Vendor list document

The vendor list document presents the providers recorded in your workspace: what each one is used for, which data it handles and where it processes it. It is the document clients usually ask for during a security review or onboarding.

#What it shows

For each vendor: its name, its purpose, the data involved and the processing region. Roles and agreement details stay in your workspace unless you decide to share them.

#What it needs

The checklist asks for at least one vendor and, for each vendor, a region, a purpose and the data involved. The processing region is never guessed, so it is usually the field you need to add. See Data location.

#Sharing

Download the validated list as a PDF to attach to an answer, or show it in your privacy center so clients find it without asking.

#Subprocessors

If you process data for clients, the vendors you use to serve them are your subprocessors. The data processing agreement lists only those vendors, and you choose how clients authorise changes.

#FAQ

#Is the vendor list a legal requirement?

The GDPR does not name a standalone vendor list. You must know who processes data for you, have the right contracts and tell people about the recipients of their data. A maintained list is the practical way to do all three.

#Can I hide a vendor from the public list?

Public pages show vendors with their name, purpose and region. Review your list before publishing and remove tools you do not want to show.