Vendor list guide
A security review wants the companies that handle customer data, and a way to see that list is still current. A public page does both.
A security questionnaire often asks which vendors touch customer data. The reviewer wants the names, what each vendor does, and a sign that the list is still current.
A company is about to trust you with customer data. Their security team still owns that data after it leaves their systems. They need to know which other companies store it, move it, or can read it.
Hosting, email, payments, support, and error tracking can all belong on the list. A reply from memory or a document from last quarter leaves the reviewer asking whether it still matches the product.
Name each company that handles customer data, explain its role, and give the reviewer enough detail to understand the relationship.
A table you can copy, with example rows, is in the subprocessor list template.
How to answer the vendor security questionnaire when you do not have SOC 2 is in the security questionnaire guide.
What to do when a vendor will only share a DPA on a higher plan is in the vendor DPA guide.
Whether a model provider belongs on that list, and how to describe it, is in the AI provider guide.
How to tell a controller, a processor, and a subprocessor apart, and which vendors belong on the list, is in the controller and processor guide.
What to write when they ask if customer data is encrypted, and who manages the keys, is in the encryption guide.
What to write when they ask what data each vendor can see, and what does not reach it, is in the data access guide.
The list names the companies that handle customer data. What to write for who on the team can still open it is in the access review guide.
The identity company belongs on the list only after you type that row. What to write when they ask if you support single sign-on is in the single sign-on guide.
If you are weighing VendorLens against a thin paid vendor list page, see the VendorLens comparison guide.
If you are deciding between a free trust page and paying to publish, see Trust Prep vs a free trust page.
A vendor list for that question works better as a page. Anyone with the link opens it, reads the vendors, and sees when you updated it. The next time a tool changes, you edit the same list and send that same link on the next questionnaire.
No login is required and no file goes stale in an inbox. Add a tool or drop one, and the address you already sent still works.
The form does not always use the same word. Vendor is the broader term. A subprocessor is a provider that processes personal data on your behalf. Follow the wording in the questionnaire and your agreements.
If the deal is waiting on that answer, start with the list. Create the page, add the vendors that touch customer data, and send the link back to the reviewer.
Security reviewers open a public link made from your company name, without an account. Send that page. Keep the spreadsheet or Notion page for internal notes.
Paste the list you already have, or upload the spreadsheet. Anyone with the link reads the names, what each vendor does, and when the list was updated.
If a reviewer wants a file, Download spreadsheet is on that page. Use Copy table if they need the rows in the reply.
You can create the page and preview it before you pay. $19 a month. Lock it in today to publish the link a security reviewer opens. Publishing turns on after we confirm your payment.
Not always. Vendor is a broad term for an outside provider. A subprocessor is a provider that processes personal data on your behalf. A questionnaire may use either term, so answer the wording it uses and check your agreements.
Update it when a provider starts or stops handling customer data, or when its role changes. A visible update date helps the next reviewer tell that the list still matches the product.
Yes. Anyone with the link can read the page without signing in. They can also copy the table or download the spreadsheet when they need the rows in another format.
Bring the list you already have, and send a public link made from your company name.