Trust Center & Subprocessor Change Monitor API

What you get: one row per vendor with a baseline (first run) or a diff (later runs) of its trust center, subprocessor list, DPA or security pages: page-by-page status and line counts, what changed, a severity, actionNeeded, and recommended actions.

Sample output from a real run (2026-10-18, 3 vendors, first run = baseline, 3 rows):

vendorName	pages monitored	page status	lines captured	severity	actionNeeded
Atlassian	subprocessor list	initial	900	info	false
Stripe	subprocessor list	initial	866	info	false
Okta	trust center + subprocessor list	initial, initial	47 + 2	info	false

That run was 3 vendor rows × $0.01 = $0.03 (there is no separate start fee). Re-runs with the same snapshotKey report added / removed lines per page; with the default datasetMode: changes_only unchanged vendors write no row. Pages that only render with JavaScript (Okta's list above: 2 lines) give a thin baseline — check lineCount on the first run.

Open Input (leave defaults → Start) Paid first-run JSON ≈ USD 0.01/row (1 vendor + 1 bounded change check). Keep reports, exports, and movement options bounded for the first run. Open Console Input (deep link above) and run this JSON.

{
  "vendors": [
    {
      "id": "okta",
      "name": "Okta",
      "criticality": "high",
      "owner": "Security / Legal",
      "tags": [
        "iam"
      ],
      "subprocessorsUrl": "https://www.okta.com/trust/subprocessors/",
      "trustCenterUrl": "https://trust.okta.com/"
    }
  ],
  "maxChars": 5000,
  "summaryMaxLines": 5,
  "diffMode": "line_summary",
  "datasetMode": "all",
  "notifyOnNoChange": false,
  "requestTimeoutSeconds": 15,
  "concurrency": 1,
  "batchDelayMs": 0,
  "delivery": "dataset",
  "webhookUrl": "",
  "snapshotKey": "trust-center-p",
  "dryRun": false
}

Paste vendor and Start.

Streamline your security operations by utilizing this advanced web scraper to systematically track vendor trust centers, subprocessor lists, and Data Processing Agreements. Instead of manually checking third-party privacy portals, security operations and engineering teams can schedule recurring monitoring runs to extract policy updates and structural changes instantly. The crawler evaluates target websites and compiles a comprehensive, severity-scored JSON digest that seamlessly integrates into your existing security dashboards or internal databases.

Whether you need to maintain an up-to-date vendor inventory or monitor critical infrastructure partners for newly added subprocessors, this tool provides the exact structured data required. The output is purpose-built for automation workflows, delivering clean JSON objects with explicit fields for easy parsing. By evaluating the changedSinceLastRun boolean, your system can immediately detect modifications. You can then parse the actionNeeded and recommendedActions arrays to automatically generate Jira tickets or Slack alerts for your security team. Additionally, the tool provides complete pageSummaries and historical evidence logs, ensuring you have a reliable, automated pipeline for tracking altered privacy terms and third-party risk across your entire vendor ecosystem.

Store Quickstart

Run this actor with your target input. Results appear in the Apify Dataset and can be piped to webhooks for real-time delivery. Use dryRun to validate before committing to a schedule.

Use with Apify MCP

Exact actor: taroyamada/trust-center-subprocessor-monitor

Sample input JSON:

{
  "vendors": [
    {
      "id": "okta",
      "name": "Okta",
      "criticality": "high",
      "owner": "Security / Legal",
      "tags": [
        "iam",
        "renewal-q4",
        "sso"
      ],
      "subprocessorsUrl": "https://www.okta.com/trust/subprocessors/",
      "trustCenterUrl": "https://trust.okta.com/"
    }
  ],
  "requestTimeoutSeconds": 30,
  "maxChars": 40000,
  "delivery": "dataset",
  "datasetMode": "changes_only",
  "notifyOnNoChange": false,
  "snapshotKey": "trust-center-quickstart",
  "diffMode": "line_summary",
  "summaryMaxLines": 15,
  "concurrency": 2,
  "batchDelayMs": 500
}

