A monitoring workflow built around GDPR vendor accountability

Identify the SaaS vendors and subprocessors that handle your customer data — including the ones that were never reviewed.

Why it matters:

Most GDPR vendor gaps come from tools introduced outside procurement. Discovery surfaces them.

Output:

A consolidated, taggable vendor inventory.

Track each vendor's published subprocessor list and detect additions, removals, and region changes.

Why it matters:

Article 28(2) requires controllers to be informed of subprocessor changes. Monitoring makes that record continuous.

Output:

A vendor-by-vendor change history with snapshots.

Diff vendor pages, DPAs, and trust portals on a recurring cadence and classify what changed.

Why it matters:

Manual review of public pages does not scale past a handful of vendors.

Output:

A structured diff per change, attached to the vendor.

Every detected change becomes a date-stamped evidence record with the source URL, snapshot, and classification.

Why it matters:

Auditors and customers ask 'how do you know?' — the timeline answers it.

Output:

Export-ready CSV / PDF evidence bundles.

Each vendor and change carries a severity reflecting change type, geography, and trust signals.

Why it matters:

Compliance teams need to know what to look at first, not just what changed.

Output:

Risk-ranked review queue.

Route alerts to the right reviewer, assign owners, and close out with a decision.

Why it matters:

Notifications without a workflow turn into noise. Decisions need a place to live.

Output:

Assigned, status-tracked alerts.

Generate evidence reports filtered by vendor, severity, time window, or change type.

Why it matters:

Vendor review cycles and external audits both need point-in-time exports.

Output:

CSV / PDF reports with source links.

Invite teammates, scope access, manage workspace settings, and rotate API keys.

Why it matters:

Privacy work is collaborative. Access needs to follow the org chart.

Output:

Workspace with role-scoped access.

Workflows and evidence records aligned with controller / processor accountability obligations.

Why it matters:

Article 28 is the legal frame the product is built around — not a checkbox.

Output:

Article 28-aligned evidence trail.

Run a one-shot scan against your top vendors before committing to a plan.

Why it matters:

You should see real findings before you pay for monitoring.

Output:

A report you keep regardless of plan choice.