How to tell customers you added or replaced a vendor

What the notice should name

A customer should be able to see what changed without opening a second document.

• VendorUse the company name a customer will recognize.
• What it doesSay the job it performs with customer data, such as hosting, email, or support.
• What dataName the customer data it will receive, store, or be able to read.
• Where it processesName the country or region when you know it, and say so when you do not.
• Effective dateGive the date the change starts, or the date a vendor stops.

If the vendor's own page does not name a place, say that you do not know it yet. Do not guess a country.

The number of days is in your agreement

A notice period, and any window to object, usually sits in your contract with that customer, or in the data processing agreement you signed with them.

Open that agreement and use the clause that is there. Write a number of days only when the contract states one. There is no universal number of days to paste in.

If the agreement says nothing about notice, say so. Do not promise a window you cannot point to. If the clause is unclear, ask a lawyer.

Keep a record of who you told

After you send the email, write down who received it and the date you sent it. A line is enough: the customer, the address you used, the date, and which vendor the note was about.

Keep that line in your own mail, or in the document where you keep the review. If a customer objects, keep the objection and your reply in that same place.

What saving a row does

Saving a row updates the public vendor list and the date on that row. That date is the day you saved the row. It is the day you last checked the company, what it does, where processing happens, and the agreement link.

That date is not the effective date in your email, and it is not a record of who you told. The row can hold the company, what it does, where processing happens, a link to the agreement, and that date. It does not hold the kind of data you named in the email.

Once the page is public, Trust Prep also adds a dated entry to the Change history on your page when you add or remove a vendor, or change what it does, its name, or where it processes. A changed agreement link alone is not logged. Entries are newest first, and you can delete one made by mistake. Automatic vendor history starts only after the page is public. A note you add yourself can be saved before publishing and appears when the page is public.

The page can also carry a short note called How we notify you, up to 400 characters, with its own last updated date. You write it in the Changes section of the editor. The editor offers suggested wording, and nothing is published until you save it. The note tells a reviewer what you do. It does not send anything.

Trust Prep does not email customers, does not track objections, and does not send notices. The email, and who received it, stay in your own mail.

If you want the longer notes

How to answer the question about how customers hear of a change is in the security review guide.

How to answer the change row on a questionnaire without SOC 2 is in the security questionnaire guide.

A table you can keep current, with the columns a reviewer expects, is in the subprocessor list template.

How soon you tell the customer about an incident is a different clock. What to write on that row is in the incident notification guide.