Key Features

• 🛡️ Compliance-first — Produces audit-ready reports mapping findings to standards (WCAG, GDPR, SOC2)
• 🔒 Non-invasive scanning — Uses only observable public signals — no intrusive probing
• 📊 Severity-scored output — Each finding rated for criticality with remediation guidance
• 📡 Delta-alerting — Flag new findings since last run via webhook delivery
• 📋 Evidence export — Raw headers/responses captured for compliance documentation

Use Cases

Who	Why
Developers	Automate recurring data fetches without building custom scrapers
Data teams	Pipe structured output into analytics warehouses
Ops teams	Monitor changes via webhook alerts
Product managers	Track competitor/market signals without engineering time

Input

Field	Type	Default	Description
vendors	array	prefilled	Each vendor can use shorthand fields (trustCenterUrl, subprocessorsUrl, securityUrl, dpaUrl) or a full urlPacks object.
requestTimeoutSeconds	integer	30	HTTP request timeout per page.
userAgent	string	—	Optional User-Agent header override.
maxChars	integer	40000	Upper bound on extracted text length per page.
delivery	string	"dataset"	dataset: Apify Dataset (default). webhook: POST to webhookUrl.
datasetMode	string	"changes_only"	changes_only: changed + initial + error rows. action_needed: only vendors requiring follow-up. all: every vendor regardl
webhookUrl	string	—	Required when delivery is webhook.
notifyOnNoChange	boolean	false	When false, webhook delivery is skipped if no vendors changed and no action is needed.

Input Example

{
  "vendors": [
    {
      "id": "okta",
      "name": "Okta",
      "criticality": "high",
      "owner": "Security / Legal",
      "tags": [
        "iam",
        "renewal-q4"
      ],
      "subprocessorsUrl": "https://www.okta.com/trust/subprocessors/",
      "trustCenterUrl": "https://trust.okta.com/"
    }
  ],
  "requestTimeoutSeconds": 30,
  "maxChars": 40000,
  "delivery": "dataset",
  "datasetMode": "changes_only",
  "notifyOnNoChange": false,
  "snapshotKey": "trust-center-subprocessor-monitor-snapshots",
  "diffMode": "line_summary",
  "summaryMaxLines": 15,
  "concurrency": 3,
  "batchDelayMs": 500,
  "dryRun": false
}

Input Examples

Example: Single vendor subprocessor list

{
  "vendors": [
    {
      "id": "atlassian",
      "name": "Atlassian",
      "criticality": "high",
      "owner": "Security / Legal",
      "subprocessorsUrl": "https://www.atlassian.com/legal/sub-processors"
    }
  ]
}

Example: Bulk vendor audit

{
  "vendors": [
    {
      "id": "atlassian",
      "name": "Atlassian",
      "criticality": "high",
      "owner": "Security / Legal",
      "subprocessorsUrl": "https://www.atlassian.com/legal/sub-processors"
    },
    {
      "id": "stripe",
      "name": "Stripe",
      "criticality": "high",
      "owner": "Security / Legal",
      "subprocessorsUrl": "https://stripe.com/legal/service-providers"
    }
  ],
  "datasetMode": "all"
}

Example: Recurring watch with its own snapshot

{
  "vendors": [
    {
      "id": "stripe",
      "name": "Stripe",
      "criticality": "high",
      "owner": "Security / Legal",
      "subprocessorsUrl": "https://stripe.com/legal/service-providers"
    }
  ],
  "snapshotKey": "stripe-subprocessors",
  "datasetMode": "changes_only"
}

Output

One dataset row per vendor (with the default datasetMode: changes_only, only vendors that are new, changed or errored).

