Vendor list only
Our subprocessors and vendors that handle customer data are listed here: [URL]. The table includes purpose, processing location where applicable, and links to provider data terms. List last updated [date].
Security review guide
How to answer the usual security-review asks
A company's security team needs to see who touches customer data, whether agreements exist, and how they hear about changes.
What you are trying to do
You are not trying to look like a SOC 2 program. You are trying to give honest, current answers they can paste into the review.
Work in this order when a deal is waiting.
If you do not have a SOC 2 report, the full reply for a vendor security questionnaire is in the security questionnaire guide.
- List every provider that stores, processes, or can read customer data.
- Link or attach the data-processing terms each provider offers.
- Say how you tell customers when that list changes.
- Send one stable link if they will accept a page instead of a one-off file.
Vendor list or subprocessor list
What they ask
Names of vendors, subprocessors, or third parties; purpose; location; sometimes a link to terms.
What to include on the page or in the table
- CompanyLegal or product name the reviewer will recognize.
- PurposeWhat they do with customer data (hosting, email, payments, support, analytics, error tracking).
- LocationCountry or region where data is processed, when the form asks.
- AgreementLink to the provider's DPA or data terms when you have one.
- UpdatedDate you last checked the row.
How to answer in the questionnaire
Paste the table, or write: "We maintain a public list at [your URL]. It includes purpose, location where relevant, and agreement links. Last updated [date]."
Vendor vs subprocessor
"Vendor" is broad. A subprocessor usually means a provider that processes personal data on your behalf. Use the word the questionnaire uses and match your customer agreements.
What not to claim
Do not say you have certified SOC 2, ISO 27001, or HIPAA unless you do. Do not copy a big-company trust center layout and leave empty policy sections. Do not list a tool you forgot to turn off in production.
More detail on why reviewers ask, and why a living page helps, is in the vendor list guide.
A table you can copy, with example rows, is in the subprocessor list template.
DPA (data processing agreement) asks
What they ask
A signed DPA, a link to standard terms, subprocessors covered, or your own DPA template.
What to do
- For each provider on your list, link to that provider's standard DPA or data processing addendum. Most SaaS vendors publish one.
- If the company sends their DPA for you to sign, route it to whoever owns contracts at your company. Do not sign in the questionnaire box.
- If you are the processor for their end users, you may need your own DPA template. That is legal work, not a trust-page feature. Say you will follow up on paper and still send the vendor list now.
What to put on the page
An Agreement or DPA column with links. If a provider has no public DPA, say "standard terms at [vendor privacy URL]" and note you will attach on request.
What not to claim
Do not mark every row "DPA executed" unless you actually executed one. Do not promise GDPR Article 28 language you have not reviewed.
When a vendor will only share that DPA on a higher plan, the steps are in the vendor DPA guide.
Change notice asks
What they ask
How customers learn when you add or remove a subprocessor, or when a vendor's role changes.
What to say when you do not have automated email yet
- "We update the public vendor list when providers change. The page shows a last-updated date and a change history."
- "Material changes are communicated to customers under our [master agreement / privacy policy notice clause]." Only say this if it is true in your contracts.
- If they need 30-day notice, check your MSA and each vendor contract. Do not invent a notice period.
What to put on the page
A visible "List updated" or per-row "Updated" date, and a change history that shows what was added or removed and when. Add a short "How we notify you" note that says what you actually do, such as "We email customers named in our agreements before a new vendor starts, and we update this list the same day."
What not to claim
Do not promise subscriber email alerts or webhooks unless you ship them. Trust Prep does not send those emails for you. Do not promise audit logs you do not keep: the change history on a Trust Prep page is a dated list of vendor changes, not a full audit log.
A short email to send, and a note on what to record, is in the subprocessor change notice.
What belongs on a simple trust page
Enough for most early-stage reviews:
- Company name and one-line product description
- Security contact email (a real inbox someone checks)
- Vendor or subprocessor table (fields above)
- Last-updated date on the list, and a change history or a short "How we notify you" note when you have one
Leave these out unless they are true and you keep them current: penetration test reports, SOC 2 badges, policy libraries, control matrices, and "compliant with" checklists you cannot substantiate.
What to write on the penetration-test row, when you have not had an independent test, is in the penetration test guide.
Plain language, current dates, no marketing superlatives. Reviewers prefer a short honest page over a polished empty shell.
Copy-paste snippets
Edit the bracketed parts.
DPA follow-up
Standard DPAs or data processing terms are linked in the vendor table. If you need a countersigned agreement, reply with your template and we will route it for signature.
Change process
We update the public list when we add or remove providers that process customer data. The page shows when the list was last reviewed and a dated history of changes. Contractual notice terms are in our [agreement name].
Related guides
Optional next step: a living page
If you want one link to send on every review instead of rebuilding a spreadsheet, you can host the table on a public page you edit when tools change.
Trust Prep (trustprep.io) is built for that workflow: paste or upload your list, preview, then publish a public link made from your company name. Reviewers open it without an account. Copy table and Download spreadsheet are on that page. You can work on the list before you pay to publish the link. Publishing turns on after we confirm your payment.
Use these answers, adapt them, and keep them true for your product today.