How the Privacyboard vendor catalog is verified: every page opened and read
A tool only gets a public Privacyboard vendor page after its data processing agreement page has been opened and read, not guessed from a homepage. A verified entry shows what the vendor publishes, the usual role and where data is typically stored, with the date it was read. It proves the page exists and says what we note. It does not prove that you are covered or that the vendor is compliant.
Privacyboard has a catalog of 550+ common tools, from payment providers to email platforms and analytics. When you add one to your workspace, its purpose, data and a suggested role are prefilled. A wrong link or a wrong region in a public document is worse than an empty field, so the catalog follows one strict rule: a tool is not published until we have opened and read its agreement page.
#What does "verified" mean here?
For each tool in the catalog we open the vendor's own data processing page, read its title and content, and record what it is. We do not guess URLs, and we do not accept a bare company homepage as a reference. An automated test in our code base rejects a catalog entry that points to a homepage.
A verified entry records:
- the link type (the agreement itself, a PDF, a preview, a help article or an explanatory page),
- the address of the vendor's own document,
- a short note about anything we noticed when we opened it, such as the effective date shown on the page or the plans it covers.
Only tools that passed this check get a public page in the vendor guide. Tools added later, and not yet checked, do not get one.
#What are the link types?
Vendors do not all publish their agreement the same way. We say which kind of page you will find, so you know what to expect before you click.
| Link type | What it means | Example of what we have noted |
|---|---|---|
| Agreement (DPA) | The agreement text is published on the vendor's own domain | A hosting or payments provider whose DPA page names its plans and effective date |
| Agreement (PDF) | The agreement is a downloadable document, often versioned | A cloud provider whose DPA applies through its service terms with no separate signature |
| Preview | A non-binding copy is shown, and the binding version is generated in the product | An analytics tool that countersigns the final version in its app |
| Help article | The agreement is explained or hosted in the vendor's documentation | A membership tool that publishes a DPA article in its help centre |
| Info or contracts page | The vendor does not publish the text and explains how you get or sign it, usually inside your account | An email platform whose DPA is an appendix of its terms of use |
These examples describe what we read on the date of our check. Vendors change their terms, which is why every entry carries a date.
#What does a verified page not prove?
Three things, and we say so on each page.
- It does not say you are covered. A page that exists does not mean the agreement applies to you. That depends on your plan and on what you accepted. Whether you have signed or accepted it is your own decision, recorded in the data processing agreement status of your vendor list.
- It does not certify the vendor. Privacyboard does not rate, score or certify vendors. When a page answers "Is this tool GDPR compliant?", it explains that compliance depends on how the tool is configured and used, on your agreement and on your own practices.
- It does not replace reading the agreement. The page gives you a short checklist of what to look for: who the parties are, which data and purposes are covered, sub-processors, transfers outside the EEA, breach notification and what happens to your data when you leave. For your own review process, see vendor privacy due diligence: a 12-point checklist.
In a few cases we note that we could not read the whole agreement, for example when the DPA is an appendix of the terms of use and we did not read the appendix text itself. We prefer to say so rather than round it up.
#How are roles and data regions sourced?
Roles. For many tools, the usual reading is that the vendor is a processor acting on your instructions, and that is what Privacyboard suggests. For others, the role depends on how you use the tool. In that case we do not prefill anything: you are asked to choose, because the answer changes what your privacy policy says and which agreement matters. See data processing agreements explained for the difference.
Regions. A region often depends on how you configured the tool, for example the region you picked when you created a project. When a vendor states where it keeps data, we show what it says, with the date we read it and the source page. When it does not, the page tells you where to look in your own console or settings. A region is never written into your record on its own: it stays a suggestion until you confirm it. If the region is outside the European Economic Area, Privacyboard flags it, because Articles 44 to 49 of the GDPR then require a transfer mechanism. Our overview of international transfers explains the options.
#How do we keep entries fresh?
Vendors move and rename documents, and versioned PDFs are the most likely to change. Our own rules are simple:
- the full list is re-checked every six months, and before any large release,
- a script lists any region source or reference page whose check date is older than 180 days,
- a wrong link reported by a user is checked and fixed.
The dates shown on pages are the dates of our checks, not a promise that nothing has changed since. If your decision depends on a vendor's terms, read the live document on the day you decide.
#Why publish this at all?
Two reasons. First, a vendor list you cannot trust is worse than none: it gives a false sense of order. Second, the same catalog feeds your privacy policy, vendor list, data processing agreement and privacy center, so an error would be copied into four places. We would rather be explicit about what a checked entry means. For the bigger picture, read why we built Privacyboard.
#FAQ
#Does a vendor page mean the vendor is GDPR compliant?
No. A vendor page shows what the vendor publishes: its agreement, its usual role and where data is typically stored. Privacyboard does not certify vendors, and compliance depends on your configuration, your agreement and your own practices.
#How often are the pages re-checked?
The whole catalog is re-checked every six months, and a script flags any entry whose evidence is older than 180 days. Each page shows when it was last read, so you can judge how recent it is.
#Why is a tool I use not in the catalog?
Only tools whose agreement page has been opened and read get a public page. You can still add any tool to your vendor list by hand in your workspace and fill in its role, region and agreement yourself.
#What if I find a wrong link?
Write to us from the contact address on the terms page. We will open the page again and correct the entry.
#Can I rely on the data region shown on a vendor page?
Treat it as a starting point. Many vendors let you choose a region per project or account, so confirm it in your own settings before you publish it in your privacy policy.
#Sources
Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.