What to write when a vendor will not name one country

Read the vendor's own page

Open the page for the product and plan you pay for. Look for where they process customer data: a data location page, their subprocessor list, or their data processing terms.

A homepage that says global is not a location. A menu of every region they sell is not the same as the place that holds your customer data.

Prefer the page that names a country or region. A privacy policy, a status page, or a blog post is a weaker source. Write down the date you opened the page you trust.

One place, several places, or none

Write what you read. Do not guess a country to make the cell look finished.

• One placeWrite that country or region, in their words. United States is enough when that is the sentence on the page.
• Several placesWrite the phrase they used, such as United States and European Union, and do not pick one country from a longer list.
• Global, or nothingLeave the cell blank, or write the short phrase they used, such as Global, so the reviewer can see you did not invent a country.

If two pages disagree, use the one that covers your plan. If you still cannot tell, leave the cell blank and keep the link.

The region in the console is not the whole map

A region you select in a cloud console is where that account's resources run. It is the place you chose for your own deployment.

It is not, by itself, where their support team works, where backups sit, or where their own vendors process data.

If you selected a region, you can write that region and say it is the one you selected. Then read their data location page. If that page names other places, do not replace those words with only the console region.

The safeguard lives in the agreement

A transfer safeguard, such as standard contractual clauses, is a term in the agreement. It is not a country, and it does not belong in the location cell.

Link the agreement. The reviewer opens that link for the clause. This note does not say whether a transfer is allowed. If the clause is unclear, ask a lawyer.

What you can put on the row

Location is a line you fill for each vendor after you read their page. You can save the row while that line is still blank. The editor still notes that processing location is missing.

A small set of known vendors can suggest a processing location or a public agreement link, and only when their own public page states it. Stripe, Vercel, and Resend can suggest United States and an agreement link. Amazon Web Services and Google Cloud can suggest an agreement link and no location. Nothing is written until you use the suggestion. You can dismiss it.

The row holds the company, what it does, the location, a link to the agreement, and the date you last checked it. There is no column for a transfer safeguard. Trust Prep does not watch a vendor's location page, and it does not email anyone.

A location shows on the public page only after you save it on the row.

If you want the longer notes

A table you can copy, with more example rows, is in the subprocessor list template.

Whether an AI or model provider belongs on the list, including region, is in the AI provider guide.

How long you keep customer data, and what to write when a vendor will not name a period, is in the data retention guide.

Where the data is processed is a different line from whether it is encrypted. What to write for encryption is in the encryption guide.

The location cell is not where backups sit. What to write when they ask if you have restored a backup is in the backup restore guide.

Where an identity company processes data is the location cell, after you type that company. What to write when they ask if you support single sign-on is in the single sign-on guide.