageverify and take it overSuggest a correctionwe log every onePublishing guidehow to keep it right
free to read
No account needed

The register stays open whether or not you buy anything.

Open the register →
Free to read. No account.Open the register →
grc & security

The question is never
whether you monitor.

It is “show me the record for the last twelve months.” Scanning is the easy part — the product is a dated, verifiable record that survives being questioned.

Start my discovery → Evidence API

Q3 2026 evidence pack

ready
range 1 Jul – 17 Aug 2026
changes 41 · decisions 38 · notices 3
normaliser 1.3.0
ledger head 0f31c8ad9e42
entries 1,204
manifest.jsonchanges.csvpack.pdf

Every row verifiable against the public ledger, by anyone, without an account.

where the time goes

Assembling evidence costs more than gathering it.

The data usually exists somewhere. Proving it was true on a particular date is the expensive part.

the screenshot folder

Evidence nobody can verify

A PNG of a vendor page proves you looked. It does not prove when, or that it has not been edited since.

the questionnaire

The same forty questions

Answered from memory each time, by whoever is free, with no shared source of truth behind the answers.

the gap

“What did you do about it?”

Detection without a recorded decision is half an answer. Auditors ask for the other half.

what you get

A record built to be questioned.

  • Hash-chained from the moment it happens

    Each row carries the hash of the row before it. An entry cannot be altered or back-dated without breaking every row after it.

  • Decision log, not just detection

    Accepted, objected, escalated or marked not applicable — with who decided and when, alongside the evidence they saw.

  • Packs on a date range, not a dashboard screenshot

    PDF, CSV and a manifest. Hand it over as-is; the auditor can verify it without asking us anything.

  • Fits what you already run

    Webhooks, an API, Slack and Teams. No agent, no browser extension, nothing to install on an endpoint.

“Evidence I can export, not screenshots I have to collect.” what the pack replaces
why the alerts are worth having

A noisy detector gets muted, and then it protects nobody.

So we tuned for silence before sensitivity, and we publish the numbers.

  • 0.6% false positives

    Measured by mutating twenty real vendor pages with eight kinds of harmless edit. One in 160 produced a published change.

  • Anything touching 40% of a list is held

    A page rebuild is not eighteen new sub-processors, and publishing it as one would be the most damaging thing we could do.

  • No model in the decision

    Fetch, normalise, hash, compare. Models may suggest a page or draft a summary; none can create or suppress a record.

Read the method Start my discovery