What to do when a vendor will only share a DPA on a higher plan

Why the DPA sits on a higher plan

A free or cheap plan is often built for one person using the tool on their own. On many tools, only the business plan comes with a DPA, along with a company sign-in and a person you can write to.

That is a packaging choice. It does not tell you whether your current plan may handle customer data. This page does not decide that.

Sales will often answer a DPA request by naming the higher plan. The file they are holding back is usually their ordinary standard DPA, not a custom draft.

Look for a public DPA before you upgrade

Search the vendor's site for data processing agreement, DPA, and data processing addendum. Check the legal page, the privacy page, and any trust page.

Some vendors publish a standard DPA as its own page or file. Others fold it into the online terms, with a sentence that says the DPA applies when you use the product.

Read who that page says it covers. A public DPA that names the business plan does not cover a free account just because the file is on the internet. If the terms say the DPA starts only after you buy a higher plan, the link is still worth keeping, with that limit written next to it.

A privacy policy or a general terms page is not the same thing as a DPA. Link it if that is what they published, and say what it is. Do not call it a signed DPA.

You decide, with a lawyer if you need one, whether that public page is enough for the review. Trust Prep does not decide whether a terms page counts as a data processing agreement, or whether a company named on the vendor's own list is covered by it.

Ask for the standard DPA

Write to support. If only sales will reply, write to sales. Use this when it is true.

We are not asking you to negotiate a custom DPA. We need your standard DPA for a customer security review. We are on the [plan] plan.

Name the product and the plan you pay for. Give the date the reviewer needs an answer, if you have one.

If the first reply is only an upgrade, ask again for the standard document, and ask them to pass the note to privacy or legal.

Save the reply. A note that the DPA is only on a higher plan is a status you can show a reviewer. It is not a signed agreement.

What to write down when nothing is signed

A missing signature is a fact. Record three things, and do not describe them as more than they are.

• The linkThe public DPA, or the public terms page if that is all they publish. Open it once before you send the list.
• The statusOne line in the notes you keep for the review: public DPA, not countersigned; asked on a date, waiting; or sales says a higher plan only.
• The dateThe day you opened the page or sent the ask. Change it when you check again.

On the vendor list, the row holds the company, what it does, where data is processed, the agreement link, and the date you last saved the row. There is no status column and no place to attach the file. Put the link in the agreement field. Keep the status sentence in your own notes. You can save the row while the link is still blank.

For a few common vendors, the editor can suggest a public agreement link. Nothing is added until you use that suggestion. A suggestion is not a decision that the link covers your plan.

Do not write that a DPA is signed unless someone signed it. Do not write that a terms link covers a named company on the vendor's own list.

When it is reasonable to switch

• Ask for the standard document before you leave. The first upgrade email is not the decision.
• Switch when the vendor will not send a standard DPA on a plan you can use, the tool stores or can read customer personal data, and another tool does the same job and already publishes a DPA.
• Switch when a reviewer has said a privacy page is not enough and you cannot get the document before the date they gave you.
• Paying for the higher plan is a reasonable choice when this vendor is hard to replace and the DPA is the thing you are paying for. That is a cost decision. This page does not say which choice is lawful.

Sending your own contract for them to sign is a decision for whoever owns contracts at your company. This page does not draft that contract, and Trust Prep does not either.

How to answer the reviewer

Use this when it is true. Edit the brackets.

We use [Vendor] on the [plan] plan. They have not given us a countersigned DPA. Their public data terms are at [link], last checked [date]. We asked on [date] for their standard DPA and were told it comes with a higher plan.

If they published a DPA and you have not signed a separate copy, say that. Link the page. Do not write that the DPA is executed.

If all you have is a terms page, say that. Do not say the terms page satisfies a named law.

Point them at the same vendor-list row, so they open the link you checked instead of a different file from an old email.

If you want the longer notes

How to answer the usual DPA question on a security review is in the security review guide.

The agreement-link column, and a table you can copy, are in the subprocessor list template.

Why reviewers ask for the list is in the vendor list guide.

How to answer the rest of a vendor security questionnaire without SOC 2 is in the security questionnaire guide.

When the name on the agreement does not match the privacy policy or the vendor list, how to line them up is in the company names guide.