SiteVerdict — Subprocessor List Monitor (GDPR / DPA)

Know the day a vendor adds a new subprocessor, moves your data to a new country, or quietly renames one — before your DPA objection window closes.

Paste the subprocessor-list URLs your SaaS vendors publish (Atlassian, GitHub, your CRM, your payroll tool…). Schedule this Actor weekly. The first run stores a baseline; every later run tells you exactly what changed, flags new transfers outside the EEA / UK / adequacy countries, and can ping Slack or any webhook with a DPO-ready message.

Not legal advice. Parsing is heuristic and transfer classifications are indicative. Always verify against the vendor's official notice and your DPA.

What you get

For every vendor list, each run:

1. Fetches the page politely (honest user agent, robots.txt respected, 1.5 s spacing per host, no bot-protection bypass).
2. Parses the list — HTML tables (any header wording: "Sub-processor", "Entity name", "Third party", "Location of processing", "Purpose", …), tables with rowspan/colspan and section rows, responsive tables that repeat labels in each cell, bullet lists ("Name – purpose – location"), definition lists, JSON exports and CSV exports.
3. Normalises names (Twilio Inc. = TWILIO, INC) and locations (USA, U.S., Northern Virginia, Frankfurt, EEA (Sweden, Ireland) → ISO codes) and classifies each country: EEA, UK, adequacy decision, US — check DPF certification, third country.
4. Compares with the previous snapshot and reports:
   • added and removed subprocessors,
   • likely renames (same website domain or near-identical name — not reported as add + remove),
   • location changes (countries added / removed),
   • purpose changes,
   • new third-country transfers (new subprocessor or new location outside EEA / UK / adequate countries).
5. Never fakes a clean result: if a page can't be parsed, is blocked, or the list suddenly disappears, you get a parse-empty / blocked / error row with a clear warning — the stored baseline is kept.

Use cases

1. DPO / privacy team — monitor all vendors in your Record of Processing Activities; respond to new subprocessors inside the contractual objection period.
2. Procurement & vendor-risk — keep an always-current inventory of fourth parties and where they process data (ENTRIES.csv).
3. Consultancies / agencies — run one monitor per client (stateStoreName) and forward Slack/webhook alerts.

Before / after (sample mode output)

Run 1 (baseline) — Acme Analytics lists AWS (Ireland), Cloudy Hosting GmbH (Germany), OldMail Ltd (UK), Stripe (Ireland). Run 2 — the Actor reports:

{
  "vendor": "Acme Analytics (sample)",
  "status": "changed",
  "added": ["Nimbus AI Labs Pvt Ltd"],
  "removed": ["OldMail Ltd"],
  "locationChanges": [{ "name": "Cloudy Hosting GmbH", "from": "Germany", "to": "Germany, United States", "countriesAdded": ["US"], "countriesRemoved": [] }],
  "newThirdCountryTransfers": [
    { "name": "Nimbus AI Labs Pvt Ltd", "country": "IN", "classification": "third-country", "note": "Third country: SCCs / IDTA / other safeguard needed", "reason": "new-subprocessor" },
    { "name": "Cloudy Hosting GmbH", "country": "US", "classification": "US-DPF-check", "note": "US: check EU-US DPF / UK Extension certification, otherwise SCCs / IDTA needed", "reason": "new-location" }
  ]
}

Slack message: "SiteVerdict: subprocessor list changed — Acme Analytics: 1 added (Nimbus AI Labs Pvt Ltd); 1 removed (OldMail Ltd); 1 location change(s); 2 new transfer(s) outside the EEA/UK/adequate countries … Reminder: check your DPA's objection period."

Try it free: enable Sample mode (no network, nothing charged).

Input example

{
  "targets": [
    { "url": "https://www.atlassian.com/legal/sub-processors", "vendor": "Atlassian" },
    { "url": "https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors", "vendor": "GitHub" },
    { "url": "https://vendor.example/subprocessors.json", "vendor": "Vendor X" },
    { "url": "https://vendor.example/trust", "vendor": "Vendor Y", "selector": "#subprocessors table" }
  ],
  "stateStoreName": "client-acme",
  "slackWebhookUrl": "https://hooks.slack.com/services/…",
  "onlyChanged": true
}

Then create a Schedule in Apify Console (weekly is typical).

