Company names

When the company names do not match

A reviewer flags the list when the data processing agreement, the privacy policy, and the vendor list use different names for the same company. Write one name they can trace, and keep the other name beside it.

This is a practical note for a security review, not legal advice.

Updated October 7, 2026

Why a reviewer flags it

They are checking that the companies that touch customer data are the same set in every document you sent.

A brand in the privacy policy, a legal name in the agreement, and a short name on the list look like three companies. They can also look like a company you left off.

The review waits until you can point from each of those names to the same row.

Three ways the names drift

Read the agreement and the privacy policy you would actually send. Compare those names with the vendor list, one company at a time.

Brand and legal entityThe list says the product name. The agreement says the company that signed it. Put the name from the agreement on the row. Put the brand next to the job, so a reviewer who searches the product name still finds the row.
Parent and subsidiaryThe contract is with a parent, and a subsidiary does the processing, or the other way around. List the company that processes the customer data. If a different company signed, name the signer next to the job. Do not add a second row for the signer unless that company also receives the data.
Renamed or acquiredThe agreement still uses the name from before a rename or an acquisition, and the product is now sold under a new one. Use the name on the agreement you are relying on. Say what the product is called now, and the date you checked. Do not replace the agreement's name with a name you have not seen on a current page.

Lines you can paste

Use the line that is true. Replace the brackets. Delete anything that is not true for this vendor.

Brand and legal name
We list [legal name], the company named in the agreement at [link], last checked [date]. [Brand] is the name on the product.

Parent and the company that processes
The agreement is with [signing company]. [Processing company] processes the customer data, so that is the name on the list. Last checked [date].

An old name after a rename or an acquisition
The agreement still names [old name]. The product is now [new name]. We list [name on the agreement] so the row matches the paper we have. Last checked [date].

How to write each row

The company name on the row is one name. Use the name on the agreement you are sending. If the only page you have is a privacy policy, use the name that policy uses for the company that receives the data, and say the policy is the source.

Next to that name, say the job. Add the brand, the product, or the former name when a reviewer would search for that instead of the legal name.

The agreement link is the page you opened. A reviewer traces the name by opening it. The date is the day you compared the documents.

If two documents still disagree, do not invent a third name. Send both names, and say which document uses which. This note does not draft the agreement or the privacy policy, and it does not decide which legal name is correct. If you are unsure which company processes the data, ask a lawyer.

What the vendor list can hold

The list row holds the company, what it does, the processing location, a link to the agreement, and the date you last checked it. The company is one name. The row does not hold a second name, and it does not keep a copy of the agreement or the privacy policy.

For a few common vendors, the editor can suggest a processing location or a public agreement link. Nothing is added until you use that suggestion. A suggestion does not fill in a legal name.

Trust Prep does not compare the name on the row with a data processing agreement or a privacy policy, and it does not email anyone.

A name, a location, or an agreement link shows on the public page only after you save it. You can save the row while the location or the agreement link is still blank. The company and what it does are required.

How to keep one list for the questionnaire and the page you send is in the security questionnaire guide.

What to do when a vendor will only share the agreement on a higher plan is in the vendor DPA guide.

What to put on the row for a model provider is in the AI provider guide.

Optional next step: a living page

The lines above are enough for the review in front of you.

If you want one link for the companies that handle customer data, Trust Prep publishes that vendor list as a page you edit when a company changes. The row can name the company, what it does, the location, the agreement link, and the date you last checked it. Reviewers open a public link made from your company name, without an account. You can fill in the list and preview the page before you pay to publish the link. Publishing turns on after we confirm your payment.

The page stores the name you save. It does not check that name against an agreement or a privacy policy.

Create your trust page