📋 Vendor Trust Center Scraper: SOC 2, ISO 27001, Subprocessors

For vendor security reviews and third-party risk management: give it a list of vendors and get, for each one, its trust center or security page, the certifications and frameworks it states (with the exact sentence as evidence), its subprocessor list including AI providers, its DPA, status page and security contacts. One row per vendor.

• ✅ Evidence, not guesses: every certification comes with the page it was found on and the sentence around it, so you can check it in seconds
• ✅ Only the vendor's own security pages count: marketing pages and cookie banners are not read as claims
• ✅ Subprocessors parsed from the vendor's table, with purpose and location, and the vendor never listed as its own subprocessor
• ✅ AI subprocessors flagged (OpenAI, Anthropic, Cohere, Vertex AI and others)
• ✅ Trust platforms recognised: Vanta, SafeBase, Drata, Secureframe, Conveyor, Whistic, Sprinto, Thoropass, TrustCloud and more
• ✅ Unreachable and invalid vendors are free

What does it do?

For every vendor domain it:

1. Loads the home page, following redirects (so notion.so that redirects to notion.com is handled).
2. Finds the security or trust page: links such as /security, /trust or trust.vendor.com, then common paths if the home page does not link to one. Pages that turn out to be a home-page redirect or a "not found" page are rejected.
3. Finds the subprocessor list and the DPA, also on the trust, privacy and DPA pages, since that is where vendors usually link them.
4. Reads the certifications, security controls and contacts from those pages only, and the subprocessors from the vendor's own table.
5. Adds a transparency score for how much the vendor publishes, and plain-English findings.

Use cases

• 🛡️ Vendor onboarding and TPRM. Pre-fill the security section of a review before you send a questionnaire.
• 🔁 Annual re-reviews. Re-run your vendor list and compare certifications and subprocessors with last year.
• 🤖 AI-use reviews. Find which of your vendors send data to AI providers.
• 📊 GRC and procurement teams. A sortable table of who publishes what.
• 💼 Sales and market research for security vendors. Which companies use Vanta or Drata, and who has no trust center yet.

What data can you get?

Field	What it is
trustCenterUrl, trustCenterPlatform	The vendor's security or trust page, and the platform behind it if any
trustCenterNeedsBrowser	true when the trust center loads its content with JavaScript, so certifications on it may be missing
certifications	Frameworks stated on the security, trust, subprocessor or DPA pages, e.g. SOC 2 Type II, ISO 27001, HIPAA, FedRAMP
certificationEvidence	[{ certification, url, excerpt }]: where each one was found, and the text around it
securityControls	Controls described on the security page: encryption, SSO, SCIM, MFA, RBAC, penetration testing, bug bounty, audit logs, backups, data residency
subprocessors	[{ name, purpose, location, source }]. source is table when read from the vendor's table, mentions when only provider names were found on the page
subprocessorCount, subprocessorsUrl, subprocessorsNeedBrowser	How many, where the list is, and whether it loads with JavaScript
aiSubprocessors	AI providers among the subprocessors
dpaUrl, privacyPolicyUrl, statusPageUrl	Legal and status pages
securityContacts, securityTxtContacts	Security, privacy and compliance addresses from the pages, and contacts from the vendor's security.txt
transparencyScore	0–100, see below
findings	Plain-English notes such as "No public subprocessor list found"

How the transparency score works

It measures how much a vendor publishes, not how secure it is: security or trust page 25, a known trust platform 10, at least one stated certification 25, a public subprocessor list 15, a public DPA 10, a security contact on the pages 10, and a security.txt 5.

How to use it

1. Click Try for free (or Start) at the top of this page.
2. Paste vendor domains into Vendors, one per line.
3. Press Start, then download the results from the Output tab as Excel, CSV or JSON.

Input example

{
  "vendors": ["vercel.com", "linear.app", "datadoghq.com", "notion.so", "github.com"]
}

Output example

Shortened; real results from October 2026:

{
  "domain": "vercel.com",
  "status": "ok",
  "transparencyScore": 90,
  "trustCenterUrl": "https://vercel.com/security",
  "certifications": ["SOC 2 Type II", "SOC 1", "ISO 27001", "HIPAA", "FedRAMP", "PCI DSS", "GDPR", "CCPA / CPRA"],
  "certificationEvidence": [
    { "certification": "SOC 2 Type II", "url": "https://vercel.com/security", "excerpt": "…" }
  ],
  "subprocessorsUrl": "https://vercel.com/trust/subprocessors",
  "dpaUrl": "https://vercel.com/legal/dpa",
  "securityContacts": ["privacy@vercel.com"],
  "securityTxtContacts": ["https://hackerone.com/vercel", "mailto:responsible.disclosure@vercel.com"]
}

For datadoghq.com the subprocessor table gives 28 rows, each with name, purpose and location and "source": "table", and for github.com 26 subprocessors with "aiSubprocessors": ["Anthropic", "OpenAI"].

Statuses and errors

status	Meaning	Charged?
ok	The vendor was scanned. Check findings for what is missing	Yes
unreachable	The vendor's website could not be loaded over HTTPS	No
invalid_input	Not a domain, or a private or internal address	No

How much does it cost?

You pay per vendor scanned. Unreachable and invalid vendors are free, and platform usage is included.

Vendors	Price on the Free and Bronze tiers
10	$0.10
100	$1.00
1,000	$10.00

FAQ

Does a listed certification mean the vendor is certified?

It means the vendor states it on its own security, trust, subprocessor or DPA pages. That is the starting point of a review, not proof: ask for the report or certificate itself. certificationEvidence shows exactly what was said and where.

Why are some certifications or subprocessors missing?

Many trust portals (Vanta, SafeBase and others) and some subprocessor pages load their content with JavaScript after the page opens. This tool reads the page the server sends, which keeps it fast and cheap, so it can miss content loaded later. When that happens, trustCenterNeedsBrowser or subprocessorsNeedBrowser is true and the URL is still returned for you to open.

Does it log in or request reports?

No. It only reads public pages and never requests NDA-gated documents.

Can I use it through the API or from an AI agent?

Yes:

curl -X POST "https://api.apify.com/v2/acts/optimistical_lectern~vendor-trust-center-scraper/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"vendors": ["vercel.com", "linear.app"]}'

From Python: ApifyClient("YOUR_APIFY_TOKEN").actor("optimistical_lectern/vendor-trust-center-scraper").call(run_input={"vendors": ["vercel.com"]}). AI agents can use it through Apify's MCP server at mcp.apify.com. It runs with limited permissions.

Something looks wrong?

Open an issue on the Issues tab with the vendor domain. Every report is read.

Related tools

• 🛡️ Website Tech Stack & Security Audit: SSL, security headers and tech stack for the same vendors
• 🌐 Domain WHOIS, DNS & Email Security: domain age, mail provider, SPF and DMARC