Field	Type	Description
vendorId / vendorName	string	Vendor you configured
criticality / owner / tags	string / string / string[]	Copied from your vendor entry
status	string	initial, changed, unchanged, partial or error
severity	string	critical, high, watch or info
actionNeeded	boolean	Whether someone should review this vendor
changedSinceLastRun	boolean	Any monitored page changed
reason / executiveSummary	string	Plain-English summary
recommendedActions	string[]	Next steps
changedPacks	string[]	Which page groups changed (subprocessors, dpa, …)
pageSummaries	object[]	Per page: pack, status, url, lineCount, preview, brief and the diff summary
vendorSummary	object	Page counts: monitored, changed, initial, unchanged, error
checkedAt	timestamp	When the check ran

Output Example

Row from the real run above (page preview omitted):

{
  "vendorId": "atlassian",
  "vendorName": "Atlassian",
  "criticality": "standard",
  "owner": "Security / Legal",
  "tags": [
    "devtools"
  ],
  "status": "initial",
  "severity": "info",
  "actionNeeded": false,
  "changedSinceLastRun": false,
  "reason": "First run for Atlassian: baseline captured across 1 page(s). Re-run to detect changes.",
  "executiveSummary": "Atlassian: initial baseline captured. Schedule recurring runs to start tracking drift.",
  "recommendedActions": [
    "Verify baseline looks correct before scheduling recurring runs."
  ],
  "changedPacks": [],
  "pageSummaries": [
    {
      "pageId": "atlassian-subprocessors-www-atlassian-com-legal-sub-processors",
      "pack": "subprocessors",
      "status": "initial",
      "url": "https://www.atlassian.com/legal/sub-processors",
      "lineCount": 900,
      "brief": "subprocessor list: baseline captured (900 lines)"
    }
  ],
  "vendorSummary": {
    "monitoredPageCount": 1,
    "changedPageCount": 0,
    "initialPageCount": 1,
    "unchangedPageCount": 0,
    "errorPageCount": 0,
    "changedPacks": [],
    "actionNeeded": false
  },
  "checkedAt": "2026-10-18T12:02:01.149Z",
  "error": null
}

API Usage

Run this actor programmatically using the Apify API. Replace YOUR_API_TOKEN with your token from Apify Console → Settings → Integrations.

cURL

curl -X POST "https://api.apify.com/v2/acts/taroyamada~trust-center-subprocessor-monitor/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "vendors": [ { "id": "okta", "name": "Okta", "criticality": "high", "owner": "Security / Legal", "tags": [ "iam", "renewal-q4" ], "subprocessorsUrl": "https://www.okta.com/trust/subprocessors/", "trustCenterUrl": "https://trust.okta.com/" } ], "requestTimeoutSeconds": 30, "maxChars": 40000, "delivery": "dataset", "datasetMode": "changes_only", "notifyOnNoChange": false, "snapshotKey": "trust-center-subprocessor-monitor-snapshots", "diffMode": "line_summary", "summaryMaxLines": 15, "concurrency": 3, "batchDelayMs": 500, "dryRun": false }'

Python

from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")
run = client.actor("taroyamada/trust-center-subprocessor-monitor").call(run_input={
  "vendors": [
    {
      "id": "okta",
      "name": "Okta",
      "criticality": "high",
      "owner": "Security / Legal",
      "tags": [
        "iam",
        "renewal-q4"
      ],
      "subprocessorsUrl": "https://www.okta.com/trust/subprocessors/",
      "trustCenterUrl": "https://trust.okta.com/"
    }
  ],
  "requestTimeoutSeconds": 30,
  "maxChars": 40000,
  "delivery": "dataset",
  "datasetMode": "changes_only",
  "notifyOnNoChange": false,
  "snapshotKey": "trust-center-subprocessor-monitor-snapshots",
  "diffMode": "line_summary",
  "summaryMaxLines": 15,
  "concurrency": 3,
  "batchDelayMs": 500,
  "dryRun": false
})