Output

• Dataset (one row per vendor list) with views Overview, Changes (one row per change) and Entries (full lists, when includeEntries is on).
• Key-value store:
  • REPORT — HTML report for the run,
  • SUMMARY — agent-ready JSON (changed vendors, problems, disclaimer),
  • CHANGES.csv, ENTRIES.csv,
  • HISTORY-<vendor> — last N checks with their changes.
• The named store (stateStoreName) keeps the latest snapshot per vendor between runs.

Statuses: baseline, unchanged, changed, parse-empty, blocked, robots-disallowed, error.

Alerts and the optional AI note

• Webhook (JSON) and Slack incoming webhook. HTTPS only; both are secret inputs, never logged or written to the dataset. Optional alerts when a list cannot be checked (alertOnErrors).
• AI impact note (off by default): with your own Anthropic or OpenAI key, each changed vendor gets a short DPO note (what changed, what to ask the vendor). The page content is passed as data with instructions to ignore any instructions inside it. Your provider bills the tokens; we charge the ai-summary event only when a note is produced.

Pricing (pay per event)

Event	When	Price
list-checked	a vendor list was fetched and parsed (baseline, unchanged or changed)	$0.01
change-alert	a vendor list changed (once per vendor per run)	$0.03
ai-summary	an AI impact note was produced with your own key	$0.02

Errors, blocked pages, robots-disallowed pages, unparseable pages and sample mode are never charged. Examples: 50 vendors checked weekly ≈ $2.15/month + $0.03 per actual change; 200 vendors monthly ≈ $2/month. The run stops cleanly at your "max total charge".

FAQ

The vendor's list is a PDF. Not supported yet — the row says so (not charged). Ask the vendor for an HTML/JSON/CSV copy or a trust-centre page.

The page uses cards / divs, not a table. Set selector to the element that wraps the list. If nothing can be parsed you get parse-empty with a hint — never a false "no subprocessors".

The page is behind a login, bot protection or robots.txt disallows it. We do not bypass any of these. You get blocked / robots-disallowed (not charged).

Does it understand subscription e-mails ("we're adding a new subprocessor in 30 days")? No — it monitors the published list. Many vendors update the list at the start of the notice period.

Is the US an "adequate" country? Only organisations certified under the EU-US Data Privacy Framework (and the UK Extension). The Actor flags US locations as "check DPF certification" — it does not look certification up.

Limits

• Max 200 lists per run, 8 MB per page, 2,000 entries per list.
• No JavaScript rendering: lists injected by client-side JavaScript after load may parse as empty (you'll be told). Most vendors publish server-rendered lists or JSON.
• Country detection uses names, ISO codes, common data-centre cities and US states; unusual wording may be missed (the raw location text is always kept).
• Rename detection is a heuristic (same website domain or ≥ 82 % name similarity).

Sources & compliance

• Sources: only the public pages / files whose URLs you supply. Checked 11 Oct 2026: robots.txt is fetched and obeyed for every URL and redirect (RFC 9309); requests carry the user agent SiteVerdict/subprocessor-list-monitor (+aman.thakran@bharatfare.com); at least 1.5 s between requests to the same host; no proxies, no fingerprinting, no CAPTCHA or login bypass. Respect each vendor's website terms for your use.
• Security: user-supplied URLs are checked against private, loopback, link-local and cloud-metadata addresses on every hop and at connect time (SSRF guard); response size and time limits apply; secrets are masked from logs and output.
• Personal data (UK GDPR / PECR): subprocessor lists name companies. Contact columns and e-mail addresses are removed by default (includeContactDetails off). If you enable them, you are the controller for that data; keep a lawful basis and minimise retention. The Actor sends no marketing messages.
• Adequacy reference (EU Commission decisions, as checked 11 Oct 2026): Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay, and the US for DPF-certified organisations only. Decisions change; verify before relying on them.
• Disclaimer: technical monitoring information only, not legal advice; no warranty that a vendor's list is complete or that a transfer is lawful.

Built by SiteVerdict (BharatFare Travel and Technologies Ltd, UK). Questions: aman.thakran@bharatfare.com.