Publish a subprocessor list your customers can check
Notice Labs gives your trust center a Subprocessors tab: each vendor with its purpose and where it processes data. Add one by searching a library of 1,898 known vendors, or enter your own, and point your DPA at the page instead of an attachment. Visitors who subscribe with Notify me are emailed when you add, remove or change a vendor.
From £39 a month. No sales call.
A subprocessor list that lives in a PDF goes stale
Most data processing agreements promise to list subprocessors and to keep the list current. In practice the list is a table in the DPA itself, or a spreadsheet attached to an email, and it's only as accurate as the last time someone remembered to update it.
A customer's legal or security team checks this list against their own vendor register, and a reviewer filling in a security questionnaire looks for it by name. If it isn't a page they can open and compare against what you actually use, they ask you directly, or they assume the worst.
How it works
- 01
Search the library
Look up a vendor by name in a library of 1,898 known providers. Each match comes with its website, logo and usual purpose already filled in, so you're not typing out what AWS or Stripe do.
- 02
Set the processing regions
Choose where that vendor processes data, picking one or more: United States, European Union, United Kingdom, Canada, Australia or global. Add a vendor that isn't in the library by entering its name, site and purpose yourself.
- 03
Publish it
The list appears as a Subprocessors tab on your trust center, in the order you set. Turn the tab off if you don't want it public yet.
- 04
Update it as vendors change
Add, edit or remove an entry in the admin whenever your vendors change, and mark the trust center reviewed so its "Last reviewed" date reflects the update. Subscribers who confirmed their email are sent a short digest of the change in the next daily update.
Name, purpose and location, not a wall of text
Each row is a vendor, what you use it for, and where it processes data. A reviewer scans it the way they'd scan their own vendor register, rather than reading a paragraph in a DPA.
Manage the list from one page
The admin lists every subprocessor with its purpose and location. Reorder, edit or remove an entry, and the trust center updates the same way.
Customers hear about changes instead of rechecking
A visitor chooses Notify me, enters an email address and confirms it from the message they receive. After that, changes to your subprocessors arrive as one email a day, with an unsubscribe link in every message. Nothing is sent to an address that hasn't confirmed, and nothing is sent when nothing has changed.
What it doesn't do
Notice Labs doesn't discover your vendors for you, or check them against a contract or invoice. You choose what's on the list and set its purpose and region; the library just fills in the name, site, logo and a usual purpose so you don't have to write those out.
It isn't legal advice on which vendors count as subprocessors under your DPA. Most data processing agreements ask for a list you keep current and make available; check your own agreement for what it requires.
A subscriber is told that a vendor was added, updated or removed, and what it's used for. It isn't a change-approval or objection process: if your DPA gives customers a right to object to a new subprocessor, handle that in the contract.
Questions
Straight answers to what people ask before they set this up.
What should a subprocessor list include?
Most DPAs ask for at least the vendor's name and what it's used for; many also expect where it processes data. Notice Labs' Subprocessors tab covers all three: name, purpose and processing regions, for each vendor you add.
Where does the vendor information come from?
From a library of 1,898 known vendors: name, website, logo and a usual purpose. You still choose the processing regions and can edit the purpose, and you can add any vendor that isn't in the library by hand.
Can I link my DPA to this page instead of listing subprocessors in the contract?
Many DPAs already allow a linked, hosted list in place of a static schedule. Point the clause at your trust center's Subprocessors page and keep the page current instead of amending the contract each time a vendor changes.
Will customers be told when our subprocessors change?
Yes. Anyone who subscribes with Notify me and confirms by email gets an update when a vendor is added, removed or edited. The Subprocessors switch on the admin's Subscribers page turns this kind of update on or off, and it's on by default.
Can we turn the subprocessor list off?
Yes. Each section of a trust center, including Subprocessors, can be switched off in the admin.
Is this the same as the Notice Labs subprocessor library?
No. The library is a public lookup of 1,898 known vendors that Notice Labs maintains. Your subprocessor list is the subset you've added to your own trust center, each with the purpose and region you set.
Related reading
Publish a subprocessor list customers can check for themselves.
From £39 a month. No sales call.