Trust Centers: Subprocessor listings
Overview
Subprocessor listings are only available on Trust Exchange Paid plans
A subprocessor is a third party that processes personal data on your behalf as part of delivering your product or service. You can maintain a list of subprocessors on your Trust Center so that prospects, customers, and regulators can see who is in your data supply chain without having to ask.
How it works:
- You build your list. Add each subprocessor that processes personal data on your behalf.
- You describe each entry. Record the legal entity name, what the vendor is used for, and where it processes data, along with any context your customers need.
- You publish it to your Trust Center. The list appears as its own section, with a last-updated date, on your public Trust Center.
- Customers subscribe for changes. Visitors to your Trust Center can subscribe to be notified when your subprocessor list changes.
- You keep it current. When you add, remove, or update a subprocessor, subscribers are notified automatically.
Subprocessor detection
If your organization uses Vendor Risk or Breach Risk, UpGuard can suggest subprocessors automatically, so you don't have to build your entire list by hand. Subprocess detection draws on two sources:
- Vendor Risk: the vendors on your third-party list are offered as subprocessor suggestions. Upgrading to Vendor Risk Paid lets you monitor more vendors, which widens the pool of suggestions.
- Breach Risk: the products detected running on your internet-facing assets are offered as suggestions — including services you may not have realized your organization was using.
Suggestions aren't published automatically. You review each one, confirm it against your agreement, and then add it to your list, so you stay in control of what appears on your Trust Center.
If you don't use Vendor Risk or Breach Risk, you can still maintain a complete subprocessor list manually in Trust Exchange, adding each vendor one at a time.
To learn more, see the UpGuard Pricing page.
Change notifications
Visitors to your Trust Center can subscribe to subprocessor updates. UpGuard then emails them whenever the list changes materially, i.e.:
- A subprocessor is added or removed.
- The values on a subprocessor’s fields (for example, the Purpose or Data region) are updated.
🎵 Webhook integrations are also available for subprocessor notifications, allowing you to send change events directly to your own systems. To learn more, see How to integrate UpGuard with other services using webhooks.