The discovery is free.
You pay to keep it right.
We do the work and show you what we found before you decide anything. After that you are paying for a list that stays correct without anyone on your team maintaining it — and for the record that proves it did.
We find your sub-processors, a reviewer checks them, and you get the list. Nothing to cancel and no obligation to continue.
- Discovery across all six sources
- Reviewer checks and de-duplicates
- Exportable list with every source
- A page on the public register
We keep the list current, bring you what moved, tell your customers on your behalf and hold the evidence for the audit.
- Everything in Discovery
- Daily re-check of your whole stack
- Dated change records, held for approval
- Customer notices sent in your name
- Evidence packs and decision log
- Watch up to 250 of your own vendors
Only billed once you approve your first list.
For firms carrying this across a book of clients rather than one business.
- Everything in Maintained
- Unlimited client workspaces
- Cross-client rollups in one view
- White-labelled exports and notices
- Reseller terms and onboarding
Everything, compared properly.
Including the rows most pricing pages leave out.
| Feature | Discovery$0 | Maintained$499/mo | Agency$1,500/mo |
|---|---|---|---|
| Discovery | |||
| Sources readlegal, DNS, headers, consent, your lists, contracts | All six | All six | All six |
| Reviewed by a named person | Yes | Yes | Yes |
| How often it runs | Once | Daily | Daily |
| Your own spreadsheet reconciled | Yes | Yes | Yes |
| Your published list | |||
| Page on the public register | Yes | Yes | Yes |
| Published at your own address | — | Yes | Yes |
| Embed and API access | — | Yes | Yes |
| Customers can subscribe to it | — | Yes | Yes |
| Notices sent in your nameafter you approve, never before | — | Yes | Yes |
| When something changes | |||
| Daily re-check of your stack | — | Yes | Yes |
| Approval queue with evidence attached | — | Yes | Yes |
| Objection windows from your own DPAsclause extracted, human confirmed | — | Yes | Yes |
| Notice inbox and page-vs-notice gap | — | Yes | Yes |
| Slack, Teams, email, webhooks | — | Yes | Yes |
| Evidence | |||
| Decision logaccepted, objected, escalated, by whom | — | Yes | Yes |
| Dated evidence packs | — | Yes | Yes |
| Ledger verification | Public | Public | Public |
| Watching other vendors | |||
| Vendors monitored daily | — | 250 | Unlimited |
| Fourth-party chain mapping | — | Yes | Yes |
| DORA register export | — | Add-on | Yes |
| For firms with clients | |||
| Client workspaces | — | — | Unlimited |
| Cross-client rollups | — | — | Yes |
| White-labelled exports and notices | — | — | Yes |
| Client-scoped API tokens | — | — | Yes |
| People | |||
| Seats | Unlimited | Unlimited | Unlimited |
| Reply from a reviewer | Best effort | 1 working day | Same working day |
| Onboarding | Self-serve | Guided | Hands-on |
Four things we will never charge you for.
Because charging for them would quietly push us to behave badly.
- AlertsYou should never be charged for an alarm going off. Metering alerts creates a reason to raise more of them, and a reason for you to want fewer.
- SeatsThe person who fields the auditor’s question is rarely the one who signed the DPA. Both need to be in here.
- Your own historyEvery dated record we hold for you stays available, and leaves with you if you go.
- Reading the registerThe public register is free to read, with no account, whether or not you ever buy anything.
Watching a page costs almost nothing. Being right costs something.
Generic page monitoring sells for a few pounds a month, and it is genuinely worth that. What it cannot do is tell you whether the thing that moved matters, or hand an auditor a record they can verify.
Fetch, normalise, hash, compare
Deterministic and cheap. Banners, timestamps and markup churn are stripped before anything is compared, and only the entity hash can raise an alarm.
Merge, classify, decide scope
The same company under three names. A page rebuild that looks like eighteen new vendors. A marketing tag that is not a sub-processor. This is the expensive part, and it is the part you are buying.
Hash-chained, and exportable
Every check, change and decision, dated as it happened. Scanning is the feature; the record is the product, and it is what survives the audit.
Subcontracting-chain mapping and register exports, scoped to the annual submission cycle. Priced against the size of your ICT estate rather than a seat count, because that is what actually drives the work.
The awkward ones.
When you approve your first list, not when you submit your domain. The discovery runs, a reviewer works through it, we send it to you — and if you decide to stop there, you keep the list and pay nothing.
One company on your watchlist, however many of their pages we have to read to keep it current. If a vendor publishes their list across four pages and a PDF, that is still one vendor.
Entities on your own published list are not counted at all — those are the thing you are paying to maintain.
Cancel from the settings page, any time, no call. Your dated history exports in full — PDF, CSV and the manifest — and your register page stays live, marked as no longer maintained rather than quietly going stale.
Two months free, so $4,990 rather than $5,988. Same product, and you can switch to annual mid-term with the balance credited.
Prices are shown excluding VAT. VAT is applied at checkout based on your billing country, and a valid EU VAT number reverse-charges. We invoice in pounds; card payments in other currencies are converted by your issuer.
No. Each client gets a workspace inside yours, with its own list, queue and evidence. If a client later wants to take it over directly, the workspace transfers with its full history rather than starting again.
See the work before you decide anything.
Free discovery, a named reviewer, and no billing until you approve the first list.