# Vendor Trust Center Scraper - SOC 2, ISO 27001, Subprocessors (`optimistical_lectern/vendor-trust-center-scraper`) Actor

For vendor security reviews: find each vendor's trust center or security page, the certifications it states (SOC 2, ISO 27001, HIPAA, FedRAMP...) with the exact text as evidence, its subprocessor list including AI providers, DPA, status page and security contacts.

- **URL**: https://apify.com/optimistical_lectern/vendor-trust-center-scraper.md
- **Developed by:** [Ivan Honer](https://apify.com/optimistical_lectern) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $7.50 / 1,000 vendors

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## 📋 Vendor Trust Center Scraper: SOC 2, ISO 27001, Subprocessors

For **vendor security reviews and third-party risk management**: give it a list of vendors and get, for each one, its **trust center or security page**, the **certifications and frameworks it states** (with the exact sentence as evidence), its **subprocessor list** including **AI providers**, its **DPA**, status page and security contacts. One row per vendor.

- ✅ **Evidence, not guesses**: every certification comes with the page it was found on and the sentence around it, so you can check it in seconds
- ✅ **Only the vendor's own security pages count**: marketing pages and cookie banners are not read as claims
- ✅ **Subprocessors parsed from the vendor's table**, with purpose and location, and the vendor never listed as its own subprocessor
- ✅ **AI subprocessors flagged** (OpenAI, Anthropic, Cohere, Vertex AI and others)
- ✅ **Trust platforms recognised**: Vanta, SafeBase, Drata, Secureframe, Conveyor, Whistic, Sprinto, Thoropass, TrustCloud and more
- ✅ **Unreachable and invalid vendors are free**

### What does it do?

For every vendor domain it:

1. Loads the home page, following redirects (so `notion.so` that redirects to `notion.com` is handled).
2. Finds the security or trust page: links such as `/security`, `/trust` or `trust.vendor.com`, then common paths if the home page does not link to one. Pages that turn out to be a home-page redirect or a "not found" page are rejected.
3. Finds the subprocessor list and the DPA, also on the trust, privacy and DPA pages, since that is where vendors usually link them.
4. Reads the certifications, security controls and contacts from those pages only, and the subprocessors from the vendor's own table.
5. Adds a **transparency score** for how much the vendor publishes, and plain-English findings.

### Use cases

- 🛡️ **Vendor onboarding and TPRM.** Pre-fill the security section of a review before you send a questionnaire.
- 🔁 **Annual re-reviews.** Re-run your vendor list and compare certifications and subprocessors with last year.
- 🤖 **AI-use reviews.** Find which of your vendors send data to AI providers.
- 📊 **GRC and procurement teams.** A sortable table of who publishes what.
- 💼 **Sales and market research for security vendors.** Which companies use Vanta or Drata, and who has no trust center yet.

### What data can you get?

| Field | What it is |
|---|---|
| `trustCenterUrl`, `trustCenterPlatform` | The vendor's security or trust page, and the platform behind it if any |
| `trustCenterNeedsBrowser` | `true` when the trust center loads its content with JavaScript, so certifications on it may be missing |
| `certifications` | Frameworks stated on the security, trust, subprocessor or DPA pages, e.g. `SOC 2 Type II`, `ISO 27001`, `HIPAA`, `FedRAMP` |
| `certificationEvidence` | `[{ certification, url, excerpt }]`: where each one was found, and the text around it |
| `securityControls` | Controls described on the security page: encryption, SSO, SCIM, MFA, RBAC, penetration testing, bug bounty, audit logs, backups, data residency |
| `subprocessors` | `[{ name, purpose, location, source }]`. `source` is `table` when read from the vendor's table, `mentions` when only provider names were found on the page |
| `subprocessorCount`, `subprocessorsUrl`, `subprocessorsNeedBrowser` | How many, where the list is, and whether it loads with JavaScript |
| `aiSubprocessors` | AI providers among the subprocessors |
| `dpaUrl`, `privacyPolicyUrl`, `statusPageUrl` | Legal and status pages |
| `securityContacts`, `securityTxtContacts` | Security, privacy and compliance addresses from the pages, and contacts from the vendor's `security.txt` |
| `transparencyScore` | 0–100, see below |
| `findings` | Plain-English notes such as "No public subprocessor list found" |

### How the transparency score works

It measures how much a vendor **publishes**, not how secure it is: security or trust page 25, a known trust platform 10, at least one stated certification 25, a public subprocessor list 15, a public DPA 10, a security contact on the pages 10, and a `security.txt` 5.

### How to use it

1. Click **Try for free** (or **Start**) at the top of this page.
2. Paste vendor domains into **Vendors**, one per line.
3. Press **Start**, then download the results from the **Output** tab as Excel, CSV or JSON.

