What changed in your software vendors' terms
New subprocessors, EU data residency, certifications, Data Privacy Framework status and CRA support windows, read from each SaaS vendor's own pages. Every change is dated, links to its source, and was reviewed before it was published. No ratings, no scores.
160 vendors, each read from its own pages · observation began 2026-09-17
Latest reviewed changes
- SubprocessorsMailgun Added Amazon Web Services South Africa (Pty) LtdLocation changed Amazon Web Services EMEA SARL: AU, BR, DE, EU, IE, SG, US, ZA -> AU, BR, DE, EU, IE, SG, US; Google LLC: BE, DE, EU, US -> AU, BE, EU, US
- SubprocessorsAirtable Location changed Bright Data Ltd.: US -> DE, SG, US
- SubprocessorsApollo.io Removed NetNut Ltd.
- Data Privacy Framework ListCloudflare Status Active - Re-certification under Review → Active
- SubprocessorsCursor Location changed SpaceXAI: US -> GB, US
- SubprocessorsGitLab Added LangChain, Inc.
Across 160 vendors
What the registry holds today, counted from the same sourced facts the changes above are measured against. The pages below name the vendors behind each figure.
- 61of 160 state no EU data location at all
- 40of 722 vendor compliance pages we read are gated, refused or JavaScript-only
- 76of 90 installable products have no stated end date for support
What is in here
For each vendor: who legally operates it, where the data sits, who else touches it, what it is certified for, how long it is supported. Every field carries the page it came from and the date we read it. 1654 distinct subprocessors are recorded across 160 vendors — see who relies on whom, or the change log.
- Legal entity
- who you actually contract with, and where it is owned
- Data location
- whether an EU region exists, and which plan reaches it
- Subprocessors
- every name the vendor lists, with country and purpose
- Assurance
- what is certified, and what is only claimed
- Support window
- how long the software is supported, and whether an end date is stated
- Security contact
- the route for reporting a flaw, and whether it is maintained
7650 sourced facts, each with its page and date · observation began 2026-09-17
Who sits underneath
A vendor-by-vendor review never shows this. These names are each recorded by several of your suppliers at once, so the blast radius of one of them is wider than any single contract suggests — and because names are transcribed exactly as each vendor writes them, never merged, the real concentration is higher than the count below. See all 1654.
Findings
Counted across the registry, with every source a click away. What the data processing agreements actually say: transfer mechanisms, notice before a new subprocessor, breach deadlines and transfer impact assessments, agreement by agreement. How vendors tell you where to report a vulnerability: who publishes a security.txt, and whose has expired. AI providers on subprocessor lists: which vendors name OpenAI, Anthropic and other AI companies, row by row. SecNumCloud, C5, ENS and HDS: which vendors are in the official registers, and which only claim it. The vendor due diligence checklist: the checks you can make from public pages, and how many vendors publish what each one needs. Sovereign clouds: what AWS, Microsoft and Google say about their European offerings, and which SaaS vendors run on them. The Data Privacy Framework List: which vendors are certified, for which data, and when they must renew. Transfer impact assessments: which vendors publish a document for yours, how current it is, and which laws it covers.
What this is not
A verdict is something a sponsor could buy. A dated observation is not.
Why there is no score on this site