Skip to content
How it works

Four steps, and one of them is honest about what we don't know.

Traversal is the product. Everything else exists to keep the output trustworthy enough to act on.

01

Add a vendor

Search any company and follow it, or upload the inventory CSV you already keep. Free accounts watch one vendor at depth 1.

02

We traverse the whole chain

Their subprocessors, and theirs, until the chain terminates. Cycles are detected, entities deduplicated, and depth stored as the shortest path from your root.

03

We classify and suppress

Every diff is typed as one of the changes below. Copyright years and whitespace churn never reach you.

Entity addedEntity removedJurisdiction shiftCategory shiftOwnership shiftTerms changedAnnounced additionAnnounced removal
04

Your rules decide who hears

Conditions over type, country, region, category and depth. Severity, channel and immediate-or-digest are set per rule.

Termination states

Three states, never collapsed into two.

A vendor that publishes nothing is a fact. A vendor we have not reached is a gap. Conflating them understates your risk, so we don't.

Resolved

We found and parsed this entity's own subprocessor list.

resolved
Publishes nothing

That entity discloses no list. That is a known fact about it, and it counts as answered.

publishes_nothing
Not yet crawled

We have not reached it. Counted against coverage, and never hidden inside the number.

not_yet_crawled
Rules

Conditions over codes, not over words.

Rules match on change type, country, region, category, depth and entity ID. Names are deliberately not matchable: companies get renamed, and the same company is spelled differently in different languages. Write a rule in Danish and it evaluates exactly as one written in German.

change.typeentity.countryentity.regionentity.categoryentity.parent_countrypath.depthvendor.id
No new processing outside the EEA, anywhere beneath my critical vendors
IF   change.type = entity_added
AND  entity.region NOT IN [EU, EEA]
AND  vendor.id IN [critical vendor set]
THEN severity = critical
     channels = [email, slack]
     delivery = immediate
Every rule can be dry-run against your current graph before you save it, so you know what it would have caught.

Start with one vendor. Free, and no card.

Search a company, follow it, and see the chain beneath it. Upgrade when one vendor stops being enough.