for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / Node.js

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_API_TOKEN' });
const run = await client.actor('taroyamada/trust-center-subprocessor-monitor').call({
  "vendors": [
    {
      "id": "okta",
      "name": "Okta",
      "criticality": "high",
      "owner": "Security / Legal",
      "tags": [
        "iam",
        "renewal-q4"
      ],
      "subprocessorsUrl": "https://www.okta.com/trust/subprocessors/",
      "trustCenterUrl": "https://trust.okta.com/"
    }
  ],
  "requestTimeoutSeconds": 30,
  "maxChars": 40000,
  "delivery": "dataset",
  "datasetMode": "changes_only",
  "notifyOnNoChange": false,
  "snapshotKey": "trust-center-subprocessor-monitor-snapshots",
  "diffMode": "line_summary",
  "summaryMaxLines": 15,
  "concurrency": 3,
  "batchDelayMs": 500,
  "dryRun": false
});

const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Tips & Limitations

• Schedule weekly runs against your production domains to catch config drift.
• Use webhook delivery to pipe findings into your SIEM (Splunk, Datadog, Elastic).
• For CI integration, block releases on critical severity findings using exit codes.
• Combine with ssl-certificate-monitor for layered cert + headers coverage.
• Findings include links to official remediation docs — share with dev teams via the webhook payload.

FAQ

Is running this against a third-party site legal?

Passive public-header scanning is generally permitted, but follow your own compliance policies. Only scan sites you have authorization for.

How often should I scan?

Weekly for production domains; daily if you have high config-change velocity.

Can I export to a compliance tool?

Use webhook delivery or Dataset API — formats map well to Drata, Vanta, OneTrust import templates.

Is this a penetration test?

No — this actor performs passive compliance scanning only. No exploitation, fuzzing, or auth bypass.

Does this qualify as a SOC2 control?

This actor produces evidence artifacts suitable for SOC2 CC7.1 (continuous monitoring). It is not itself a SOC2 certification.

Related Actors

Security & Compliance cluster — explore related Apify tools:

• Privacy & Cookie Compliance Scanner | GDPR / CCPA Banner Audit — Scan public privacy pages and cookie banners for GDPR/CCPA compliance signals.
• Security Headers Checker API | OWASP Audit — Bulk-audit websites for OWASP security headers, grade each response, and monitor header changes between runs.
• SSL Certificate Monitor API | Expiry + Issuer Changes — Check SSL/TLS certificates in bulk, detect expiry and issuer changes, and emit alert-ready rows for ops and SEO teams.
• DNS / SPF / DKIM / DMARC Audit API — Bulk-audit domains for SPF, DKIM, DMARC, MX, and email-auth posture with grades and fix-ready recommendations.
• robots.txt AI Policy Monitor | GPTBot ClaudeBot — Detect GPTBot, ClaudeBot, Google-Extended, and other AI crawler policies in robots.
• Data Breach Disclosure Monitor | HIPAA Breach Watch — Monitor the HHS OCR Breach Portal for new HIPAA data breach disclosures.
• WCAG Accessibility Checker API | ADA & EAA Compliance Audit — Audit websites for WCAG 2.
• 📜 Open-Source License & Dependency Audit API — Audit npm packages for license risk, dependency depth, maintainer activity, and compliance posture.

Cost

Failed vendors are not charged. If every monitored source for a vendor fails (the vendor gets status: "error"), that vendor is not written to the dataset, so it is not billed. It is saved in the run's key-value store record FAILED_ROWS (and in the OUTPUT record), and the run status message says how many vendors failed. Webhook delivery is unchanged.

Pay Per Event (current Store prices):

• Result vendor row: $0.01 per vendor row written to the default dataset (no separate start fee)

Example: 1,000 vendor rows = 1,000 × $0.01 = $10.00

No subscription required — you only pay for what you use.

⭐ Was this helpful?

If this actor saved you time, please leave a ★ rating on Apify Store. It takes 10 seconds, helps other developers discover it, and keeps updates free.

Bug report or feature request? Open an issue on the Issues tab of this actor.