### Input example

```json
{
  "vendors": ["vercel.com", "linear.app", "datadoghq.com", "notion.so", "github.com"]
}
```

### Output example

Shortened; real results from October 2026:

```json
{
  "domain": "vercel.com",
  "status": "ok",
  "transparencyScore": 90,
  "trustCenterUrl": "https://vercel.com/security",
  "certifications": ["SOC 2 Type II", "SOC 1", "ISO 27001", "HIPAA", "FedRAMP", "PCI DSS", "GDPR", "CCPA / CPRA"],
  "certificationEvidence": [
    { "certification": "SOC 2 Type II", "url": "https://vercel.com/security", "excerpt": "…" }
  ],
  "subprocessorsUrl": "https://vercel.com/trust/subprocessors",
  "dpaUrl": "https://vercel.com/legal/dpa",
  "securityContacts": ["privacy@vercel.com"],
  "securityTxtContacts": ["https://hackerone.com/vercel", "mailto:responsible.disclosure@vercel.com"]
}
```

For datadoghq.com the subprocessor table gives 28 rows, each with name, purpose and location and `"source": "table"`, and for github.com 26 subprocessors with `"aiSubprocessors": ["Anthropic", "OpenAI"]`.

### Statuses and errors

| `status` | Meaning | Charged? |
|---|---|---|
| `ok` | The vendor was scanned. Check `findings` for what is missing | Yes |
| `unreachable` | The vendor's website could not be loaded over HTTPS | No |
| `invalid_input` | Not a domain, or a private or internal address | No |

### How much does it cost?

You pay per vendor scanned. Unreachable and invalid vendors are free, and platform usage is included.

| Vendors | Price on the Free and Bronze tiers |
|---|---|
| 10 | $0.10 |
| 100 | $1.00 |
| 1,000 | $10.00 |

### FAQ

#### Does a listed certification mean the vendor is certified?

It means the vendor **states** it on its own security, trust, subprocessor or DPA pages. That is the starting point of a review, not proof: ask for the report or certificate itself. `certificationEvidence` shows exactly what was said and where.

#### Why are some certifications or subprocessors missing?

Many trust portals (Vanta, SafeBase and others) and some subprocessor pages load their content with JavaScript after the page opens. This tool reads the page the server sends, which keeps it fast and cheap, so it can miss content loaded later. When that happens, `trustCenterNeedsBrowser` or `subprocessorsNeedBrowser` is `true` and the URL is still returned for you to open.

#### Does it log in or request reports?

No. It only reads public pages and never requests NDA-gated documents.

#### Can I use it through the API or from an AI agent?

Yes:

```bash
curl -X POST "https://api.apify.com/v2/acts/optimistical_lectern~vendor-trust-center-scraper/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"vendors": ["vercel.com", "linear.app"]}'
```

From Python: `ApifyClient("YOUR_APIFY_TOKEN").actor("optimistical_lectern/vendor-trust-center-scraper").call(run_input={"vendors": ["vercel.com"]})`. AI agents can use it through Apify's MCP server at `mcp.apify.com`. It runs with limited permissions.

#### Something looks wrong?

Open an issue on the **Issues** tab with the vendor domain. Every report is read.

### Related tools

- [🛡️ Website Tech Stack & Security Audit](https://apify.com/optimistical_lectern/website-security-compliance-auditor): SSL, security headers and tech stack for the same vendors
- [🌐 Domain WHOIS, DNS & Email Security](https://apify.com/optimistical_lectern/domain-whois-dns-lookup): domain age, mail provider, SPF and DMARC

# Actor input Schema

## `vendors` (type: `array`):

Vendor domains, one per line, e.g. vercel.com. URLs and email addresses work too.

## `probeTrustSubdomains` (type: `boolean`):

Checks trust.<vendor>, security.<vendor> and status.<vendor> when the home page does not link to them.

## `maxConcurrency` (type: `integer`):

How many vendors to scan at the same time.

## `timeoutSecs` (type: `integer`):

Give up on a page after this long.

## Actor input object example

```json
{
  "vendors": [
    "vercel.com",
    "linear.app",
    "datadoghq.com"
  ],
  "probeTrustSubdomains": true,
  "maxConcurrency": 8,
  "timeoutSecs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

One item per vendor.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "vendors": [
        "vercel.com",
        "linear.app",
        "datadoghq.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("optimistical_lectern/vendor-trust-center-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "vendors": [
        "vercel.com",
        "linear.app",
        "datadoghq.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("optimistical_lectern/vendor-trust-center-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "vendors": [
    "vercel.com",
    "linear.app",
    "datadoghq.com"
  ]
}' |
apify call optimistical_lectern/vendor-trust-center-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,optimistical_lectern/vendor-trust-center-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/21N5Dby92TGPDqKNQ/builds/kftyBjvg7FYPAFtUg/openapi.json