For DPO, vCISO and GRC firms
Your clients' vendors' vendors, checked and watched for you
A concierge pilot for fractional DPO, vCISO and GRC firms. We map each client's vendor chain to tier 3, flag AI subprocessors, and alert you when a list changes. From EUR 300 per month.
The problem
Every client has a chain. Nobody watches tier 3.
Each of your clients signs with a handful of SaaS vendors. Each vendor publishes a subprocessor list, and those lists change, often to add an AI provider. The subprocessors have subprocessors of their own.
Vendor notices, where they arrive at all, go to the client, cover one tier, and often land in a shared inbox. Keeping that up for every client, by hand, is the part of the job that doesn't scale.
Why now
Regulators now expect the whole chain
- GDPR / EDPB: Opinion 22/2024 says controllers should have "the information on the identity (i.e. name, address, contact person) of all processors, sub-processors etc. readily available at all times". EDPB, October 2024
- DORA: the register of information asks financial entities to record ICT subcontracting chains by rank. The free Third Party Index export is a useful start, and it says plainly: "Ranks 1 and 2 only." source
- AI providers: vendors keep adding model providers and inference hosts to their lists. Your clients will ask whether that touches their data.
What's included
What we do for you each month
- Map each client's chain to tier 3. You send each client's vendor list; we build the chain from the vendors' own published lists.
- Check every row. Each entry is checked against the vendor's own list and carries an evidence link and the date we checked it. Rows we couldn't verify are marked as such.
- Flag AI subprocessors. Model providers, inference hosts and AI agent services are flagged, with the vendor's own purpose wording.
- Monitor and alert. We monitor your clients' vendor chains and alert you by email when a list changes: what changed, which clients it touches, and the evidence link.
- Keep clients separate. Each client's chain is kept separately, so you can hand one client's file over without touching another's.
How it's delivered
Done by hand, on purpose
The pilot is a concierge service. Mapping, checking and alerts are done by our team and sent by email. There's no self-serve app yet. We'd rather learn how your firm actually delivers vendor reviews before we build one, and pilot firms shape what comes next.
Where Third Party Index fits
Built on a free index, plus the checking it leaves to you
Third Party Index is a free public index of declared subprocessor lists, licensed CC BY 4.0. We use some of its data, with credit. Its rows are candidates, and its DORA export says "Check each row against the vendor's list before it goes in a register." source The pilot is that checking, plus tier 3, AI flags and alerts, for every client you bring.
| Free index | What the pilot adds |
|---|---|
| Declared lists. Rows are candidates to check. DORA export ranks 1 and 2 only. | Tier 3, each row checked, AI flags, and email alerts, kept per client. |
Example of a change note: it names the vendor, the subprocessor that was added, the date, and a source link. Live additions are listed on the AI subprocessor tracker.
Price
From EUR 300 a month
The pilot is from EUR 300 a month, exact figure agreed by email, based on how many clients and vendors you want covered. It never goes above EUR 400 a month.
Month to month, prepaid monthly via the Pay button (invoice until card payment is live, then card via a Stripe link), VAT added where applicable. Cancel any time before the next billing date; no lock-in.
Opens a short invoice request. The exact figure is agreed by email before the first invoice, and never goes above EUR 400 a month.
Not ready for a monthly pilot? Try us on one client with the one-off $490 Vendor Chain Audit (up to 25 direct vendors). Monitoring is a separate $99/month for up to 100 vendors.
FAQ
What is the subprocessors.fyi concierge pilot?
It is a monthly service for fractional DPO, vCISO and GRC firms that manage vendors for several clients. From EUR 300 per month (never more than EUR 400), subprocessors.fyi maps each client's vendors to tier 3 by hand, checks rows against the vendors' published lists, flags AI subprocessors, monitors your clients' vendor chains and alerts you by email when a list changes.
Is the pilot self-serve software?
No. During the pilot, mapping, monitoring and alerts are done by hand by the subprocessors.fyi team and sent by email. There is no self-serve app or integration yet. Each client's chain is kept separately, and what pilot firms find useful decides what we build next.
How is the pilot price set?
The pilot is from EUR 300 a month, exact figure agreed by email, based on how many clients and vendors you want covered. It is capped at EUR 400 per month.
What are the pilot terms?
The pilot is month to month and prepaid monthly: by invoice (request one with the Pay button), or by card via a Stripe link once card payment is live, with VAT added where applicable. You can cancel any time before the next billing date, and there is no lock-in.
Can we use the output in client files?
Yes. Each chain map and change note links to the vendor's own published list as evidence, with the date it was checked, so you can put it in a client file or hand it to an auditor. Where Third Party Index data is used, its credit line goes with it, as its CC BY 4.0 licence requires.
Why do DPO firms need to look beyond tier 1?
EDPB Opinion 22/2024 says controllers should have the identity (name, address, contact person) of all processors and sub-processors readily available at all times, regardless of the risk of the processing. For a DPO firm, that means each client's whole chain, not just the vendors the client signed with.
Should we start with the pilot or a single audit?
If you manage vendors for several clients and want ongoing alerts, start with the pilot. If you want to try us on one client first, the one-off $490 USD Vendor Chain Audit (up to 25 direct vendors) is the smaller step. Monitoring for that client would then be a separate $99 USD per month.
See whether it fits how your firm works
Tell us in writing how you work with clients. We reply by plain-text email.
Request an invoice
Card payment isn't live yet, so we invoice you. We reply by plain-text email from founders@subprocessors.fyi.
No payment is taken on this page. We use these details only to invoice you. See our privacy notice.
Some public data on this site comes from Third Party Index, licensed CC BY 4.0. We add our own checks and AI flags. Third Party Index does not endorse subprocessors.fyi.