← Vendor change evidence

How do I track when a vendor changes its subprocessors or privacy policy?

A vendor adds a subprocessor. The page updates. No email arrives, or one arrives in a monthly digest nobody opens. Nine months later an auditor asks how you review changes to your processors, and the honest answer is that you look when you remember to.

The control that closes this is unglamorous: dated snapshots, compared on a cadence, kept as a record.

Open the free vendor change comparison

What to snapshot

• Subprocessor list. The one with a contractual clock attached — new entries can mean new companies or new countries handling personal data.
• Privacy notice. Changes to purposes, retention, or international transfers.
• Terms of service or DPA. Liability, termination, and data-return language.
• Security or trust page. Certifications that lapse quietly, and claims that quietly soften.

Why the vendor's own notification is not the control

Notification depends on the vendor's list being current, on the address they hold, and on the mail arriving somewhere a person reads. All three fail routinely, and none of them fail loudly. A snapshot you took is a fact you hold; a notification you did not receive is indistinguishable from nothing having changed.

Inconclusive is a result

The failure mode that makes a monitoring control worse than none is a clean "no changes" produced by a fetch that never happened. When a snapshot records a non-ok status — timeout, blocked, or anything else — the comparison reports inconclusive rather than stable, and says which side failed. A gap you can see is recoverable; a gap that reads as reassurance is not.

How to use it

1. Capture snapshots of the pages you monitor, with dates and a fetch status, on whatever cadence your agreements imply.
2. Run the comparison over the previous and current snapshot. It runs locally and never contacts the vendor or uploads anything.
3. Export the Markdown or JSON report and file it with the date you reviewed it.
4. Read the diff yourself. The report is evidence of what differs, not a judgement about what it means.

The tool reports evidence only. It does not decide whether a contract, a security posture, or a compliance status has changed — those are legal and commercial questions about your agreement.

Common questions

How do I track when a vendor changes its privacy policy or subprocessor list?

Capture a dated snapshot of the pages you care about — privacy notice, terms, subprocessor list, security page — on a regular cadence, then compare each new snapshot against the previous one and keep the resulting diff as your review record. What matters for an audit is not only that you noticed a change but that you can show the two versions, the dates, and the date you reviewed it. Relying on the vendor's own notification is not a control, because notification is exactly what tends to fail.

Why is a subprocessor list worth monitoring specifically?

Data processing agreements commonly give the customer a right to be informed of new subprocessors, and sometimes a window to object, because a new subprocessor can mean personal data reaching a new company or a new country. That right is only usable if you notice in time. A page that gains a line without an announcement is the ordinary case, so a dated diff is the practical way to keep the clock meaningful.

What happens if a snapshot could not be captured?

The report is inconclusive rather than stable. A snapshot that timed out, was blocked, or failed for any other reason is recorded with its non-ok status and the comparison says so explicitly. This matters because the dangerous failure mode for a monitoring control is a clean 'no changes' produced by a fetch that never happened.