Subprocessor Chain Auditor
Maps where personal data actually ends up
6 of 8 subprocessors have a gap in the chain.
8 subprocessors checked. 6 are flagged for 17 points across the chain.
Fix CDN Edge (via CloudHost) first. Tier T2 holds the most gaps.
Whether the agreement terms are adequate needs a lawyer: this checks that the chain is covered.
Why rows were flagged
- Not audited in a year56%
- No signed agreement22%
- Transfer region not approved22%
Value flagged by Tier
- T23
- T13
Items to act on, worst first
| Item | Tier | Value | Days since audit | Why |
|---|---|---|---|---|
| CDN Edge (via CloudHost) | T2 | 7 | 0 | No signed agreement, Transfer region not approved, Not audited in a year |
| Analytics Pro | T1 | 4 | 0 | No signed agreement, Not audited in a year |
| SupportDesk | T1 | 3 | 200 | Transfer region not approved |
| MailSend Ltd | T1 | 1 | 667 | Not audited in a year |
| BackupVault (via CloudHost) | T2 | 1 | 486 | Not audited in a year |
| SMS Gateway (via MailSend) | T2 | 1 | 0 | Not audited in a year |
What to do this week
- Sign a data processing agreement with CDN Edge (via CloudHost) or stop sending it data.
- Check where T2 sub-subprocessors move data, and approve or block each region.
- Audit or obtain a certificate from every subprocessor not checked in a year.
Do
- Fix the highest-risk item first, then run the check again on fresh data.
Don't
- Don't act on one row alone: open the source record first.
How to improve
- Add more detail per row (owner, date, source) so the next report can trace each item.
- Add a second period of data so the next report can show whether things are improving.
Demo
Overview
Data protection obligations follow personal data wherever it goes, including to every subprocessor your own processors engage. Almost nobody can produce that map. They can list their vendors — that is a procurement record — but the layer below is a set of web pages each vendor maintains separately and can change without asking.
The gaps are consistent. A processor used with no data processing agreement at all, usually because a team adopted the tool rather than procuring it. An agreement that predates the current scope, covering a service that has since expanded. Personal data reaching a country the agreement never contemplated. A vendor's subprocessor list changed while nobody watched, because the contract only required them to publish the change rather than notify anyone.
And the record of processing itself — the register most regimes require you to maintain — was written once during a compliance project and has described a fictional company ever since.
This agent builds the chain from your own records, compares the register against what is actually in use, and names every gap. It gives no legal advice and makes no compliance determination: it reports what the documents say and what is missing, and whether that amounts to a failure is a lawyer's judgement about a specific regime.
Benefits
You can answer the question
"Where does our customer data go?" — asked by every enterprise buyer.
Gaps found before an audit
Or before a customer's diligence finds them for you.
A register that is true
Which is the point of having one.
What it does
Maps the layer below your vendors
Your processors' own processors. A set of web pages they can change without telling you.
Finds processing with no agreement
Usually a tool a team adopted rather than procured. The most common gap and the easiest to prove.
Catches scope that outgrew the agreement
The agreement is real and signed, and describes a service that has since expanded past it.
Flags unexpected locations
Personal data reaching a country the agreement never contemplated, via a subprocessor you never chose.
Tests the register against reality
Most records of processing were written once and have described a fictional company ever since.
Gives no legal advice
It reports the gaps. Whether one is a breach is a judgement about a specific regime, for a lawyer.
What this changes
What this changes about your week
- It takes over
- Mapping where personal data actually ends up, past your own vendors.
- Done today by
- Written once during a compliance project and never revisited.
- How often
- Annually on paper.
- Typical manual effort
- Every agreement read against every vendor's own subprocessor list.
Why Legal in particular. You know your vendors; the layer below is web pages each vendor can change without telling you. And the register most regimes require has described a fictional company since the day it was written.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Subprocessor Chain Auditor has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- Your processors and what each is used for
- Data processing agreements, in a knowledge base
- Vendor subprocessor lists, with the date you captured them
- Your record of processing activities
- Requires the All-Access plan or higher
Use cases
Annual register review
What is actually processing data, against what the register says.
Enterprise diligence
The chain, ready before a buyer asks for it.
Before adopting a vendor
What their own chain adds to yours.
After an incident at a vendor
Which of your data was in reach, through which link.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Is this legal advice?
No, and it gives none. It reports what your documents say and what is missing. Whether a gap is a breach of a specific regime is a question for your own counsel.
Does it check vendor websites for changes?
It works from what you supply. Vendor subprocessor pages change without notice, so it reports the date of the list you gave it and flags anything older than the review window you set.
Does it contact vendors?
No. It produces the questions to send; sending them is yours.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent