Vendor due diligence checklist for SaaS
Most of what a vendor security questionnaire asks about data protection, the vendor has already published, or has chosen not to. These are the 14 checks you can make from its public pages before you send a single question, the rule behind each one, and how many of the 160 vendors in this registry publish what the check needs.
The duty behind it
GDPR Art. 28(1) lets you use only processors that provide "sufficient guarantees". The European Data Protection Board's guidelines 07/2020 say what to weigh: the processor's expert knowledge, its reliability, its resources and its reputation (§97); adherence to an approved code of conduct or certification counts as evidence (§98); and the check is a continuous obligation, repeated at appropriate intervals, not a one-off at signing (§99). If you fall under NIS2, Art. 21 adds supply-chain security and asks you to weigh each direct supplier's own vulnerabilities and cybersecurity practices (Directive (EU) 2022/2555, Art. 21(2)(d) and (3)).
The checklist
Who exactly you contract with
Look for: The legal entity named in the terms or the DPA, whether it is an EU company, and who owns it.
Why: The contracting entity is who owes you the obligations; its owner decides which foreign laws can reach your data. (Art. 28(3) GDPR)
In this registry: 152 of 160 name their contracting entity on a page we could read; 41 name an EU entity. See every vendor
A data processing agreement
Look for: A DPA you can read before signing, not one sent after a sales call.
Why: Processing on your behalf must be governed by a contract with the contents Art. 28(3) lists. (Art. 28(3) GDPR)
In this registry: 120 of 160 publish one we could read. See every vendor
Notice before a new subprocessor, and the right to object
Look for: A number of days, how you are told (email, RSS, a page to watch), and what happens if you object.
Why: Under a general authorisation the vendor must tell you of changes so you can object; the EDPB expects the contract to set a reasonable timeframe. (Art. 28(2) GDPR; EDPB 07/2020 §158)
In this registry: 80 of the 120 agreements state a number of days; 117 say how you can object. See every vendor
How fast you hear about a breach
Look for: A deadline in hours, or the words the agreement uses instead.
Why: You have 72 hours to notify your supervisory authority; the processor owes you notice "without undue delay", with no number set by law. (Art. 33(1)–(2) GDPR)
In this registry: 30 of the 120 agreements commit to a number of hours. See every vendor
Audit and information rights
Look for: What the vendor gives you to show compliance (reports, answers) and when an on-site audit is allowed.
Why: The processor must make available the information needed to demonstrate compliance and allow audits. (Art. 28(3)(h) GDPR)
In this registry: 119 of the 120 agreements set out audit or information rights. See every vendor
The subprocessor list
Look for: A public list naming each subprocessor, its purpose and its location, with a date.
Why: Your data goes where the subprocessors are, and the same obligations must flow down to them. (Art. 28(2) and (4) GDPR)
In this registry: 124 of 160 publish a list we could read. See every vendor
Where your data is stored, and on which plan
Look for: Whether an EU location exists, whether it is the default, and which plan or add-on it needs.
Why: An EU region on the enterprise tier only does not help a team on a lower plan.
In this registry: 99 of 160 document an EU location; for 31 it is the default or free. 61 state none we could find. See every vendor
How data leaves the EEA
Look for: The transfer mechanism the agreement relies on (SCCs, the Data Privacy Framework), and whether a transfer impact assessment is offered.
Why: A transfer outside the EEA needs a mechanism; relying on the SCCs brings the Schrems II assessment with it. (Chapter V GDPR; CJEU C-311/18)
In this registry: 114 of the 120 agreements rely on the SCCs; 20 mention a transfer impact assessment. See every vendor
Data Privacy Framework status
Look for: Whether the US entity you contract with is on the official list, and active.
Why: The Framework covers only organisations active on the list, and a lapsed entry stays on it as history. (Decision (EU) 2023/1795)
In this registry: 73 of 160 have an active entry for the EU-U.S. Framework. See every vendor
Certifications, and whether the certificate is shown
Look for: The scheme, its scope, and the certificate or report itself, not a logo.
Why: ISO 27001 or a SOC 2 report is evidence about security practice (Art. 32). It is not a GDPR certification under Art. 42, which is what Art. 28(5) refers to. (Art. 28(5), 32 GDPR; EDPB 07/2020 §98)
In this registry: 149 of 160 claim at least one certification; 25 publish a certificate document we could open. See every vendor
An approved code of conduct or an official register entry
Look for: Adherence to a code approved under Art. 40 (the EU Cloud Code of Conduct), or a national scheme the authority publishes.
Why: An approved code is one of the elements the GDPR itself accepts to demonstrate sufficient guarantees; a register entry is the authority's record, not the vendor's word. (Art. 28(5), 40 GDPR; EDPB 07/2020 §98)
In this registry: 12 of 160 adhere to the EU Cloud Code of Conduct; 18 hold an ENS certificate and 3 a SecNumCloud qualification. See every vendor
A route for reporting vulnerabilities
Look for: A security.txt at the standard address, with a contact and an expiry date that has not passed.
Why: It is where a researcher who finds a flaw in the vendor's service, and so in your data's protection, is told to go. (RFC 9116)
In this registry: 100 of 160 publish one; 68 carry both required fields, in date. See every vendor
A support period, if you install their software
Look for: The period during which the vendor fixes vulnerabilities in a version you run, stated in months or as an end date.
Why: From December 2027 a manufacturer must state a support period, as a rule at least five years. (Art. 13(8) CRA)
In this registry: 28 of the 61 vendors that ship installable software state a period for at least one product. See every vendor
Check again, at intervals
Look for: Changes to the subprocessor list, the DPA, residency terms and certifications since you signed.
Why: The EDPB calls the duty to use only processors with sufficient guarantees a continuous obligation, to be verified at appropriate intervals. (EDPB 07/2020 §99)
In this registry: We re-read every source weekly; 95 reviewed changes are published so far. See every vendor
What public pages cannot tell you
These are the questions that still belong in a questionnaire or a call, because no vendor page settles them:
- Whether the controls behind a certificate work. A SOC 2 type II report says that, and vendors usually share it only on request, often under NDA.
- Which subprocessors and regions apply to your plan and your workspace, where the public list covers the whole company.
- Whether the DPA you will sign is the public one. Larger customers can negotiate their own.
- The vendor's secure development practice and its record of fixing reported flaws, which NIS2 Art. 21(3) asks you to weigh.
- How long your data is kept after you leave, and how deletion is confirmed, beyond what the agreement says.
- Financial stability, insurance, and what happens to your data if the vendor is sold. The registry records ownership changes it sees, not the risk of one.
Some vendors have already answered a standard questionnaire, a CAIQ or a SIG, and offer it on request or publish it: see which vendors say so.
Using this list
Each vendor page in the registry answers the checks above for that vendor, with the source and the date each fact was read: start at the vendor list. Where a vendor publishes nothing for a check, the page says so rather than guessing, and that silence is itself something to raise with the vendor.