Where your software actually runs, who else touches it, and how long it will be supported.

Every field below carries the page it came from and the date we read it. Nothing is a rating, a score or a verdict — we record what vendors disclose, and what changed since.

29of 104 state no EU data location at all
39publish a compliance page no ordinary client can read
43of 46 shipping software miss the CRA five-year floor

Data residencyWhether an EU data location exists, which plan reaches it, and what it costs.29 of 104 unstated Support windowsHow long each product is supported — and which vendors have never said.43 of 46 under the CRA floor Trust centresEvery vendor's own compliance page, including the gated and the JavaScript-only.1 last dated over a year ago

What is in here

For each vendor: who legally operates it, where the data sits, who else touches it, what it is certified for, how long it is supported. Every field carries the page it came from and the date we read it. 1095 distinct subprocessors are recorded across 104 vendors — see who relies on whom, or the change log.

Legal entity: who you actually contract with, and where it is owned
Data location: whether an EU region exists, and which plan reaches it
Subprocessors: every name the vendor lists, with country and purpose
Assurance: what is certified, and what is only claimed
Support window: how long the product is supported, against the CRA floor
Security contact: the route for reporting a flaw, and whether it is maintained

4395 sourced facts, each with its page and date · observation began 2026-09-17

Who sits underneath

A vendor-by-vendor review never shows this. These names are each recorded by several of your suppliers at once, so the blast radius of one of them is wider than any single contract suggests — and because names are transcribed exactly as each vendor writes them, never merged, the real concentration is higher than the count below. See all 1095.

Findings

Counted across the registry, with every source a click away. What the data processing agreements actually say: transfer mechanisms, notice before a new subprocessor, breach deadlines and transfer impact assessments, agreement by agreement.

What this is not

We never rate a vendor. No badge, no score, no verdict. Compliance is a property of your use of a tool, not of the tool — the same product can be fine for your newsletter and wrong for your HR records. So we record what vendors disclose and let you decide, and the only computed figures here are arithmetic that shows its inputs.

A verdict is something a sponsor could buy. A dated observation is not.
Why there is no score on this site